Privacy policy

1. Who we are

In this policy, "CloseEase", "we", "us" and "our" mean CloseEase, a business based in Ontario, Canada. "You" and "your" mean the individual whose personal information we handle. "Personal information" means information about an identifiable individual.

The "website" means closeease.com and all of its pages, including the desktop, phone and standard versions. The "CRM" means the CloseEase CRM, the subscription software that our customers log on to at app.closeease.com.

CloseEase is owned and operated by one person. You can reach us at info@closeease.com. The full legal name and address of the contracting party appear on our invoices and on any signed quote or agreement.

2. Privacy Officer

We have designated a Privacy Officer, who is the owner of CloseEase. The Privacy Officer is accountable for our compliance with this policy and with the privacy laws that apply to us, and is the person in charge of the protection of personal information for the purposes of Quebec law.

To contact the Privacy Officer, email info@closeease.com with "Privacy" in the subject line, or use the form at the bottom of this page. You will receive a personal reply by email within 24 hours.

3. Scope and the laws we follow

This policy applies to personal information about visitors to the website, people who contact us, people who act for our business clients and CRM customers, and people who use the CRM.

Our services and the CRM are for business use only. Most of the personal information we handle is business contact information, such as a name, job title, work email address and company name. We apply this policy to business contact information as well.

This policy does not govern the information that our CRM customers store in the CRM about their own clients, contacts, staff and other people. Each CRM customer controls that information. Section 15 explains our role.

We follow the Personal Information Protection and Electronic Documents Act (PIPEDA). For residents of Quebec, we also follow the Act respecting the protection of personal information in the private sector, as amended by the Act to modernize legislative provisions as regards the protection of personal information (Law 25). For commercial electronic messages, we follow Canada's Anti-Spam Legislation (CASL).

4. What we collect

4.1 When you visit the website

When your browser loads a page, our hosting provider, Vercel, receives the technical information that every browser sends: your IP address, your browser and device type, the page requested, the referring page, and the date and time. Your browser also sends your IP address and browser details to Google Fonts, which supplies the typefaces the website uses. We do not use this information to identify you, and we do not keep our own copy of these technical logs.

4.2 Contact forms and the Mail program

The contact forms on the website, and the Mail and Message programs on the desktop and phone versions, ask for your name, your email address, your company or website (optional) and your message. Some forms also include a subject. We also receive the name of the page or program the message was sent from. The same applies when you claim a game prize or ask about the CRM through one of these forms. Each message is delivered to us by email through FormSubmit.

4.3 The website chat

The chat on the desktop version of the website gives automated, built-in answers that run in your browser. What you type is not sent to us or to anyone else unless you ask the chat to pass a message on. If you do, the chat asks for your email address, your name (optional) and, in some cases, a short note, and sends these together with a transcript of the conversation through FormSubmit, in the same way as a contact form. The conversation is not saved after you close or reload the page. No artificial intelligence service is connected to the chat. We will update this policy before we connect one.

4.4 Signing up for the CRM

The sign-up form on the Get the CloseEase CRM page asks for your name, your work email address, your company name and the number of seats you need.

When automatic checkout is not available, the form sends these details to us by email through FormSubmit, and we reply by email with a secure payment link from Stripe. When automatic checkout is available, the form sends the same details to the CRM, which opens a Stripe Checkout page. Once the payment succeeds, the CRM creates your account and emails you a link to set up your log on.

Stripe collects your card details and billing information, such as the name on the card, the billing country and the postal code, on its own secure page. We never receive your full card number. From Stripe, we receive a record of each payment: the amount charged, the HST, the payment status, the billing name and email address, Stripe's customer and subscription references, and the card brand and last four digits.

4.5 Buying the Find, the Fix or Support

When your business buys the Find, the Fix or Support, we collect the names, job titles, work email addresses and other business contact details of the people we work with, billing details, our correspondence, and the information you give us so that we can do the work. That information can include documents, descriptions of how your business works, and access to systems that contain personal information about your staff or your clients. We use that information only to do the work your business has asked for, and we ask you to share only the personal information the work needs.

4.6 Using the CRM

For each person who uses the CRM, we hold: the person's name and work email address; a hashed form of the password (we never store the password itself); two-step sign-in settings; the person's role and permissions; a record of sign-ins and of sensitive actions, with the time and IP address; and, if the person turns them on, the details the browser needs to deliver phone or desktop notifications. When you email us for support, we keep that correspondence.

