Private beta · Review draft

Closer Circuit Privacy Policy

Who this policy covers

Closer Circuit, LLC ("Closer Circuit," "we," or "us") helps sales teams with coaching, motivation, accountability, activity tracking, and company-configured competitions. This policy covers our website, web application, and iOS and Android applications, including integrations you or your company choose to connect.

Closer Circuit is currently a private beta. A verified person may create one new company workspace as its founding Admin, or an invited member may join an existing company workspace. Creating an account never grants access to another company's data. Features and integrations may remain limited or unavailable while their release requirements are being completed.

For company workspace information, we generally process information on the company's behalf to deliver its configured service. Your company decides membership, roles, scoring rules, and permitted business use. We also handle account administration, security, support, and website communications. Your company's separate privacy notices and employment policies may apply to its use of the service.

Information we handle

• Account and company information: email address, display name, authentication identifier, email-verification status, company and team membership, role, invitations, and an optional profile photo or selected avatar. Authentication is handled through Firebase Authentication; we do not ask you to give us a connected provider's password.
• Activity and competition information: activity counts and times, eligible action types, verification status, limited provider proof, company scoring settings, standings, recognition, and coaching or competition records entered into the workspace. Proof can contain opaque identifiers that distinguish occurrences without storing the underlying customer's conversation.
• Information you submit: support messages, optional profile media, and files or records submitted through available workspace features. Avoid customer names, contact details, financial information, credentials, and unrelated personal information in support reports, coaching notes, or proof uploads.
• Connection information: provider permissions, account/company bindings, access credentials held in server-only stores, connection health, and the minimum targeting information needed to perform a requested provider operation. Google Calendar, Microsoft, and Zoom credentials and sensitive targeting information use application-level encryption; controls for other connectors differ.
• Technical and security information: authentication and authorization events, request and error information, app version/build and platform, bounded mobile operational events, and network information processed by our hosting and infrastructure providers. Support messages are free text; operational mobile telemetry uses restricted event names and fields rather than unrestricted message contents.

The current applications do not request your device address book or precise location. Closer Circuit's current integrations do not automatically ingest call or meeting recordings, audio, video, transcripts, or chat. This does not prevent an underlying provider or meeting host from processing information under its own settings and policies.

Why we use information

We use information to authenticate users, maintain company workspaces, enforce permissions, display the team's configured activity and standings, support coaching and recognition, perform explicitly requested integration actions, investigate problems, prevent misuse, and maintain the service. Company scoring follows the configured rules and available qualifying proof; missing proof is not evidence that a person did no work.

We do not sell personal information or use connected-provider information for advertising or data-broker services. The current product does not use advertising trackers or cross-app tracking. We do not use Google Calendar data to train general-purpose AI models, make lending or creditworthiness decisions, or infer unrelated employee behavior.

Google Calendar

Connecting Google Calendar is optional and belongs to the individual member, not a shared company login. We request an OpenID account identity, permission to list your calendars, and permission to view and manage events on calendars you own. The account identity is used for secure provider-account binding; connecting Calendar does not change your Closer Circuit login.

You choose up to three calendars you own. Closer Circuit can create an event when you request it, and edit or cancel events previously managed through Closer Circuit after your confirmation. The managed-events screen does not display your unrelated Google events. Background synchronization may process limited event fields from selected calendars to maintain synchronization and, if separately enabled, evaluate qualifying appointments. It does not copy your complete calendar into a company dashboard.

Event titles, descriptions, locations, guest addresses, and meeting links needed for an explicit calendar operation are processed transiently and sent to Google. They are not stored as Calendar competition evidence or exposed as unrelated personal calendar content to teammates or company managers. We retain encrypted credentials, selected-calendar identifiers, exact managed-event targets, and private synchronization state as needed for the connection. Provider account and occurrence bindings may use one-way keyed identifiers; these remain protected information rather than a promise of complete anonymity.

Adding a Zoom Meeting Room to Calendar is a separate confirmation. If you cancel a linked room through Closer Circuit, its linked Closer Circuit-managed Google event is also scheduled for removal; a provider failure can leave cleanup pending. Disconnecting Calendar is different: it stops further local access and starts credential and private-state cleanup, but does not delete existing events from Google.

Calendar competition verification is currently disabled in this beta configuration. Connecting or scheduling alone does not award points. Before enabling appointment verification, we will provide the applicable in-product notice and obtain any additional consent required for that use. The qualification design checks a company-approved structured appointment type, an external attendee determination, timing and ownership, duplicates, and cancellation state without retaining guest identity or event text in proof. Calendar can support proof that an appointment was booked; it does not prove that an appointment was held.

