Privacy Policy

Data Controller: we determine how and why your account, billing, and usage data are processed.

Data Processor: for the lead data you upload to Klozeo, including leads a connected app saves there at your request, you remain the Data Controller. We process that data exclusively on your behalf and according to your instructions, including when you ask a connected app to read or change it. Our Data Processing Agreement, part of the Terms of Service, governs this processing from the day you create your account.

When you create an account, we collect:

• Email address
• Email verification date (account metadata)
• Name (if provided)
• Password (stored as a hash, never in plain text)
• Team memberships and roles, if you join or invite a team. The owner and the active members of each workspace you are in see your email address (Section 9.6)
• For each session: IP address and browser (user agent)
• The source of your first visit, only if you accepted it in the cookie banner and your browser still holds it when you sign up: the page that referred you, the landing page and the campaign parameters of the link (Section 7.2)

We store the canonical 9-digit SIREN, including when you submit a SIRET, to identify and deduplicate leads. For a sole proprietor, this identifier can identify a natural person. It appears in lead reads, exports and configured webhooks; the SIRET establishment suffix is not stored or sent.

You control what lead data you store. This data belongs to you. Typical fields include:

• Business names and contact information
• Addresses and geographic location data
• Phone numbers and email addresses
• Website URLs and social media links
• Categories, tags and custom attributes
• Notes and scoring data

We also keep the history of lead creation, updates, merges and deletions: action, date, actor and values before and after the change. The values before and after in the history of a lead deleted more than 30 days ago, including note text and the assignee, are erased by a daily job, so they are gone within 31 days of the deletion. The action, the date, the member or API key that acted, the channel, the reason and the names of the changed fields remain. Backups keep those values for up to 90 days after the erase. The history of a lead that is not deleted is not purged, including the text of a deleted note.

We measure audience without cookies and collect error reports to keep the Service running. See Section 6.

When you use the Klozeo API, we log request metadata (endpoint, timestamp, HTTP status, rate-limit counters) to enforce plan limits and ensure service stability. This data does not include request payloads.

When you connect an app or AI assistant, we record the connection (the app's name and the access it received). See Section 8. We also keep the origin and date of your first connection per channel (Claude, ChatGPT or other) until your account is deleted, even after you disconnect the app. If you create your account from a connected app, we also keep that sign-up origin (Claude, ChatGPT or other) and the app's OAuth client identifier until your account is deleted.

Payments are processed by Stripe Payments Europe, Limited (Ireland). When you create an account, we create a Stripe customer with your email address, your name and your Klozeo account identifier. When you subscribe, you enter your payment details directly with Stripe: we never receive or store card numbers.

Klozeo stores your Stripe customer identifier and, for each subscription, its Stripe identifiers, plan, status, billing period, trial dates, cancellation and end dates, number of seats and billing interval. See Stripe's Privacy Policy for what Stripe collects.

Waitlist: your email address, the plan you are interested in, where you signed up and the page that referred you. We use it to tell you when sign-ups reopen.

Leads Bible guide (PDF): your first name, your email address and your answer to “your biggest challenge”; the form can also send a name, a company size and an industry. We record when the guide was sent, whether and when you downloaded it, and when the two follow-up emails were sent. We use these data to send you the download link and two follow-up emails, 2 and 7 days after the download, only while you have a confirmed newsletter subscription and have not unsubscribed. The request is stored in Klozeo’s database with its own unsubscribe link; it does not create a newsletter record.

Newsletter: the form collects only your email address. Klozeo’s database stores that address, the “newsletter” source, subscription status, creation, sending and confirmation dates, confirmation and unsubscribe tokens, and the confirmation expiry date. Confirmation emails are sent through Resend (Section 9.1).

Unsubscribing: the newsletter record is deleted. Only your normalized email address (lowercase, with leading and trailing spaces removed) remains in an opposition list in Klozeo’s database, without a name, token or date. This list prevents newsletter and guide follow-up emails and is kept after account deletion. The guide request has its own retention period (Section 10.3).

When you write to us through the contact form or by email, we receive your name, email address and message.

To count accepted contacts, we retain a technical event for 400 days: pseudonymous metadata with no directly identifying data (random identifier and exact date-time only, without name, email, message or IP). This timestamp can be matched to that of the received message.

