Privacy Policy

Route to Grow LLC is a limited liability company organized in the United States, with operations in Miami, Florida. For personal information submitted by visitors of our website, prospects and account administrators, we act as the data controller (or "business" under United States state privacy laws).

For personal information that our customers upload, import or generate inside their Closary CRM workspace (for example their own leads, contacts, call recordings and messages), we act as a data processor (or "service provider") acting on the documented instructions of that customer. In those cases the customer is the controller and its own privacy notice governs the relationship with the individual. Requests about that data should be directed to the customer; we will assist them in responding.

This policy does not apply to third party websites, applications or integrations that you choose to connect to Closary CRM, which are governed by their own privacy notices.

Information you provide directly: name, business email, phone number, company name, role, country, website, quote request details, support tickets, survey answers, and any content you submit through forms, WhatsApp or email.

Account and billing information: login credentials (stored hashed), workspace settings, plan and subscription data, invoices, tax identifiers and partial payment card data. Full card numbers are handled by our PCI DSS compliant payment processors and are never stored on our servers.

Customer content: records you create or import into the platform such as contacts, deals, pipelines, notes, documents, e-signed contracts, email and WhatsApp conversations, call recordings and transcripts, and files stored in your workspace.

Usage and device data: IP address, approximate location derived from IP, browser type and version, operating system, device identifiers, referring URLs, pages viewed, session duration, clicks, feature usage and error logs.

Communications data: metadata and content of messages exchanged with our sales and support teams, including call recordings where permitted by law and after notice.

Information from third parties: data from integration partners you authorize (email providers, calendars, telephony, WhatsApp Business, social platforms, payment gateways), enrichment and advertising partners, and publicly available business sources.

We do not intentionally collect special categories of data such as health, biometric, genetic, racial or ethnic origin, political opinions, religious beliefs, trade union membership, precise geolocation, or sexual orientation, and we ask you not to upload them unless a specific written agreement covering that processing is in place.

If your industry requires processing regulated data (for example protected health information), contact us before uploading it so we can evaluate whether an additional agreement such as a HIPAA Business Associate Agreement is required.

To provide, operate, maintain and secure the Services, including authentication, hosting, backups and customer support. Legal basis: performance of a contract.

To process payments, manage subscriptions, prevent fraud and collect amounts due. Legal basis: performance of a contract and legal obligation.

To improve and develop features, measure performance, run analytics and debug errors. Legal basis: legitimate interests.

To provide artificial intelligence features such as real time sales assistance, call analysis, follow up scoring and content generation. This processing is performed on your workspace data to produce outputs for you. Legal basis: performance of a contract.

To send service messages, security alerts and administrative notices. Legal basis: performance of a contract and legal obligation.

To send marketing communications about products, offers and events, subject to your consent where required and always with an opt out. Legal basis: consent or legitimate interests.

To comply with legal, tax and accounting obligations, respond to lawful requests, and establish, exercise or defend legal claims. Legal basis: legal obligation and legitimate interests.

Closary CRM uses artificial intelligence models, including models operated by third party providers, to generate call summaries, coaching suggestions, lead scores, follow up recommendations and drafted content.

We do not use customer content to train publicly available foundation models, and our AI subprocessors are contractually restricted from using customer content submitted through our accounts to train their general models.

AI outputs are suggestions and can contain errors. They are not a substitute for human judgment and must not be used as the sole basis for decisions that produce legal or similarly significant effects on an individual.

You may request human review of any automated output that materially affects you by writing to us.

Where the Services record or transcribe calls and messages, the customer operating the workspace is responsible for obtaining any consent or providing any notice required by applicable law in the jurisdictions of all participants, including two party consent rules.

Recordings and transcripts are stored in the customer workspace and are subject to that customer's retention settings.

We use strictly necessary cookies for authentication, security and load balancing, functional cookies to remember preferences such as language and theme, analytics cookies to understand usage, and advertising cookies including the Meta Pixel and Google tags to measure campaigns and show relevant ads.

Where required by law we request consent before setting non essential cookies, and you can withdraw it at any time through the cookie settings in your browser or the banner control. Blocking essential cookies may prevent the site from working.

