Privacy policy

Effective November 8, 2026. Last updated: November 8, 2026.

This policy explains how Ask Lou LLC, a Delaware limited liability company at 160 Maplewood Ave, Maplewood, NJ 07040, USA ("Closefinch", "we", "us"), handles personal data. It covers our website and the Closefinch service.

1. Two roles

• For our customers' data we're a processor (a "service provider" under US state law). A company that signs up (the "customer") decides what to connect and what Closefinch does with it: email, calendars, meeting recordings, CRM records, and the people in them. We process that data only on the customer's instructions, under our Data Processing Agreement. If you're a person in a customer's emails or meetings and want to use your privacy rights, contact that company. We'll help them answer you.
• For our own users, visitors and buyers we're a controller. That covers account details, billing contacts, website visits and support conversations. The rest of this policy covers that data, and how we treat customer data in practice.

2. What we collect, and why

3. Customer data in practice

• Connected accounts. When someone in a customer's organization connects Gmail, Outlook, a calendar or a CRM, we read only what the features they turn on need. Tokens are encrypted. People can disconnect at any time, and what was captured through a connection can be removed with it.
• Meeting recordings. The recorder joins only when the organization has turned it on and the person who scheduled the meeting has agreed to it. The bot's name says it records, and it posts a notice with a link that anyone can use to stop it. Stopping deletes the media. The customer is responsible for having a lawful basis and for consent where the law requires all parties to agree. Media is deleted after 7 days (30 for meetings with clips). Transcripts are kept for 2 years by default, and each organization can set its own periods.
• AI. Features that use AI send the text a task needs to our AI provider (see Subprocessors). Neither we nor our providers use customer data to train AI models. AI output can be wrong: the product shows its sources, and outgoing messages wait for a person's approval by default.
• Feedback and error reports. What you send us as feedback (from the app or the website), and the error reports the service records, may be processed by AI tools our team uses to diagnose and fix problems. Email addresses, phone numbers, card numbers and secrets are masked before they do, and a person on our team approves any reply to you. An email you give with feedback from the website is used only to reply about it, never for marketing. [COUNSEL REVIEW: added for the ops inbox, OPS-AUTOFIX]
• Google user data. Closefinch's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Gmail and Calendar data only to provide the features the user turns on. We don't use it for advertising and don't sell it. We don't let people read it except: with the user's agreement; for security (such as investigating abuse); to comply with law; or when it's aggregated and anonymized for operations. We don't use it to train AI models.

4. Who we share data with

• Our subprocessors, under contract, for the purposes above.
• Authorities, when the law requires it. We push back on requests that are overbroad and, where we're allowed to, tell the customer first.
• A successor, if Ask Lou LLC is acquired or merged. This policy keeps applying to the data.

We don't sell personal data and don't share it for cross-context behavioral advertising.

5. International transfers

We host in Germany. Some subprocessors are in the United States. Transfers out of the EU, EEA and UK are covered by the European Commission's Standard Contractual Clauses and the UK Addendum, and by the EU-US Data Privacy Framework where a provider is certified.

6. How long we keep data

• Account data while the account exists, then up to 30 days in backups.
• Security records for 1 year.
• Billing records as long as tax law requires (typically 7 years).
• Feedback you send from the app (and survey answers) for 2 years, or until your account or organization is deleted.
• Session replay recordings for 30 days, or until you opt out, an owner turns it off, or your account or organization is deleted.
• Customer data as the customer's settings and our DPA say. When an organization is deleted, its data is purged, including its audit log, and backups expire within 30 days.

7. Security

Safeguards include:

• separation of each organization's data, enforced by the database;
• encryption in transit and at rest (the database disk and every backup), and encrypted connected-account tokens;
• two-step sign-in, which owners need to use owner powers;
• a tamper-evident audit log;
• automated detection and alerting;
• the least access our own staff need.

More is in our security overview.

8. Your rights

Depending on where you live (for example under the GDPR, UK GDPR or California's CCPA/CPRA), you may have the right to:

• access your personal data, correct it, delete it, or get a copy of it;
• restrict or object to our processing;
• withdraw consent;
• not be discriminated against for using these rights.

Owners can ask us for a full export of their organization's data, and users can delete their account in the product. Otherwise, email privacy@closefinch.com. We answer within 30 days (45 under CCPA), and we may need to confirm who you are. You may also complain to your data protection authority.

We offer the service to businesses in the United States and don't direct it to people in the EU or the UK, so we haven't appointed representatives there.

9. Children

The service is for businesses and isn't directed to children under 16. We don't knowingly collect their data.

10. Changes

We'll post changes here, and tell account owners by email before a material change takes effect.

11. Contact

Ask Lou LLC, 160 Maplewood Ave, Maplewood, NJ 07040, USA · privacy@closefinch.com