4.7 Information we receive from others

We receive personal information from others in these cases: Stripe sends us payment records; the administrator of a CRM customer's account gives us the name and email address of each person the administrator invites to the CRM; and a client may give us the contact details of colleagues we will work with.

5. Cookies, browser storage and analytics

5.1 Cookies

The website does not set any cookies. The CRM sets one cookie, named ce_session, which keeps a signed-in user signed in. It is strictly necessary for the CRM to work, it expires after 30 days, and it is removed when the user signs out.

5.2 Browser storage

The website saves some choices in your browser's local storage or session storage so that it works the way you left it. These include your answer to any cookie notice; sound, display and accessibility settings; the position of desktop icons; game scores and the initials you enter for them; text you type in the desktop Notepad; chat window settings; which windows and messages you have opened; the version of the website you chose for the current visit; and the items you tick on the ready-to-start checklist. This information stays on your device. It is not sent to us or to anyone else, and we cannot see it. You can delete it at any time by clearing your browser's stored data for the website.

5.3 Analytics

We do not use any analytics, advertising or session-recording tool on the website. The website contains code that can load Google Analytics 4 (provided by Google LLC) and Microsoft Clarity (provided by Microsoft Corporation), but both are switched off, and no cookie notice is shown while they are off. Even if we switch them on, neither tool will load unless you first select Allow in a cookie notice. Before we switch either tool on, we will update this policy to describe what the tool collects, where it stores the information and how long it keeps it.

The Cookie settings link in the footer of the standard website reopens the cookie notice so that you can change your answer. While no tool is switched on, that link shows the message "No analytics or cookies are in use". The CRM does not use analytics or advertising tools.

6. Why we use it

We use personal information only for these purposes:

to reply to your messages and follow up on your enquiry;
to prepare quotes, deliver the Find, the Fix and Support, and manage our relationship with your business;
to create and run CRM accounts, send log on details, account notices and invoices, and provide support;
to process payments and keep accounting and tax records;
to keep the website and the CRM secure, prevent fraud and misuse, and fix problems;
to send marketing email, only as section 8 describes; and
to comply with the law and to establish, exercise or defend legal claims.

We do not sell, rent or trade personal information. We do not use it for advertising, we do not use it to train artificial intelligence models, and we do not make decisions about you based only on automated processing. We collect only the personal information we need for these purposes. Before we use personal information for a new purpose, we ask for your consent, unless the law allows or requires that use without consent.

We collect, use and disclose personal information with your consent, except where the law allows or requires us to act without it. Your consent is express when you send a form, sign up for the CRM, sign a quote or select Allow in a cookie notice. Your consent is implied for uses that follow directly from what you ask us to do, such as replying to an email you send us. We also use personal information as needed to perform a contract with your business, and to meet our legal obligations, such as keeping tax records.

For residents of Quebec, we ask for consent in clear terms, for specific purposes, and separately from any other information. Any technology that can identify, locate or profile you, such as an analytics tool, is switched off by default and is used only if you choose to turn it on.

You may withdraw your consent at any time, subject to legal or contractual restrictions, by emailing info@closeease.com. To stop marketing email, use the unsubscribe link in the email. To withdraw consent to analytics, use the Cookie settings link. If you withdraw consent, we may no longer be able to provide a service that depends on it, and we will tell you if that is the case. Withdrawing consent does not affect records that the law requires us to keep.

8. Marketing email (CASL)

We do not currently send newsletters or other marketing email. Emails that reply to you, or that concern a quote, a purchase, an invoice, your CRM account or the services your business receives, are not marketing email.

If we begin to send marketing email, we will send it only to people who have given us express consent, or where CASL allows implied consent, such as within 2 years after your business last bought from us or within 6 months after you last made an enquiry. Each marketing email will identify CloseEase, include our mailing address and a way to contact us, and contain an unsubscribe link that works for at least 60 days after the email is sent. We will act on every unsubscribe request within 10 business days, and we will keep a record of unsubscribed addresses so that we do not email them again.

We share personal information only with the service providers and in the cases listed below, and we share only the information each one needs. Each provider handles personal information under its own terms and privacy policy. We remain responsible for personal information that we transfer to a provider for processing on our behalf.

