Privacy Policy

Who we are

Klosemore is a product of SIA Ars Ratio, a limited liability company registered in the Commercial Register of the Register of Enterprises of the Republic of Latvia under number 40203491084, at Muitas iela 35, Ventspils, LV-3602, Latvia. In this policy, "we" means SIA Ars Ratio.

This policy covers the website at klosemore.com, the app at app.klosemore.com, and the messages you send us. Klosemore is built for businesses, so most of the people it describes use Klosemore at work, or appear in the records of a business that does.

Our two roles

The law gives us one of two roles for each kind of data, and the role decides who answers to you for it.

• We decide (controller) for the data of people who visit the website, people who write to us, and people who use a Klosemore account: who they are, how they sign in, what they tell us about Chat's answers, and how much they use the app. This policy covers that data in full.
• Your company decides (processor) for the data your company connects to Klosemore: its CRM records, the email synced into them, what its people ask in Chat, and what they do in Klosemore with that data. We process that data only to run Klosemore for your company, under our Data Processing Addendum with it. If you are a contact in a customer's CRM, that customer answers for your data, and we help them do it.

What we collect and why

When you visit the website

Vercel Web Analytics counts page views: the page, the referring site, your country, device type, operating system and browser. It sets no cookies and records nothing that identifies you. It tells visits apart with a hash of the request that it discards after 24 hours.

Our host logs each request to the website and the app: the time, the page, the page you came from, and your browser and operating system. Like any web server, it also sees your IP address, which it needs to send you the page. The app adds its own log lines about what it does, such as each sync and the details of any error, which can include part of the data it was handling. We read these logs only to find faults and to stop attacks.

Legal basis: our legitimate interest in knowing which pages people read, and in keeping the website and the app working and secure.

When you write to us

Your name, your email address or LinkedIn profile, your company and what you write, so we can answer and follow up. If you report a vulnerability, we keep your report and your address, so we can fix the problem and answer you.

Legal basis: steps you ask for before a contract, and our legitimate interest in answering you.

When you use a Klosemore account

Your name, email address and profile picture from sign-in. If a colleague invited you, your name and email address came from them. Our sign-in provider records when and from which device and IP address you sign in.

In the app we keep your workspace and role, the feedback you give us about Klosemore's answers, how much you use it, and errors. We use it to run the service and to fix it. What you do in Klosemore with your company's data is your company's, as the next entry says.

You need a name and a work email address to have an account. Without them you cannot sign in. Nothing else is required of you.

Legal basis: our legitimate interest in providing the service your company signed up for, and in keeping it working and secure.

What your company connects

When your company connects Pipedrive, Klosemore copies into its own database the deals and leads, the contacts and organisations, the activities and notes (call and meeting notes too), the list of your company's Pipedrive users, the history of each deal's stage and close date, and the email Pipedrive syncs. Searching all of it has to be fast, so a copy is required, not incidental.

What your people ask Chat, and what Chat remembers to answer them better, is your company's data too. So is the record of what each person does with that data in Klosemore, such as the flags they act on or dismiss. Your company's team leads can see it.

Legal basis: your company's instructions, as its processor.

How the AI uses your data

Klosemore analyses what your company connects with automated checks and AI models, to show which deals need attention and why, to answer questions in Chat, and to draft text for you to review.

• No training. We never train AI models on your data, and we use the model providers only under terms and settings that forbid them to train on it.
• No retention at the model providers. Those terms and settings also forbid them to keep it once a request is done, apart from short-term caching and the abuse review described under Where your data lives.
• Nothing changes without a person. Klosemore changes your CRM only if your company's admins allow it, and only when the person using it confirms the change.
• No decisions about people. Klosemore flags deals and suggests next steps. A flag describes what happened on a deal, including what the person who owns it did or did not do, which the GDPR calls profiling; your company tells you about it and answers any objection you make to it. Klosemore makes no decision about anyone that has a legal or similarly significant effect on them, and our Acceptable Use Policy forbids using Klosemore to judge how individual employees perform.

Where your data lives

Klosemore stores the data it holds about your workspace in the EU, in Frankfurt, encrypted in transit and at rest. The AI models that read and write text run in the EU too: every request to them is pinned to an EU region, and it fails rather than run anywhere else.

Six things can still leave the EU:

• Chat's memory. To recall what matters, Chat turns your messages, saved memories and summaries of past chats into search vectors. Amazon Bedrock makes them in the United States, through Vercel's AI Gateway, and keeps nothing after each request.
• The AI Gateway's route. Vercel's AI Gateway may pass a request through another Vercel region on its way to the model.
• Abuse review. A model provider keeps a request it flags for abuse review under its own policy, which can place it outside the EU.
• Our host's logs. Vercel keeps its request and error logs, which can hold fragments of your data, in the United States.
• Sign-in, which runs in the United States.
• Email you send us, which Google Workspace stores in its data centres, in and outside the EU.