To limit login attempts and abusive email requests, we use shared counters per IP address (IPv4) or network prefix (IPv6 /64 and /48), and per email address for guide and newsletter requests. These identifiers are hashed before storage in Klozeo’s database; counters include request counts, timestamps and an expiry. Hashing is pseudonymization, not anonymization.

These counters are short-lived: a few seconds to two hours, depending on the limit. Expired counters are automatically purged by a task that runs every minute. Temporary in-memory guards also limit requests per IP or network over one minute; they are not stored in the database.

For other authentication routes, technical counters also associate the IP address with the endpoint, without hashing; they are purged after ten minutes of inactivity.

• We do not sell your data
• We do not share your data with third parties for marketing or advertising purposes
• We do not use your data to train AI or machine-learning models
• We do not access your lead data except when strictly required to provide technical support at your request

We use account and operational data to:

• Provide, operate, and maintain the Service
• Process payments and send billing-related communications
• Send transactional emails (email verification, password resets, team invitations, plan changes, the guide you requested)
• Send guide follow-ups only with your current confirmed newsletter consent
• Send up to two onboarding emails in your first days while your account has no leads, each with a one-click unsubscribe link
• Tailor onboarding and product emails by recording, per account, how it connects to Klozeo (for example n8n, Make, Zapier, our SDKs or an AI assistant, with first and last use) and the language of your browser at sign-up, never the raw technical headers
• Respond to support requests
• Monitor service health, detect abuse, and prevent fraud
• Comply with legal and regulatory obligations

• Right to access: obtain a copy of the personal data we hold about you
• Right to rectification: correct inaccurate or incomplete data
• Right to erasure: request deletion of your personal data
• Right to restrict processing: restrict certain processing operations
• Right to data portability: receive your data in a machine-readable format
• Right to object: object to processing based on legitimate interests
• Right to lodge a complaint with the CNIL

You can access and export your lead data at any time using the built-in export features (CSV, JSON, XLSX).

You can disconnect an app or AI assistant at any time; see Section 8.

You can delete your account yourself: in the dashboard, open Settings → Delete my account. Enter your password and type DELETE to confirm. Once the request is recorded, your access is revoked and deletion of the account and associated data is completed within 30 days, subject to the backup retention periods and legal obligations described in Section 10.3.

Your Stripe subscriptions are cancelled. If no invoice has been finalized, the Stripe customer is deleted; otherwise its profile is anonymized (contact details and metadata are cleared), but invoices already issued are kept for accounting obligations.

If you cannot use this process, email [email protected] or use our contact page. We handle your request within 30 days.

• Right to know what personal information is collected and how it is used
• Right to know whether your personal information is sold or disclosed (we do not sell it)
• Right to opt out of the sale of personal information
• Right to access and delete your personal information
• Right to non-discrimination for exercising your privacy rights

• Account creation and management
• Processing your lead data as instructed, including through the apps you connect
• Processing payments and managing subscriptions
• Providing customer support

• Maintaining a secure and functional platform, including error monitoring
• Measuring audience without cookies to improve the Service
• Detecting and preventing fraud or abuse
• Helping new accounts get started with up to two onboarding emails, which you can unsubscribe from in one click
• Enforcing our Terms of Service

• Newsletter and downloadable guides you subscribe to
• Keeping the source of your first visit and the campaign parameters of your sign-in link (Section 7.2)
• Testing variants of our website pages and measuring the results to improve them (Section 6.2)

• Tax and accounting obligations
• Responding to lawful requests from competent authorities

We use Plausible, a privacy-first analytics tool that we host ourselves, to measure aggregate traffic: page views, referrer, device type, browser, country, requests for the guide, and usage events of the website and the dashboard (such as a completed sign-up, a lead created or an export).

Plausible does not use cookies, does not track you across websites and does not store IP addresses. It does not require consent under the GDPR or the ePrivacy Directive, so it runs whether or not you accept the cookie banner.

To stay within that exemption, events go through our own web server before they reach Plausible. Your browser sends only three items: the name of the event, the path of the page (without query string or fragment) and the host of the referring site; the server drops anything else. Plausible receives these three items, your browser's user agent and your network (your IPv4 address, or the first 64 bits of your IPv6 address). It turns the last two into a salted hash that changes every day and into a country, and does not keep the network.