We honor Global Privacy Control signals as a valid opt out of sale or sharing where legally applicable.

Service providers and subprocessors that host infrastructure, deliver email and messaging, process payments, provide telephony, run analytics, provide AI inference and deliver customer support. They act on our instructions under written contracts.

Integration partners you connect, which receive only the data required for that integration and process it under their own terms.

Professional advisors such as auditors, accountants, insurers and lawyers under duties of confidentiality.

Corporate transactions, where information may be transferred as part of a merger, acquisition, financing, reorganization or sale of assets, subject to this policy.

Legal and safety disclosures, when reasonably necessary to comply with law, enforce our agreements, or protect the rights, property or safety of Closary, our customers or the public. Where legally permitted we notify the affected customer before disclosing their content.

We do not sell personal information for money. Some advertising cookies may qualify as sharing or as a sale under certain state laws, and you can opt out as described below.

When a customer connects QuickBooks Online, Closary CRM accesses that QuickBooks company only through Intuit's authorization (OAuth 2.0) and only for the customer's own workspace.

We use it to create and update customers, products and services, invoices, payments, sales receipts, refund receipts, credit memos and journal entries that mirror the sales recorded in the CRM, and to take card payments and payment links through QuickBooks Payments.

We store only the identifiers of the QuickBooks records we create and the access tokens, which are encrypted at rest. We do not copy or sell the customer's QuickBooks data, and we do not use it for advertising.

Card details entered for QuickBooks Payments are sent from the browser directly to Intuit and never reach our servers.

The customer can disconnect QuickBooks at any time from Settings › QuickBooks or from QuickBooks itself. The tokens are then revoked and deleted. Records already created in QuickBooks remain in the customer's QuickBooks company.

We are based in the United States and our providers may process data in the United States, the European Union and other countries. Where personal data is transferred from the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission Standard Contractual Clauses together with the United Kingdom Addendum, and we perform transfer impact assessments and apply supplementary technical measures such as encryption in transit and at rest.

A copy of the relevant transfer mechanism is available on request.

We retain workspace content for as long as the account is active. After termination, content is retained for 30 days to allow export and is then scheduled for deletion, with removal from backups within 90 days.

Billing and tax records are retained for the period required by law, generally up to 7 years. Marketing contact records are retained until you unsubscribe and for a reasonable period after. Security logs are typically retained for 12 months.

We apply administrative, technical and organizational safeguards including encryption in transit with TLS and encryption at rest, role based access control, least privilege, multi factor authentication for internal systems, network segmentation, logging and monitoring, vulnerability management, backups, and employee confidentiality and security training.

No method of transmission or storage is completely secure. You are responsible for keeping credentials confidential and for configuring user permissions inside your workspace.

If a personal data breach affects your information, we will notify affected customers and regulators without undue delay and, where required, within 72 hours of becoming aware.

Depending on where you live you may have the right to access your personal information, obtain a copy in a portable format, correct inaccurate data, request deletion, restrict or object to certain processing, withdraw consent, opt out of targeted advertising, sale or sharing, opt out of profiling with significant effects, and not be discriminated against for exercising your rights.

To exercise rights write to info@routetocrm.com from the email address associated with your record. We verify identity before responding and answer within the period required by law, generally 30 days, extendable where permitted.

You may use an authorized agent where the law allows it. If we deny a request you may appeal by replying to our decision, and you may also lodge a complaint with your supervisory authority.

The Services are intended for business use and are not directed to individuals under 16 years old. We do not knowingly collect personal information from children. If you believe a child provided us information, contact us and we will delete it.

You can unsubscribe from marketing emails using the link in each message or by contacting us. You can also opt out of WhatsApp or SMS marketing by replying with the stop keyword. Service and transactional messages related to your account cannot be opted out of while the account is active.

We may update this policy to reflect changes in our practices or in the law. We will update the date at the top and, for material changes, provide notice by email or in the product at least 15 days before the change takes effect.

Route to Grow LLC, operating as Closary CRM, Miami, Florida, United States.

Privacy and data protection requests can be addressed to our privacy team at the email below. We aim to answer every request within 5 business days.