1. Who we are
Closr is a CRM for real-estate agencies. It is made up of the website at getclosr.io, the Closr web app and the Closr mobile apps for iOS and Android (together, the "Service").
The Service is provided by Closr Labs LLC, a Delaware limited liability company, 16192 Coastal Highway, Lewes, DE 19958, United States ("Closr", "we", "us"). Contact: support@getclosr.io.
We provide the CRM to real-estate agencies (our "customers"). Each agency decides which of its staff use the CRM and what data about its leads and clients it keeps there.
- For data about an agency's leads, clients and deals, the work its staff do in the CRM, and data received from platforms the agency connects (section 5), the agency is in charge of the data (the "controller"). We process it on the agency's behalf, under our agreement with the agency.
- For website visitors, account holders and billing, and how the Service itself is run, secured and improved, we are in charge of the data, and this policy explains what we do.
2. Who this policy is for
- Website visitors: people who visit getclosr.io, request a demo, start a trial or contact us (section 3).
- CRM users: agency owners who sign up, and agency staff (agents, managers, administrators) who sign in to the web or mobile app (sections 4 to 13).
- Leads and clients of our agency customers: people whose details an agency stores in the CRM, including people who fill in an agency's lead form on Facebook, Instagram or TikTok, or message an agency on WhatsApp, Messenger, Instagram, Telegram or email. If that is you, the agency you dealt with is your first point of contact (section 11).
3. Website visitors
What we collect. When you request a demo, start a trial or contact us: your name, work email, phone number, company name, role and your message. When you browse getclosr.io: pages visited, referring website, browser and device type, approximate location derived from your IP address, and the date and time of your visit.
Cookies and similar technologies. getclosr.io uses:
- Essential: Google reCAPTCHA v3 on our forms, to protect them from spam and abuse. reCAPTCHA collects hardware and software information, such as device and browser data, and sends it to Google for analysis. This site is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.
- Analytics: PostHog (PostHog Inc., EU Cloud, Frankfurt, Germany) to measure how the website is used: pages visited, clicks and referring sites. IP addresses are anonymised. It sets a first-party cookie to recognise repeat visits. Google Analytics 4 (Google LLC) to measure website traffic and how visitors use the site. It sets cookies such as
_ga. - Advertising: Google Ads (Google LLC) and the Meta Pixel (Meta Platforms, Inc.) to measure the results of our ads, for example when someone who clicked an ad starts a trial, and to show our ads to people who visited the site. They set cookies such as
_gcl_auand_fbp. We share which steps of the sign-up form were completed, your answers to its questions about your agency (such as team size and lead sources), and that a sign-up happened. We do not share your name, email or phone number. - Google Tag Manager (Google LLC) loads the tools above. It does not set cookies itself.
These tools are used on the website only. Our mobile apps do not use advertising pixels or advertising cookies.
Your choices. When you first visit getclosr.io, a banner asks for your consent. Analytics and advertising cookies load only if you accept them. Essential cookies are always on. You can change your choice at any time through "Cookie settings" in the website footer. You can also block or delete cookies in your browser settings, opt out of Google ads personalisation at adssettings.google.com, opt out of Meta ads based on website activity in your Facebook or Instagram ad settings, and opt out of Google Analytics with the browser add-on at tools.google.com/dlpage/gaoptout. The website works without analytics and advertising cookies. reCAPTCHA is needed to submit our forms; if you prefer not to use it, email us at support@getclosr.io instead. To have your website analytics data deleted, email support@getclosr.io.
Why we use it. To reply to your request, arrange a demo, set up your trial, send you information you asked for and, where allowed, product updates (you can unsubscribe at any time), and to keep the website secure and improve it, and to measure and improve our advertising, with your consent.
Legal basis. We use your contact details to take the steps you asked for before entering into an agreement with you. We use non-essential cookies and send marketing emails only with your consent where the law requires it.
How long we keep it. Demo and contact requests: up to 24 months after our last contact with you, unless you become a customer. Website analytics events: 1 year.
4. What we collect when you use the CRM
Account and profile. Your name, work email, phone number, role, team and agency, and your sign-in details. If you sign in with Google, we receive your Google account name and email. If you turn on two-factor authentication, we store what is needed to verify your authenticator codes.
