Closai, Inc., a Delaware corporation (“Company,” “we,” “us,” or “our”) provides this Privacy Policy because we know that you, like us, care about how your information is collected, used, shared, retained and secured. This Privacy Policy applies to information collected when you visit our website www.closai.io (our “Website”), use our mobile applications (our “App”), or access or use services (“Services”) that we make available from time to time through our Website or App (collectively, the Website, App and Services hereinafter our “Platform”).

By using our Platform, you agree to the terms of this Privacy Policy and the accompanying Terms of Use and consent to the collection, use and disclosure practices, and other activities as described in this Privacy Policy. If you do not agree and consent, discontinue use of the Platform. Capitalized terms not defined in this Privacy Policy have the meaning ascribed to them in the Terms of Use. 

If you are a Nevada Resident, California Resident, or a data subject in Europe, please see respectively the “Additional Disclosures for Nevada Residents,” “Additional Disclosures for California Residents,” and “Additional Disclosures for People in Europe” sections below. If you have any questions or wish to exercise your rights and choices, please contact us as set out in the “Contact Us” section.

DEFINITIONS 

Personal Data: Personal Data means data about a living individual who can be identified from those data (or from those and other information either in our possession or likely to come into our possession). 

Usage Data: Usage Data is data collected automatically either generated by the use of the Platform or from the Platform infrastructure itself (for example, the duration of a page visit).

Cookies: Cookies are small pieces of data stored on your device (computer or mobile device).

Data Controller: Data Controller means the natural or legal person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal information are, or are to be, processed. For the purpose of this Privacy Policy, we are a Data Controller of your Personal Data. This includes Personal Data collected through OAuth connections and email sync integrations, regardless of whether those connections were initiated through the Closai platform directly or through an integration with one of our Enterprise Partners.

Data Processors (or Platform Service Provider): Data Processor (or Platform Provider) means any natural or legal person who processes the data on behalf of the Data Controller. We may use the services of various Platform Service Provider in order to process your data more effectively.

Data Subject (or User): Data Subject is any living individual who is using our Platform and is the subject of Personal Data.

Enterprise Partner: Enterprise Partner means a business entity that has executed an Order Form with Closai and is licensed to receive Enriched Data outputs from the Closai Platform for use with their own end customers. Enterprise Partners are downstream recipients of data Closai has processed; they are not data controllers of your Personal Data.

Enriched Data: Enriched Data means purchase history data, style affinity signals, wardrobe insights, and other outputs derived from your connected accounts that Closai may make available to authorized Enterprise Partners, subject to your consent and the scope defined at the time of connection.

TYPES OF DATA COLLECTED

We collect personal information you provide when using the Platform, such as your name, email address, phone number, and other details, when you register, update profiles, place orders, participate in promotions, or contact customer support.

Here is a listing of the information that we collect, how we collect the information, and how we use and share that information, including the categories of information we collect:

PERSONAL DATA WE COLLECT

While using our Platform, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you ("Personal Data"). Personally identifiable information may include, but is not limited to:

• Email address

• First name and last name

• Address, City, State, ZIP/Postal code, Country

• Financial information to pay for Services within the Platform

• Reviews

• Copyrightable material: photos, videos, music, and text you put in that identify you

• Your own content that identifies you

• Your own photos of items that identify you

• Personal photos or screenshots

• Purchase order information, including items bought, amounts paid and order dates

THE WAYS WE MAY COLLECT YOUR PERSONAL DATA

The Information You Provide to Us

Registration and Account Information. To access certain features or services on our Platform, we may ask you to provide registration details or other personal information. We collect and process this information solely for the purposes of providing you with our services, enhancing user experience, and ensuring the security of our Platform. We require that all the information you provide is accurate, current, and complete.

Social Media Login Options. When available, the Platform offers the option to log in using your social media accounts (e.g., Google, Apple, or others). If you choose to use these login options, we will use the information provided solely for creating and managing your user account on our Platform. We do not access, collect, or share any additional data from your social media profiles beyond what is necessary for account registration and management. Your privacy is important to us, and we do not share your data with any third parties, including your social media providers. We encourage you to maintain the confidentiality of your account credentials and to notify us immediately of any unauthorized use of your account or any other breach of security.

Content. When applicable, we may collect information regarding the content you send to us as part of our Platform, including content within any messages you send to us (such as feedback and questions to customer support).