We use GrowthBook, hosted ourselves, to test variants of some pages, only if you accept “Improving the site”. In the dashboard, the variant is computed in your browser from your account identifier, email address and plan.

If you accept “Improving the site” in the cookie banner, your browser creates a random visitor identifier and keeps it for at most 13 months; later visits do not extend this period. When you are not signed in, the variant is computed from this identifier. When a page shows you a variant, your browser sends us this identifier, the name of the test and the variant shown. When you request the Leads Bible guide, subscribe to the newsletter or create an account, your browser also sends this identifier, and we record only that this action took place and when. We never record your email address, name, account or IP address with this data, and we never link it to them. If you refuse, or have not chosen yet, your browser creates no identifier: you always see the standard version of the pages and nothing is sent.

We use this data only to compare the variants of our own pages, as aggregated statistics in GrowthBook. It is not shared with anyone, and we delete it 13 months after recording it. We process it on the basis of your consent (Art. 6(1)(a) GDPR).

You can refuse or withdraw your consent at any time, as easily as you gave it, with the “Cookie settings” link at the bottom of every page of the website except the dashboard, this one included: your browser then deletes the identifier, you always see the standard version of the pages and nothing more is sent. Clearing this website's data in your browser also deletes the identifier and your choice; we ask again on your next visit.

We use GlitchTip, hosted ourselves, to receive technical error traces and a sample of performance traces (about 10%) from the website, the dashboard and the web server: the type of error, where it happened in the code, the page and the browser. These traces contain no cookies and no request content. The IP address is not sent by the application; the error-monitoring server keeps at most a truncated version of it (network prefix), which does not identify you.

Required to operate the Service, these cannot be disabled:

• Session cookies: keep you authenticated during your visit
• Security cookies: protect against CSRF and other attacks
• Workspace cookie: remembers which workspace you selected
• Language cookie: remembers the language you chose, for one year

Legal basis: Art. 6(1)(f) GDPR. Exempt from consent under the ePrivacy Directive.

Whatever you choose in the cookie banner, your browser keeps what the Service needs: your choice itself (for 6 months, then we ask again) and whether you dismissed the onboarding banner.

If you accept “How you found us”, your browser also keeps:

• The source of your first visit: the address of the page that referred you, without its query string, the path of the page you landed on and the campaign parameters of the link
• The campaign parameters of a sign-in link (utm_source, utm_medium, utm_campaign and ref), used only in your browser to choose which onboarding banner the dashboard shows you

If you accept “Improving the site”, it also keeps the random visitor identifier described in Section 6.2 and the list of tests in progress (GrowthBook).

We use the source of your first visit only within 30 days of that visit. It stays in your browser until you sign up, you open the dashboard, you refuse or withdraw your consent, you clear this website’s data, or a visit after those 30 days replaces it. The campaign parameters of a sign-in link are kept for 30 days at most and deleted if you refuse or withdraw. The source of your first visit is sent to us only when you create an account: your browser sends it with your sign-up, we store it on your account for as long as the account exists, and our internal sign-up alert shows it with your email address (Section 9.3). Apart from this, only the random visitor identifier is sent to us, as described in Section 6.2; the rest stays in your browser.

You choose each purpose on its own. If you refuse one, or have not chosen yet, none of its data is stored, read or sent: without “How you found us”, your account records no source; without “Improving the site”, you see the standard version of the pages we test. Refusing changes nothing else on the site.

You can change or withdraw your choice at any time, as easily as you gave it, with the “Cookie settings” link at the bottom of every page of the website except the dashboard, this one included. Withdrawing deletes the values above from your browser. It does not erase a source already stored on your account: it stays there until you exercise your rights over it or delete your account (Section 4).

We do not use advertising, retargeting, analytics or third-party tracking cookies. We do not share cookie data with ad networks or data brokers.

Stripe may set cookies on payment pages. Refer to Stripe's Privacy Policy for details.

You can connect Klozeo to AI assistants and other apps through its MCP server (mcp.klozeo.com), by OAuth authorization or with an API key. Klozeo never sends your data to an assistant on its own initiative: an assistant receives data only when it calls a Klozeo tool or the Klozeo API on your behalf.