Billing. When an agency subscribes, payments are processed by Stripe. We receive the plan, number of users, billing contact and payment status. We do not store full card numbers.
Work you do in the CRM. Leads, contacts, notes, comments, tasks, follow-ups, deals and commissions, documents, listings and photos, and messages you send or receive through the CRM (WhatsApp, Messenger, Instagram, Telegram and email). This is your agency's data (section 1).
Calls. When you make or receive calls through the CRM: phone numbers, time, duration and outcome of each call. Where your agency turns it on: the call recording, a transcript, and an AI-generated call summary. The summary also labels who is speaking and detects voicemail. Some agencies also use automated voice call flows, which use synthesised voices.
Office presence (location). If your agency uses office presence and you allow location access, the app records when you arrive at and leave one of your company's offices. On iPhone this uses "Always" location permission, so it works when the app is closed. On Android it works only while the app is open. Your precise coordinates never leave your device: we receive only the arrival and departure times and the office. This is used for attendance and lead assignment, and your managers can see it. You can turn location access off in your phone's settings at any time; office presence then stops.
Device and notifications. A notification token so we can send push notifications, your device type, operating system and app version. We also send you service emails, such as invitations, password resets and notifications.
AI features. Some features use AI: the inbox AI assistant, Ask AI, lead detection and extraction from messages, lead notes and interest extraction, listing descriptions, notification texts, call transcription and summaries, voices for call flows, and listing image editing. For these, the text, audio or images involved and the CRM data needed for the task are sent to our AI providers (section 8) to produce the result. This can include messages and emails synced from connected accounts (section 5). We use our AI providers' business services under terms that do not allow them to use this data to train their models.
Usage and diagnostics. How you use the CRM, masked session recordings, and error and crash reports (section 12).
5. Connected accounts: advertising, messaging, email and calendar
An agency can connect its own accounts on other platforms to Closr from the Closr web app. The mobile apps do not request access to any of these platforms. We access an account only after a user signs in to the platform and approves the access we request. Access can be removed at any time in Settings › Connections, or directly on the platform (see getclosr.io/delete-account).
Meta (Facebook, Instagram, Messenger and WhatsApp)
- Ads and lead forms. We read the agency's ad accounts, campaigns, spend and results, the Facebook Pages it chooses, and leads submitted through its lead forms (for example name, phone, email and form answers). We use this to create leads in the agency's CRM, assign them to agents, and report cost and results per campaign.
- WhatsApp Business, Messenger and Instagram messages. We send and receive messages on the agency's WhatsApp Business numbers, Facebook Pages and Instagram accounts, manage WhatsApp message templates, and read number quality and limits. Messages are stored in the agency's CRM inbox.
- Google Ads. We read the agency's campaigns, spend and results to report cost per lead and per campaign.
- Gmail. If a user connects a Gmail or Google Workspace mailbox, we read and sync emails exchanged with the agency's leads and clients into the CRM inbox, and send emails the user writes in Closr. These emails are sent and received through the user's own mailbox.
- Google Calendar. If a user connects a Google Calendar, we create and sync events for leads and viewings.
- Google sign-in. We receive the user's name and email to sign them in.
Microsoft 365 and other email providers. A user can connect a Microsoft 365 mailbox or any email account that supports IMAP/SMTP. We sync emails exchanged with the agency's leads and clients into the CRM inbox and send emails the user writes in Closr. These emails are sent and received by the user's own email provider, not by us.
Telegram. If an agency connects a Telegram bot or account, we send and receive its messages in the CRM inbox.
TikTok. If an agency connects TikTok for Business, we read its ad accounts, campaigns, spend and results, and leads submitted through its TikTok lead forms, for the same purposes as Meta lead forms.
How we use this data. Only to provide the features the agency has switched on, for that agency alone. Messages, emails and lead details from these platforms may be processed by our AI providers (section 8) only to provide features the user sees, such as the inbox assistant, suggested replies and lead extraction. We do not use data from these platforms for advertising, we do not sell it, we do not combine it across agencies, and neither we nor our AI providers use it to train AI models. Access tokens are stored encrypted.