Email Information and Digital Receipts.  If you provide us with access to your email account or share your email order information, we may collect details from your emails, including digital receipts, purchase confirmations, shipping information, and related order details. This information is used to enhance our services, manage your orders, provide customer support, and offer personalized experiences. Information received from Gmail APIs will adhere to the Google User Data Policy, including the Limited Use requirements. Any data collected will not be used to develop, improve or train generalized AI models, or transferred to any third-party tools for generalized AI models. To improve your experience, the data may be used to develop, improve or train personalized AI models in the Platform. You can manage or revoke access at any time through your email settings or our Platform settings.

OAuth-Connected Account Data. When you connect a third-party retail or brand account to the Closai Platform via OAuth, you are granting Closai direct authorization to access purchase history and related data from that account. You are the one granting this authorization — Closai holds the OAuth permissions on your behalf and is solely responsible for securing and maintaining that connection. If you connect your accounts through an integration offered by one of our Enterprise Partners (for example, a fashion rental service or retailer powered by Closai), the data relationship is still directly between you and Closai. The Enterprise Partner receives only the Enriched Data outputs that you have authorized Closai to share, and cannot independently access, modify, or revoke your underlying account connections.

Other Information You Voluntarily Provide.  If you choose to voluntarily provide other information to us that we do not request, in such instances, you are solely responsible for such information.

The Information Collected Automatically from You

We automatically collect information when you use the Services, which may include personal information. The categories of information we automatically collect and may have collected in the last 12 months include:

Service Use Data. This includes data about pages you visit, features you use, the time of day you use the Services, products and services you view and purchase, and your referring and exiting pages.

Geo-locational Information. Certain features and functionalities of the Platform may be based on your location. Collection of this information occurs only when the Platform is running on your mobile device. You may decline to allow us to collect such information by adjusting your browser settings, in which case we will not be able to provide certain features or functionalities to you. We use various current – and later – developed tracking technologies to automatically collect information when you use the Services.

Cookies. Like most websites, we use automatic data collection technology when you visit our Website to collect information that identifies your computer. This comprises information about your operating system, your IP addresses, browser type and language, referring pages and URLs, keywords, date and time, and what sections of our Platform you visit (the “usage information”). You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service.

Examples of Cookies we use:

• Session Cookies. We use Session Cookies to operate our Service.

• Preference Cookies. We use Preference Cookies to remember your preferences and various settings.

• Security Cookies. We use Security Cookies for security purposes.

Pixels. Pixels are also known as web beacons, code embedded in a website, video, email or advertisement that sends information about your use to a server. Pixels are used in combination with cookies to track activity by a particular browser on a particular device.

SOCIAL MEDIA AND TECHNOLOGY INTEGRATIONS

We may offer parts of our Platform through websites, apps, platforms, and services operated or controlled by separate entities. When you interact with other entities, including when you leave our Platform, those entities may independently collect information about you and solicit information from you. The information collected and stored by third parties is subject to their policies and practices, including what information they share with us, your rights and choices on their services and devices, and where they store information. We encourage you to review their terms of use and privacy policies.  Please note that we do not control or take responsibility for the privacy practices of these third-party entities, and any data they collect is governed solely by their privacy policies and terms of use.

USE OF DATA

The Company uses the collected data for various purposes:

• To provide and maintain our Platform

• To fulfill any other purpose for which you provide it

• To notify you about changes to our Platform

• To allow you to participate in interactive features of our Platform when you choose to do so

• To provide customer support

• To collect valuable insights and information, enabling us to enhance our platform and improve the overall user experience

• To detect, prevent and address technological issues 

• To develop, improve or train personalized AI models to improve user experience

• To provide you with news, special offers, and general information about other goods, services, and events which we offer that are similar to those that you have already purchased or inquired about unless you have opted not to receive such information

• In any other way we may describe when you provide the information

• For any other purpose with your consent

• To enhance each individual user’s experience by tailoring personalization efforts

• To generate Enriched Data outputs that may be shared with authorized Enterprise Partners, subject to the scope of your consent at the time of connection

We may also use your Personal Data to contact you with newsletters, marketing or promotional materials and our own and third-parties' goods and services that may be of interest to you. You may opt out of receiving any, or all, of these communications from us by following the unsubscribe link or instructions provided in any email we send.

We may use the information we have collected from you to enable us to display advertisements to our advertisers' target audiences. Even though we do not disclose your personal information for these purposes without your consent, if you click on or otherwise interact with an advertisement, the advertiser may assume that you meet its target criteria.