You can disconnect from Profile settings under Connections and can revoke access in your Google Account's third-party access settings. Local disconnect blocks new app access before remote cleanup finishes. If disconnect or reconnect fails, contact support; revoked or expired permission does not authorize us to resume access without a valid grant. Previously recorded company activity is not automatically erased by disconnect.

Closer Circuit's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Google-derived information is used only for disclosed user-facing features. Human access and transfers are restricted to permitted support/security, legal, or other policy-authorized circumstances; connecting an account is not blanket permission for staff to read its contents.

Microsoft 365 and Outlook.com

Connecting Microsoft is optional and belongs to the individual member, not a shared company login. We request an OpenID account identity, your basic profile, offline access so the connection survives without asking you to sign in repeatedly, and permission to view and manage calendars and events on your account. The account identity is used for secure provider-account binding; connecting Microsoft does not change your Closer Circuit login, and a member may hold a Microsoft connection and a Google Calendar connection at the same time.

Both work or school accounts and personal Outlook.com accounts may connect. We record which Microsoft directory your account belongs to, so that a company can restrict connections to its own directory if it chooses and so a stored credential cannot be used in the context of a different one. We do not record your Microsoft password, and we do not ask for one.

Access and refresh credentials are held in server-only storage under application-level encryption, bound to your company, your membership, the connection attempt that created them, and the directory that issued them. A credential sealed for one of those cannot be opened in the context of another.

Microsoft calendar reading, event creation, and appointment verification are not active in this beta configuration. Connecting establishes the permission and the credential; it does not yet synchronize your calendar, create events, or award points. Before enabling any of those, we will provide the applicable in-product notice and obtain any additional consent required for that use. When they are enabled, they will follow the same contract described above for Google Calendar: limited event fields processed to maintain synchronization and evaluate qualifying appointments, with event text and guest addresses handled transiently rather than retained as competition proof.

Microsoft Teams attendance is not an active integration. We do not request Teams meeting or attendance permissions in this configuration. Microsoft does not make meeting attendance records available for personal Microsoft accounts, so a personal account could not supply that proof even where the feature is later enabled.

A self-service Microsoft disconnect is not yet available in the product. Contact support to have a Microsoft connection revoked and its stored credential removed, and you can revoke access at any time from your Microsoft account's app permissions. Revoked or expired permission does not authorize us to resume access without a valid grant, and previously recorded company activity is not automatically erased by disconnect.

Other current integrations

RingCentral: A company-authorized connection and rep mappings let Closer Circuit process limited call events, times, results, and provider-measured duration for eligible activity. The normal proof lane retains event facts and business-side mapping identifiers, not call audio, transcripts, or a customer contact database. A separately enabled diagnostic capture can retain credential-redacted provider event material for a short period; credential redaction does not necessarily remove all personal information. That capture is not the normal verification path and must remain restricted to approved troubleshooting.

Salesforce: Where enabled, each member connects their own account. Company approval binds the integration to the permitted Salesforce organization; it does not create a shared Salesforce login. Authorized lead information may be processed to present permitted records to that member, while eligible activity proof is kept separate from full lead content. Connections are read-only by default. Task or other supported writes require separate activation and user action; connecting is not blanket authorization to modify CRM records. Scheduled Salesforce evidence imports are currently disabled.

Zoom Meetings: Eligible hosts connect their own account to create and manage company Meeting Rooms. We handle room details, protected provider targets and join information, and limited lifecycle and pseudonymous attendance observations. Room details are company workspace information, not private-calendar text. Participants join Zoom under Zoom's own service and privacy terms. Meeting reports are subject to provider delivery and verification; Zoom attendance does not create Circuit Points. The connector does not request access to recordings, audio/video contents, transcripts, chat, or Zoom Phone. Zoom Phone and additional social providers are not active integrations in this beta. Microsoft 365 and Outlook.com are described in their own section above.

Disconnecting an integration stops new authorized use through that connection. It does not necessarily cancel previously created provider meetings, erase historical company records, or delete data independently held by the provider. Contact support if the connection's displayed state does not reflect its actual health.

Who information is shared with

Within your company: permitted members can see workplace identity, team context, configured standings, recognition, and information made available by their role. Company administrators, team leads, managers, and coaches have different scopes. Administrators can access company authority/audit history and support reports available to their role. Exports stored in a company workspace can be accessible to its members. Provider credentials and private Google Calendar event contents are not company-directory or leaderboard information.

