Privacy Policy

Effective 3 November 2026 · Version 1.0

1. Who is responsible for your data

CloseLoop Labs is a trading name of CloseLoopLabs, a sole trader based in the United Kingdom ("we", "us"). We are the controller of the personal data about you as a CloseLoop Labs user: your account, settings, usage and communications with us.

Your inbox also contains personal data about other people, such as the customers, suppliers and colleagues who email you. For that data you, as the business using CloseLoop Labs, decide why it's processed, and we process it on your behalf only to provide the service.

2. The personal data we collect

• Account data: your name, email address, Google account ID, company name and time zone.
• Connection data: the access keys Google issues so we can act for you. The long-lived key is encrypted before it's stored.
• Email data: when a brief runs we read the sender, recipients, subject, date and text of emails in your inbox. We keep a record of each email we sort: sender name and address, subject, date, Gmail IDs, the AI's category, summary and reason, any draft reply, and what you did with it. We do not keep full email bodies or attachments.
• Writing style: we read a sample of emails you've sent and keep a short written description of your style, not the emails themselves.
• Calendar data: your events, read when needed to show your day and week and to suggest free times. We don't store your calendar.
• Information you give us: your business description, team email addresses and brief settings.
• Usage and log data: an activity log of key actions (sign-ins, replies sent, emails moved or binned, settings changes) and technical logs from our hosting provider, such as IP address, browser and error details.
• Communications: emails you send us for support or feedback.
• Cookies: strictly necessary cookies only. See section 10.

We don't take card details yet. When billing starts, payments will be handled by our payment provider and we'll update this policy first.

3. How we use personal data, and our legal bases

• Providing the service (sorting your inbox, summaries, drafts, sending replies you approve, morning briefs): to perform our contract with you.
• Learning your preferences (your writing style, and senders you've moved between sections) so drafts and sorting fit you: to perform our contract with you.
• Support and service emails (answering questions, telling you about changes or problems): to perform our contract, and our legitimate interest in running the service well.
• Security and fixing problems (preventing misuse, investigating errors): our legitimate interests.
• Legal and tax obligations, such as keeping billing records once we charge: legal obligation.

We don't send marketing emails without your consent, and we make no decisions about you that have legal or similarly significant effects based solely on automated processing.

4. Google user data and AI

CloseLoop Labs's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In practice:

• We use Gmail and Calendar data only to provide and improve the features you use in CloseLoop Labs.
• We transfer it to others only as needed to provide those features (see section 5), for security, or to comply with the law.
• We never use it for advertising, and we never sell it.
• No person reads your email unless you ask us to (for example for support), or it's needed for security or to comply with the law.
• We never use it to train, develop or improve AI or machine-learning models.

To sort, summarise and draft, we send the relevant email text, your business description and your writing-style description to Anthropic's Claude API. Under Anthropic's commercial terms, data sent through its API is not used to train its models. AI can make mistakes, which is why nothing is sent from your account until you approve it.

5. Who we share data with

• Service providers who host, store or process data for us under contract and only on our instructions: Google, Vercel, Supabase, Anthropic and ImprovMX. The full list is on our Legal page.
• Professional advisers, such as accountants or lawyers, where needed.
• Authorities, where the law requires it or to protect rights and safety.
• A buyer or successor, if the business is sold or transferred. We'd tell you first.

We do not sell personal data.

6. International transfers

Our app runs in London, but some providers are based in, or may access data from, the United States and elsewhere. When personal data leaves the UK, we rely on UK adequacy regulations (including the UK–US data bridge where the provider is certified) or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

7. How long we keep data

• Account and settings: while your account is open. You can delete your account at any time in Settings > Privacy & data, and everything is deleted straight away.
• Sorted-email records, drafts and writing style: while your account is open. You can delete them straight away by disconnecting Google in Settings > Connected accounts and choosing to delete your data.
• Activity log: while your account is open, and deleted with it.
• Hosting logs: kept by our hosting provider for a short period, then deleted automatically.
• Billing records (once we charge): six years, as UK tax law requires.

Copies in our database provider's backups are overwritten in their normal cycle.

8. How we protect data

All traffic is encrypted with HTTPS, data is encrypted at rest by our providers, and your Google key gets an extra layer of encryption before it's stored. Only our server can reach the database. You sign in with Google, so we never hold a password for you. We only ever move email to Gmail's Bin, never permanently delete it, and nothing is sent without your approval. More detail is on our Security page.

9. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have it corrected if it's wrong;
• have it deleted;
• restrict or object to how we use it;
• receive a copy of it in a portable format (email us and we'll send it);
• withdraw consent where we rely on it.

Email privacy@closelooplabs.io and we'll respond within one month. You can also remove our access to Google at any time from your Google account permissions. If you're unhappy, please tell us first, but you can complain to the Information Commissioner's Office at any time at ico.org.uk or on 0303 123 1113.

If someone who emailed a CloseLoop Labs user wants to exercise their rights, they should contact that user first, as the business that controls their data. We'll help the user respond.

10. Cookies

We only use cookies that are strictly necessary to sign you in and keep sign-in secure. We don't use analytics or advertising cookies, so we don't need to ask for consent. See our Cookie Policy for the full list.

11. Children

CloseLoop Labs is for business use and isn't directed at anyone under 18.

12. Changes to this policy

We'll update this page and the date at the top whenever we change it. For material changes, we'll tell you by email or in the app before they take effect.

13. Contact

Privacy questions or requests: privacy@closelooplabs.io. Anything else: hello@closelooplabs.io.

Other policies: Terms of Service · Security · Cookie Policy · Legal