RETENTION OF DATA

Company will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

Your Personal Data, including data collected through OAuth connections and email sync, is retained at the account level and is not deleted solely because you discontinue use of a particular Enterprise Partner's services. If you wish to delete your Closai account and all associated data, you may do so directly through the Platform or by contacting us at contact@closai.io. Upon verified account deletion request, we will delete your Personal Data within 30 days, except where retention is required by applicable law.

Company will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of our Platform, or we are legally obligated to retain this data for longer time periods.

TRANSFER OF DATA

Your information, including Personal Data, may be transferred to — and maintained on — computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from your jurisdiction.

If you are located outside United States and choose to provide information to us, please note that we may transfer the data, including Personal Data, to United States and other jurisdictions. Data protection laws in the US and other jurisdictions may be different from those of your country of residence. Your use of the Platform, decision to provide data to us, or to allow us to collect data through our Platform, constitutes your acknowledgement that we are processing your data in the United States and other jurisdictions, and your consent to the transfer to and from, processing, usage, sharing, and storage of information about you in the US and other jurisdictions as set out in this Privacy Policy even though the standards of data protection and privacy available in the United States and other jurisdictions may not be the same or as high as the standards in your home country.  Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer.

Where Closai transfers Personal Data of users located in the European Economic Area (EEA) or United Kingdom to recipients in the United States or other jurisdictions that may not provide equivalent levels of data protection, Closai will ensure that appropriate safeguards are in place, including the use of Standard Contractual Clauses (SCCs) approved by the European Commission, where required.

SECURITY OF DATA 

Your data security is a top priority for us. We partner with trusted service providers who implement advanced security measures, such as SSL encryption for secure connections and automatic encryption of all data before storage. While we and our partners take every precaution to protect your information, it's important to know that no method of data transmission or electronic storage can be guaranteed to be completely secure.

Our Company will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy and no transfer of your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of your data and other personal information. However, while we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

We use Google OAuth 2.0 protocol and JSON Web Token (JWT) based authentication to allow users to sign into the system. Their Privacy Policies are:  

• JSON Web Token (JWT)

• Google OAuth 2.0 protocol

In the event of a data breach that is likely to result in a risk to your rights and freedoms, Closai will notify affected users and, where required by law, the relevant data protection authorities, within 72 hours of becoming aware of the breach.

SHARING YOUR INFORMATION

We share information, which may include personal information, we collect in accordance with the practices described in this Privacy Policy. The types of entities to whom we may have disclosed and may have shared information with in the last 12 months, include the following:

• Business Transfers. We share information in the event of, or during negotiations of, any proposed or actual merger, reorganization, dissolution or similar corporate event, the sale of all or any portion of our assets, or transfer of all or a portion of our business to another business.

• Disclosure to Public Authorities. Under certain circumstances, We may be required to disclose your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g., a court or a government agency, etc.).  We also share information to protect the rights, property, life, health, security and safety of us, the Services or anyone else.

• Disclosure for Law Enforcement. Under certain circumstances, Company may be required to disclose your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g., a court or a government agency).

• Enterprise Partners. We may share Enriched Data outputs, derived from your connected accounts, with authorized Enterprise Partners who have executed an agreement with Closai, solely to the extent you have authorized at the time of connection. Enterprise Partners are contractually prohibited from reselling, redistributing, or using your data beyond the purpose for which it was shared. They are not permitted to access your underlying account connections, raw email data, or Personal Data beyond the Enriched Data outputs Closai provides. You may withdraw authorization for sharing with a specific Enterprise Partner at any time through your account settings or by contacting us at contact@closai.io.

PLATFORM SERVICE PROVIDERS

We may employ third-party companies and individuals to facilitate our Platform (“Platform Service Provider”), to provide the Platform on our behalf, to perform Platform-related services or to assist us in analyzing how our Platform is used.  These third parties may have access to some of your basic Personal Data only to perform these specific tasks on our behalf and are obligated not to disclose or use it for any other purpose. Some of the ones we utilize for our Platform currently are as follows:

• Sentry for Mobile Crash Reporting and App Monitoring

• Amplitude to collect information on the user interactions and events with the app

Email Marketing

We offer electronic newsletters to which you may voluntarily subscribe at any time. We are committed to keeping your e-mail address confidential and will not disclose your email address to any third parties except as allowed in the information use and processing section or for the purposes of utilizing a third-party provider to send such emails. We will maintain the information sent via e-mail in accordance with applicable laws and regulations.

In compliance with the CAN-SPAM Act, all e-mails sent from us will clearly state who the e-mail is from and provide clear information on contacting the sender. You may choose to stop receiving our newsletter or marketing emails by following the unsubscribe instructions included in these emails or by contacting us. However, you will continue to receive essential transactional emails.