What the assistant reads (lead fields, which may include the contact details of the people in your leads, notes, statistics) is then sent to it and processed by its provider (for example Anthropic, Cursor or OpenAI) under that provider’s own terms and privacy policy, as a recipient you chose. Klozeo does not control that processing, including whether the provider uses it to train its models: check your settings with the provider.

Data also travels the other way. When you ask an assistant to save or update leads, for example with contact details you paste into the conversation, it sends those fields to Klozeo. Klozeo stores them in the connected workspace like any other lead data: the same history and retention periods apply (Section 10.3). The change also triggers the webhooks configured in that workspace, and their destinations receive the lead event (Section 9.2). You can correct or delete these leads from the dashboard or the API, within the limits of your role.

Klozeo also keeps a separate save record for each request an assistant makes to save leads. It prevents a retried request from saving twice and lets Klozeo return the same result again. It links the request to the member and workspace that made it, to the connection used, to the identifiers of the leads concerned, to the outcome for each lead and to a fingerprint of the request. It contains no contact details and no conversation text. Klozeo keeps it for 30 days, then the automatic retention purge deletes it. It is separate from lead history, and disconnecting the assistant does not delete it sooner.

An OAuth authorization on the classic MCP server gives the app: Full access to your personal workspace, like an API key.

• Read, create, update and delete your leads and their notes
• Import, update, delete and export leads in bulk
• Manage scoring rules, custom attributes and webhooks
• Manage the API keys of your personal workspace

The app receives an API key of your personal workspace. It does not expire: it stays valid until you revoke it. Team workspaces you belong to are not included.

To disconnect the app, revoke its key under Dashboard → API Keys. The key carries the app’s name.

Klozeo records this key under the app’s name, with its creation date.

A Claude connector added with the address https://mcp.klozeo.com/mcp remains a classic connection.

When you connect ChatGPT to Klozeo, you choose the workspace it can access: your own, or a team you are an active member of. Your role in that workspace (owner, admin, editor or viewer) limits what it can do, and is checked again at every request.

At connection, read-only:

• Search your leads and read every field of a lead
• Read the notes attached to a lead
• Read the statistics, categories and cities of the workspace

Permission to make changes is requested separately, the first time ChatGPT needs it. A viewer cannot grant it:

• Add a note to a lead
• Update the fields of a lead
• Add a tag to a lead

A change made through this app can trigger the webhooks configured in this workspace. A notification already sent to a third-party service cannot be recalled or undone.

ChatGPT can never:

• Create or delete leads, edit or delete notes
• Export your data or make bulk changes
• See, create or delete API keys
• Manage webhooks, scoring rules or custom attributes

Duration and revocation:

• The app receives an access token valid for 8 hours, renewed automatically. The connection stays valid as long as it is used at least once every 6 months.
• Permission to make changes is requested separately, the first time the app needs it. Your answer is remembered for this app and this workspace.
• The connection ends, and Klozeo asks for your consent again, if you disconnect the app, change your password, leave the team or lose the role it requires, if the addresses registered by the app change, or if the connection is not used for 6 months.
• Apps that receive the authorization on your own computer (a localhost, 127.0.0.1 or [::1] address) or through a private app scheme see this screen every time.
• You can disconnect this app at any time in Klozeo, under Dashboard → MCP → Connected applications. Access stops at the next request.

Klozeo keeps a record of each connection: app, workspace, role, permissions granted, and the dates of creation, expiry, last use and revocation. Tokens are stored only as hashes, never in plain text. These records are deleted with your account.

Klozeo does not receive your conversations: only the requests ChatGPT sends to Klozeo’s tools, with their parameters (for example the text of a search or a note) and the technical information ChatGPT attaches, such as language or an approximate location. Klozeo never asks for your password or API keys in ChatGPT. What ChatGPT reads is sent to OpenAI and processed under the OpenAI terms that apply to your account: for a personal ChatGPT account, OpenAI’s Privacy Policy; for a business or education plan (such as ChatGPT Business, Enterprise or Edu), your organization’s agreement with OpenAI, such as the OpenAI Services Agreement, and OpenAI’s commitments on business data.