Service providers: Google/Firebase supplies authentication, hosting, database, storage, logging, and related infrastructure. The selected integration provider receives the requests you authorize. Authorized personnel may process information as necessary to operate and support the service, subject to access restrictions. Google-derived data remains subject to the stricter restrictions above.

Legal and security needs: we may disclose information when required by applicable law or necessary to protect the service, investigate security incidents, or enforce valid agreements. Any such use of Google-derived information must also comply with Google's applicable restrictions. A transfer of Google-derived information in a business transaction requires the conditions and prior consent required by Google policy.

Connected providers operate under their own policies, including Google, Salesforce, RingCentral, and Zoom. These links do not replace our responsibility for information handled by Closer Circuit.

Retention and deletion

We distinguish connection credentials, provider proof, company history, support, and infrastructure logs. Disconnect is not a request to delete all company history, and deleting data in Closer Circuit does not necessarily delete it from a provider.

• Connection credentials and private sync state: retained while needed for an authorized connection. Disconnect or loss of authority blocks local access and starts deletion/revocation work. Provider or cleanup errors can delay completion; support must resolve outstanding cleanup. We do not promise an immediate remote deletion time.
• Verified-action proof: the approved standard is 24 months from the activity occurrence, with lawful preservation where required. Historical company activity summaries and standings are separate from the underlying proof and can remain after proof expires. During this private beta, automatic proof purging is not enabled; retained proof requires authorized cleanup or request handling until that safeguard is activated. Disconnect and offboarding do not automatically remove existing company proof.
• Support reports: scheduled expiry after 90 days. High Five messages: scheduled expiry after 30 days. Related preference/account settings can remain while needed to provide the service.
• Zoom reporting: attendance/reporting records are scheduled to expire 180 days after their latest recorded provider observation; provider meeting mappings are scheduled for removal 30 days after recorded end or cancellation, subject to operational processing.
• Optional diagnostic provider captures: scheduled removal of the raw capture after seven days; minimal event facts can remain under their own retention rules.
• Infrastructure logs: ordinary application logs currently use a 30-day bucket, the separate security-events bucket uses 730 days, and mandatory platform administrative audit logs use 400 days. Application authority history stored in the workspace is separate and currently has no automatic expiry.
• Backups: the current database backup schedule uses a 90-day retention window. Deleted information can remain in protected backups until those copies expire. Restoration must account for earlier deletion and preservation instructions.
• Account records, company activity/history, uploaded files and exports: kept while needed to run the workspace, support its history, or meet authorized retention/preservation needs. These categories do not currently have a single automatic expiry period in the beta. A verified deletion request is handled through support rather than a universal self-service erase button.

Scheduled cleanup is not instantaneous and can be delayed by faults or a valid preservation obligation. We review any extended retention rather than representing a scheduled deadline as a guarantee that every copy has already disappeared.

Your choices and requests

Use Profile settings to manage available personal connections and profile information. You can decline a provider connection, deselect calendars, revoke provider access, or report a connection problem. Disconnect does not by itself erase your company activity history.

For access, correction, export, or deletion of company-controlled information, contact your company administrator. You can also contact support@closercircuit.com; we will verify the request, coordinate with the company where appropriate, and address any obligations that apply directly to us. This policy does not waive rights that applicable law gives an individual or require employer approval where the law does not permit that restriction.

Company export capabilities currently vary by record type. Contact support for information not covered by the available reports. We do not promise a complete self-service export or instant account erasure while those workflows are incomplete.

Devices and security

The applications use necessary session storage to keep users signed in. Mobile authentication state is stored through the platform's Firebase persistence layer; certain drafts and pending support reports use protected device storage. Information displayed on a screen or included in a downloaded report can also be copied or retained on the user's device. Sign out and protect shared devices, and do not assume signing out recalls exports already downloaded.

We use encrypted network connections, company-scoped authorization, server-only credential access, and other technical safeguards. These measures reduce risk; no service can guarantee complete security or uninterrupted availability. This policy is not a certification of compliance with GLBA, HIPAA, SOC 2, or any other standard.

Information is processed using our providers' infrastructure, including the United States, and may be processed where an enabled provider operates. The beta is intended for approved business users, not children. Contact support if a child's information was submitted or if your company needs a specific location or contractual data-processing arrangement before use.

Changes and contact

We will identify the effective version and communicate material changes through the service or an appropriate account/company contact. New uses of connected-provider information require updated notice and any necessary consent before that use begins. Publishing this policy does not enable an integration or represent provider approval; each provider's own review is separate and is recorded where it happens.

For privacy, security, or deletion questions, email support@closercircuit.com. Do not include passwords, provider tokens, customer records, or sensitive attachments in an initial request.