The sub-processor list names each company, what it does and where.

When data leaves the EU, it is covered by the EU-US Data Privacy Framework where the company is certified under it, and by the European Commission's standard contractual clauses in the data processing agreement that covers it. The sub-processor list says which applies to each company. Write to us for a copy of the safeguard that applies.

Who we share it with

We never sell your data or use it for advertising. We share it only with:

• Our sub-processors, each for its one job. The sub-processor list names every one. We email every customer's admins at least 30 days before a sub-processor not on that list starts handling their data, or as soon as we can if we must replace one at short notice.
• Our professional advisers, such as lawyers and accountants, when they need it to advise us, and always under a duty of confidentiality.
• Authorities, when the law requires it. We check that each request is lawful and share only what it requires.
• A buyer of the business. If another company buys Klosemore or merges with us, your data moves with the business and stays under this policy. We tell you before it moves.

How long we keep it

We keep data only as long as its purpose needs, unless the law makes us keep it longer, as it does for accounting records.

• Website visits: as anonymous counts only. The visit hash goes after 24 hours.
• Request logs: up to 30 days.
• Messages you send us: until we have answered you and finished following up; if your company is a customer, until its data is deleted when it leaves Klosemore. Sooner if you ask.
• Your account: for as long as you belong to a Klosemore workspace. If your company removes you, we delete your account within 30 days, sooner if you ask, unless you also belong to another Klosemore workspace.
• What your company connects: for as long as your company uses Klosemore, unless it deletes it sooner.
• When your company leaves Klosemore: from the day your company's agreement with us ends or it disconnects its CRM, whichever comes first, Klosemore's access to the CRM stops. Your data stays for 30 days, so your company can reconnect or export it. After that, within a day, we delete your workspace, everything it synced, your chats, and every account that belongs only to your company. Copies in our backups expire within 30days. Someone who also belongs to another customer's workspace keeps their account.

Security

Klosemore encrypts your data in transit and at rest. Only the people who need access to run Klosemore can reach it. The Data Processing Addendum describes these measures in full.

We hold no security certification yet. No system is perfectly secure. If a breach puts your data at risk, we tell the authority, and you when the risk to you is high, as the GDPR requires. For data we process for a customer, we tell that customer, as our Data Processing Addendum says. To report a vulnerability, write to security@klosemore.com, as our Vulnerability Disclosure Policy describes.

Your rights

Under the GDPR, you can ask us to:

• See it: tell you what data we hold about you and give you a copy.
• Correct it: fix data that is wrong or incomplete.
• Delete it: erase your data when we no longer need it or have no right to keep it.
• Limit it: hold your data but stop using it while a question about it is settled.
• Move it: hand you the data you gave us in a format another service can read.

Your right to object. Wherever we rely on our legitimate interest, you can object at any time, for reasons that come from your situation. We then stop, unless we have a stronger reason to continue that the law accepts.

Write to privacy@klosemore.com. It costs nothing. We may ask you to confirm who you are before we act, and we answer within one month. If a request is complex, we can take up to two months more, and we tell you why within the first month.

If your data reached us through a customer's CRM, send the request to that customer. If it reaches us instead, we pass it to them and help them answer you.

You can complain to Latvia's Data State Inspectorate (Datu valsts inspekcija) at dvi.gov.lv, or to the authority where you live or work.

Children

Klosemore is for businesses and is not meant for anyone under 18. We do not knowingly collect a child's data. If you think we have, write to privacy@klosemore.com and we delete it.

Cookies

The website sets no cookies. The app uses cookies to keep you signed in, to secure the connection to your CRM, and to remember how you left the sidebar. It also keeps your panel width and the pages you opened recently in your browser.

Each of these is needed for the service you asked for, so neither the website nor the app asks for consent.

Changes to this policy

At least 30days before a change to this policy applies, we email your workspace's admins and tell the people who use Klosemore, with what changes and the date it applies. A change the law requires can apply sooner, and we tell you as soon as we can.

Every change also appears with its date in the change history at the end of this page, and the date at the top moves with it.

Contact

For anything in this policy, write to privacy@klosemore.com, or by post to SIA Ars Ratio, Muitas iela 35, Ventspils, LV-3602, Latvia.

We have not appointed a data protection officer, as the law does not require one for what we do today. Write to privacy@klosemore.com instead.

If you need this policy in another format, write to us and we send it.