9.1 Website, email and payments

Vercel Inc. (United States) hosts the website and receives the technical information described in section 4.1. Vercel serves the website from a worldwide network of servers, so a request can be handled in Canada, the United States or another country.
Google LLC (United States) provides Google Fonts, which supplies the website's typefaces and receives your IP address and browser details.
FormSubmit (formsubmit.co) delivers contact form, chat and sign-up messages to us by email. FormSubmit does not state where it processes data, so we treat it as processing data outside Canada.
Our email service provider hosts the info@closeease.com mailbox and stores the emails you send us and our replies. It may store them outside Canada, including in the United States.
Stripe (Stripe, Inc. and its affiliate Stripe Payments Canada, Ltd.) processes card payments for the CRM and any other payment you make to us online. Stripe processes data in the United States and other countries. Stripe also uses payment information for its own purposes, such as fraud prevention and legal compliance, under its own privacy policy.

9.2 The CRM

Vercel Inc. (United States) runs the CRM application at app.closeease.com and stores files uploaded to the CRM.
Neon (United States) hosts the CRM database in the United States.
Resend (United States) sends the CRM's system emails, such as log on invitations, password resets and alerts.
Cloudflare, Inc. (United States) stores the CRM's encrypted nightly database backups.
GitHub, Inc. (United States) runs the scheduled job that creates those encrypted backups.
The push service of a user's browser, such as the services run by Google, Apple, Mozilla or Microsoft, delivers phone or desktop notifications to CRM users who turn them on.
Services that a CRM customer connects to its own account, such as its own Stripe, Resend or Twilio account, Meta, LinkedIn, TikTok, Google, Microsoft, Zoom or Calendly, receive the data that the customer's use of them requires. The customer chooses these services, and its own agreement with each of them applies.

9.3 Other disclosures

Our accountant and legal advisers, who are bound by duties of confidentiality, for accounting, tax and legal purposes.
Government bodies, courts and law enforcement, when the law requires us to disclose information.
A prospective buyer of all or part of the CloseEase business, and its advisers, as PIPEDA permits for business transactions, under an agreement that protects the information.

10. Storage outside Canada

We do not operate our own servers. Our providers store and process personal information outside Canada, mainly in the United States, and Vercel and Cloudflare operate worldwide networks of servers. FormSubmit does not state where it processes data. While personal information is outside Canada, it is subject to the laws of the country where it is held, and the courts, law enforcement and national security authorities of that country may be able to obtain access to it.

For residents of Quebec: before we communicate personal information outside Quebec, we assess whether it will receive adequate protection, taking into account its sensitivity, the purpose of its use, the protection measures that will apply, and the legal framework of the place where it will be held, and we rely on written terms with the provider.

11. How long we keep it

Enquiries: contact form, Mail program and chat messages, and CRM sign-up requests that do not lead to a purchase, are kept for 24 months after our last communication with you, and then deleted.
Project information: documents, materials and project correspondence from the Find, the Fix and Support are kept for 24 months after the work ends, and then deleted, except where they form part of the business records described in the next item. System access details you give us are deleted within 10 business days after the work that needs them ends.
Business records: signed quotes and agreements, invoices, payment records and tax records are kept for 6 years after the end of the tax year to which they relate, as Canadian tax law requires.
CRM user accounts and security records: kept while the customer's subscription is active, and deleted with the customer's other data as described in the next item.
Data in a CRM customer's account: kept while the subscription is active and for 30 days after it ends, so that the customer can ask for an export. If the customer asks for an export during those 30 days, the data is kept until we have delivered the export. It is then permanently deleted from the CRM, and encrypted backup copies are deleted automatically within a further 30 days.
Backups: each nightly encrypted backup of the CRM database is deleted automatically 30 days after it is made.
Privacy requests and breach records: kept for 24 months after the request is closed or after we determine that the breach occurred.
Unsubscribe records: kept for as long as we send marketing email, so that we do not email an address that has unsubscribed.
Browser storage: stays on your device until you clear it. Session storage is cleared when you close the browser tab.

Stripe keeps its own records for the periods its policies and the law require. When a retention period ends, we delete the information or make it anonymous. If a legal claim, an investigation or a legal obligation requires us to keep information longer, we keep it until that matter ends.