Analytics

We may use third-party Platform Service Provider to monitor and analyze the data shared from your use of our Platform, including, but not limited to:

• Google Analytics.Google Analytics is a web analytics service offered by Google that tracks and reports website traffic. Google uses the data collected to track and monitor the use of our Platform. This data is shared with other Google services. Google may use the collected data to contextualize and personalize the ads of its own advertising network.

For more information on the privacy practices of Google, please visit the Google Privacy & Terms web page.

Payments

We may provide paid products and/or services within the Platform. In that case, we use third-party services for payment processing (e.g., payment processors). We will not store or collect your payment card details. That information is provided directly to our third-party payment processors whose use of your personal information is governed by their Privacy Policy. These payment processors adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, Mastercard, American Express and Discover. PCI-DSS requirements help ensure the secure handling of payment information.

The payment processors we work with include, but are not limited to:

AFFILIATE LINKS TO OTHER SITES

Our Platform may contain affiliate links to other sites that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

CHILDREN'S PRIVACY

Our Service is not intended for children under 13 years of age. No one under age 13 may provide any personal information to or on the Service. We do not knowingly collect personal information from children under 13. If you are under 13, do not use or provide any information on this Service or through any of its features, register on the Service, use any of the interactive or public comment features of this Service, or provide any information about yourself to us, including your name, address, telephone number, email address, or any screen name or username you may use. If we learn we have collected or received personal information from a child under 13 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 13/16, please contact us at contact@closai.io.

California residents under 16 years of age may have additional rights regarding the collection of their personal information. Please see here for more information.

CHANGES TO THIS PRIVACY POLICY

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

ADDITIONAL DISCLOSURES FOR CALIFORNIA RESIDENTS.

Your Rights Under CCPA/CPRA. If you are a California resident, you have the following rights with respect to your Personal Information:

• Right to Know. You may request that we disclose the categories and specific pieces of Personal Information we have collected about you, the categories of sources, our business purpose for collecting or sharing it, and the categories of third parties with whom we share it.

• Right to Delete. You may request that we delete Personal Information we have collected from you, subject to certain exceptions.

• Right to Correct. You may request that we correct inaccurate Personal Information we maintain about you.

• Right to Opt Out of Sharing. Closai shares Enriched Data with Enterprise Partners as described in this Privacy Policy. You have the right to opt out of this sharing at any time through your account settings or by contacting us. We will process opt-out requests within 15 business days.

• Right to Non-Discrimination. We will not discriminate against you for exercising any of your CCPA/CPRA rights.

Categories of Personal Information Collected. In the past 12 months, we have collected the following categories of Personal Information: identifiers (name, email, IP address); commercial information (purchase history, order data); internet or electronic network activity (usage data, cookies); and geolocation data.

Do Not Track. We do not support Do Not Track ("DNT") at this time.

To exercise your California privacy rights, contact us at contact@closai.io with the subject line "California Privacy Request."

ADDITIONAL DISCLOSURES FOR DATA SUBJECTS IN EUROPE (GDPR)

Closai's primary lawful basis for processing your Personal Data, including data collected through OAuth connections and email sync, is your explicit consent, given at the time you connect your accounts to the Platform. You may withdraw this consent at any time without affecting the lawfulness of processing prior to withdrawal. Where processing is necessary to perform a contract with you (e.g., providing the Closai service), we rely on contractual necessity. We may also process data where required by law or where we have a legitimate interest that is not overridden by your rights.

Your Data Protection Rights. If you are a resident of the EEA or UK, you have the following rights:

• The right to access, update, or delete the information we have on you.

• The right of rectification, to have inaccurate or incomplete information corrected.

• The right to object to our processing of your Personal Data.

• The right of restriction, to request that we restrict processing of your Personal Data.

• The right to data portability, to receive a copy of your data in a structured, machine-readable format.

• The right to withdraw consent at any time.

• The right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK, or your national supervisory authority in the EEA).

Data Transfers. Where Closai transfers your Personal Data outside the EEA or UK, we will ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, to protect your data in accordance with GDPR requirements.

Record of Processing. Closai maintains an internal Record of Processing Activities (ROPA) as required under Article 30 of the GDPR. You may request information about how your data is processed by contacting us at contact@closai.io.

To exercise any of your rights, please contact us at contact@closai.io. We will respond within 30 days of a verified request.

CONTACT US

If you have any questions about this Privacy Policy, please contact us by email at: contact@closai.io.