Google API Services: Limited Use. Closr's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data (for example Gmail messages and Calendar events) only to provide and improve the user-facing features the user has connected. We transfer it to third parties only as needed to provide those features (for example to our AI providers to draft a suggested reply), to comply with law, or with the user's consent. People at Closr do not read this data unless the user gives explicit consent for a specific message, it is needed for security, or the law requires it. We do not use Google user data for advertising, and we do not use it, or allow our providers to use it, to develop, improve or train generalised AI or machine-learning models.
When an account is disconnected, we delete its access token immediately and stop collecting new data. Leads, messages, campaigns and cost data already imported stay in the agency's CRM for the duration of its agreement, then are deleted as described in section 10.
6. Why we use it and our legal basis
- To provide the CRM the agency has contracted for: accounts, sign-in, features, calls, messages, notifications, office presence and connected platforms.
- To bill the agency for its subscription.
- To keep it secure: preventing unauthorised access, detecting misuse, protecting accounts.
- To support you and your agency.
- To improve the CRM, using usage and diagnostic data (section 12).
- To meet legal obligations.
We process this information because it is needed to perform the agreement with the agency, to keep the Service secure, and to comply with the law. We rely on your consent only for permissions your phone asks you to grant (location, microphone, camera and photos, notifications), which you can withdraw in your phone's settings. We do not use your data for advertising, we do not sell it, and we do not share it with data brokers.
7. Who can see it
- Your agency. Managers and administrators can see your profile, your work in the CRM, your calls and, where used, your office presence, according to the permissions your agency sets.
- Our service providers, who process data only on our instructions (section 8).
- Platforms your agency connects (section 5) and property portals such as Property Finder, Bayut and Dubizzle. Data is exchanged with them only to run the integration the agency has switched on.
- Authorities, where the law requires it.
8. Service providers
| Provider | What it does for us | Where |
|---|---|---|
| Google Cloud (Cloud Run, databases, storage) | Runs the CRM and stores its data | European Union: Belgium (europe-west1); AI assistant database in the Netherlands (europe-west4) |
| Google Firebase | Sign-in, push notifications, app configuration | United States and other countries |
| Google reCAPTCHA | Protects website forms from spam and abuse | United States and other countries |
| Google LLC (Analytics, Ads, Tag Manager) | Website analytics and ad measurement | United States and other countries |
| Meta Platforms, Inc. (Meta Pixel) | Ad measurement and audiences | United States and other countries |
| Mailgun | Sending service emails (invitations, password resets, notifications) | European Union |
| Twilio (including Twilio Intelligence), DIDLogic | Calling, call recording and part of call transcription. Twilio is used under agreements that restrict how it uses our data. | United States, European Union |
| Meta Platforms | WhatsApp, Messenger and Instagram messaging, when the agency connects it | United States and other countries |
| Pusher | Real-time updates in the app | May process data outside the UAE |
| Stripe | Subscription payments | United States, European Union |
| OpenAI (GPT models) | Call summaries, voicemail detection and speaker labels; lead notes, interest extraction, listing descriptions and notification texts. Used under API terms that don't allow training on our data. | United States |
| Anthropic (Claude) | Inbox AI assistant, lead detection and extraction. Used under API terms that don't allow training on our data. | United States |
| Google (Gemini) | Ask AI. Used under API terms that don't allow training on our data. | United States and other countries |
| ElevenLabs | Call transcription and voices for automated call flows. Used under agreements that restrict how they use our data. | United States |
| fal.ai | Listing image editing. Used under agreements that restrict how they use our data. | United States |
| PostHog Inc. | Product and website analytics, masked session recordings | European Union: Frankfurt, Germany |
| Functional Software, Inc. (Sentry) | Error and crash monitoring | United States |
9. Transfers outside the UAE
Our main data is stored in the European Union. Some providers process data in the United States or elsewhere, and Closr Labs LLC is a US company. We protect these transfers with data processing agreements that include standard contractual clauses or equivalent safeguards, binding each provider to protect the data at a level at least equivalent to UAE law.