12. Security

We protect personal information with safeguards suited to its sensitivity, including these:

The website and the CRM are served only over encrypted connections (HTTPS).
Every CRM user must sign in with a password and with two-step sign-in through an authenticator app.
CRM passwords are stored only in hashed form, and the keys and access tokens for services connected to the CRM are encrypted (AES-256-GCM).
Each CRM customer's data is kept separate from every other customer's data, and each customer's administrators decide what each of their users may do.
Sign-ins and sensitive actions in the CRM are recorded in an activity log.
CRM database backups are encrypted before they are stored.
Within CloseEase, only the owner of CloseEase has access to personal information.

No method of transmitting or storing information is completely secure, and we cannot guarantee absolute security.

13. Your rights and requests

You have the right to ask whether we hold personal information about you and to access it, to ask us to correct information that is inaccurate or incomplete, to withdraw your consent as described in section 7, and to ask us to delete information that we no longer need or that you no longer consent to us holding, subject to the records the law requires us to keep.

How to make a request. Email info@closeease.com with "Privacy request" in the subject line, or use the form at the bottom of this page, and say what you would like us to do. We may ask you for information to confirm your identity, and we use that information only for that purpose. There is no fee.

When we respond. We respond in writing within 30 days after we receive your request. If we need more time and the law allows an extension, we will tell you in writing before those 30 days end, with the reason and the date by which we will respond. If we refuse a request in whole or in part, we will give you our reasons and tell you how to make a complaint.

Residents of Quebec. Under Quebec law, you also have the right to be informed of the personal information we hold about you and how we use it, to have computerized personal information that you provided to us communicated to you, or to a person or body you designate, in a structured, commonly used technological format, and to file a complaint with the Commission d'accès à l'information du Québec. We respond to requests from Quebec residents within 30 days after we receive them.

Complaints. Please contact our Privacy Officer first, so that we can try to resolve your concern. You may also complain to the Office of the Privacy Commissioner of Canada, or, if you live in Quebec, to the Commission d'accès à l'information du Québec.

14. Data breaches

A breach of security safeguards is any loss of, unauthorized access to, or unauthorized disclosure of personal information. If a breach occurs, we act immediately to contain it and to assess the risk it creates.

If a breach creates a real risk of significant harm to an individual, we report it to the Office of the Privacy Commissioner of Canada and notify the affected individuals as soon as feasible. If a confidentiality incident involving the personal information of a resident of Quebec presents a risk of serious injury, we notify the Commission d'accès à l'information du Québec and the affected individuals as soon as feasible. We also notify any organization that may be able to reduce the risk of harm.

We keep a record of every breach, whether or not it must be reported, for 24 months after we determine that it occurred. If a breach affects data stored in a CRM customer's account, we notify that customer by email within 72 hours after we confirm the breach, and we give the customer the information it needs to meet its own legal obligations.

15. Data our CRM customers store

Our CRM customers use the CRM to store information about their own clients, contacts, staff and other people, and to send messages to them ("Customer Data"). For Customer Data:

the CRM customer controls the Customer Data, decides what is collected and why, and is responsible for obtaining the consents and giving the notices that the law requires, including under CASL for any messages it sends;
CloseEase processes Customer Data only on the customer's behalf, to provide, secure and support the CRM as our Terms of service describe, and does not use it for its own purposes;
the customer's own privacy policy, not this policy, governs how the customer uses Customer Data;
we use only the providers listed in section 9.2 to process Customer Data; and
when a subscription ends, Customer Data is exported on request and then deleted as section 11 and our Terms of service describe.

If you are a client or contact of a business that uses the CRM and you want to access, correct or delete your information, please contact that business. If you contact us instead, we will forward your request to that business within 5 business days and tell you that we have done so.

16. Children

The website, our services and the CRM are for businesses and are not directed at children under 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected it, we delete it.

17. Changes to this policy

We may update this policy. When we do, we post the new version on this page and change the effective date at the top. If a change is material, such as a new purpose or a new type of service provider, we will also notify CRM customers and clients with current work by email at least 30 days before the change takes effect, unless the law requires the change to take effect sooner. The previous version of this policy was effective October 20, 2026.

18. Effective date and contact

This policy is effective October 22, 2026. If you have a question about this policy or about your personal information, email info@closeease.com or use the form below.