10. How long we keep it
| Data | How long |
|---|---|
| Account and CRM data | For as long as the agency's account exists. When it ends, the agency can export its data for 30 days; then we delete it, unless the law requires us to keep it. |
| A user deactivated by the agency | Kept with the agency's data while the agency's account exists. Deleted when the agency deletes its account or asks us to, or when the user requests deletion (section 11). Deactivation alone does not delete data |
| Call recordings | As set by the agency administrator: from 30 days to 10 years, or until the agency deletes them |
| Office presence | Raw arrival and departure events: 13 months. Daily attendance sessions: for as long as the agency's account exists, as its attendance record |
| AI assistant conversations | 12 months |
| Server logs | 10 days |
| Session recordings | 30 days |
| Usage analytics events | 1 year |
| Error and crash data | 30 days |
| Backups | Deleted data is removed from backups within 30 days, as backups expire |
| Connected platforms | As in section 5 |
| Website visitors | As in section 3 |
Deletion requests are completed within 30 days, unless the law requires us to keep the data.
11. Your rights and how to delete your data
Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and other laws that apply to you, you can ask to access your data and get a copy, correct it, delete it, restrict or object to how it is used, withdraw consent where we rely on it, and ask about the providers and transfers above.
- Website visitors and agency owners: email support@getclosr.io.
- Agency staff: ask your agency administrator first; we will help the agency respond. You can also email support@getclosr.io.
- Leads and clients of an agency, including people who filled in a lead form or messaged an agency: contact the agency you dealt with. If you write to us, we pass your request to that agency and help it respond.
Deleting your account. Use the form at getclosr.io/delete-account, which opens an email to support@getclosr.io with your request. You can also email support@getclosr.io with the subject "Delete my account" from the email address on your account. We reply within 30 days and complete deletion requests within 30 days. Data your agency must keep for legal reasons (for example transaction records) is kept by the agency under its own obligations. Full instructions, including how to remove Closr's access from Facebook, Google, Microsoft and TikTok: getclosr.io/delete-account.
We reply to requests within 30 days. If you are not satisfied, you can complain to the UAE data protection authority or the authority where you live.
12. How we measure and improve the CRM
What we collect. Your CRM user identifier (an internal code made of your agency id and user id, never your name, email or phone); your role, team and agency; device and app information (app version, device model, operating system, browser, screen size, a random installation identifier); which screens and features you use and when (page addresses without query strings or tokens); masked session recordings for a sample of sessions; and error, crash and performance diagnostics.
Masking. In session recordings, all text, everything you type and all images are masked before the recording leaves your device. Screens showing lead or client details, chats and messages, Ask AI, call recordings and documents are blocked completely. Sign-in, password and two-factor screens are never recorded.
What we do not collect here: your name, email or phone, lead or client details, the content of messages, notes or calls, or your IP address.
Why. To find and fix errors and slow screens, improve the product, protect workflows agencies rely on (calling, lead handling, follow-ups), and support agencies when they report a problem. We do not use this information to evaluate individual staff performance.
Who and where. PostHog Inc. (product analytics and session recordings, PostHog EU Cloud, Frankfurt, Germany) and Functional Software, Inc. (Sentry, error monitoring, United States). Access to session recordings is limited to Closr staff who need it to support and improve the product.
How long. Session recordings: 30 days. Usage analytics events: 1 year. Error and crash data: 30 days. If your agency ends its contract or you ask us to delete your data, we delete the information linked to your user identifier from these tools within 30 days.
13. Security
We protect data with encryption in transit (HTTPS) and at rest (Google Cloud), encrypted storage of platform access tokens, passwords stored only as bcrypt hashes (never in plain text), access controls, optional two-factor authentication with an authenticator app (TOTP), and restricted staff access. No system is perfectly secure; if a breach affects an agency's data, we notify the agency without undue delay.
14. Children
The Service is a work tool for agency staff and is not intended for anyone under 18.
15. Changes
If we change how we collect or use data, we update this policy and the date at the top before the change takes effect, and tell agencies about material changes.
16. Contact
Closr Labs LLC, 16192 Coastal Highway, Lewes, DE 19958, United States. Email: support@getclosr.io. Account deletion: getclosr.io/delete-account.