Claude (claude.ai, Claude Desktop and the mobile apps) connects to Klozeo through Anthropic’s connector system, at https://mcp.klozeo.com/v1/mcp, using OAuth. When you connect Claude, you choose one or more workspaces it can access: your own, or teams you are an active member of. Your role in each workspace (owner, admin, editor or viewer) limits what it can do there, and is checked again at every request. Claude receives the name of each connected workspace, or the owner's email address when a workspace has no name.

At connection, read-only:

• Search your leads and read every field of a lead
• Read the notes attached to a lead
• Read the statistics, categories, cities and statuses of the workspace

Permission to make changes is requested separately, the first time Claude needs it. A viewer cannot grant it:

• Save leads, including contacts you paste into the conversation
• Update an existing lead
• Add a note to a lead
• Add a tag to a lead

A change made through this app can trigger the webhooks configured in this workspace. A notification already sent to a third-party service cannot be recalled or undone.

Claude can never:

• Delete leads, edit or delete notes
• Export your data, import a file or update leads in bulk from a filter
• See, create or delete API keys
• Manage webhooks, scoring rules or custom attributes

Duration and revocation:

• The app receives an access token valid for 8 hours, renewed automatically. The connection stays valid as long as it is used at least once every 6 months.
• Permission to make changes is requested separately, the first time the app needs it. Your answer is remembered for this app and the workspaces you chose. Adding a workspace asks again, in read-only.
• The connection ends, and Klozeo asks for your consent again, if you disconnect the app, change your password, if the addresses registered by the app change, or if the connection is not used for 6 months. If you leave a team or lose the role it requires, that workspace is removed from the connection, which ends when no workspace is left.
• Apps that receive the authorization on your own computer (a localhost, 127.0.0.1 or [::1] address) or through a private app scheme see this screen every time.
• You can disconnect this connector at any time in Klozeo, under Dashboard → MCP → Connected applications. Access stops at the next request.

Klozeo keeps a record of each connection: app, workspaces with the role in each, permissions granted, and the dates of creation, expiry, last use and revocation. Tokens are stored only as hashes, never in plain text. These records are deleted with your account. Klozeo also keeps the date of your first connection through Claude and, if you created your account while connecting Claude, that sign-up origin; both are kept until your account is deleted, even after you disconnect Claude (see Section 2.5).

Klozeo receives only the requests Claude sends to Klozeo’s tools, with their parameters (for example the text of a search or a note, or the contact details you ask it to save) and the technical information that accompanies them; those parameters may repeat parts of your conversation. Klozeo has no access to the rest of your conversations with Claude and never asks for your password or API keys in Claude. What Claude reads is sent to Anthropic and processed under the Anthropic terms that apply to your account: for an individual claude.ai account, Anthropic’s Privacy Policy; for a business plan (such as Team or Enterprise), your organization’s agreement with Anthropic.

Claude Code usually connects to the classic MCP server with an API key, as described in the Claude Code documentation; that access follows the rules for classic MCP connections above. If you use, in Claude Code, a connector added to your claude.ai account, this section applies.

• Cloudflare, Inc. (United States): DNS, TLS, reverse proxy and web application firewall (WAF) for the site, API and MCP server; requests and their technical information, including IP addresses, pass through it. Cloudflare R2 also hosts our encrypted backups in the EU jurisdiction
• Hetzner Online GmbH (Germany): servers hosting the database and our monitoring tools
• Contabo GmbH (Germany): servers running the website, the API and the MCP server
• Stripe Payments Europe, Limited (Ireland): payment processing and billing; a customer record (email address, name, account identifier) is created when you sign up
• Resend (Plus Five Five, Inc., United States): transactional emails, with your email address and the email content
• Fish Audio (Hanabi AI Inc., United States): optional voice onboarding with Martha (beta), only if you accept Martha’s terms; it processes your voice and what you say, your first name and your setup progress, and its real-time infrastructure, LiveKit, receives your browser connection and IP address. No lead data is sent. Details: klozeo.com/martha-terms

Each provider has access only to the data strictly necessary to perform its function and is bound by confidentiality obligations.

An AI assistant or app you connect receives the data it reads on your behalf. Its provider is a separate recipient that you choose. The same applies to the webhook destinations you configure, which receive lead events. See Section 8.

Recherche d’entreprises (api.gouv.fr), a French public service, is a recipient you choose in the same way. We call it only when you ask to enrich a lead (the enrich option on a lead creation, merge or batch item, the enrich endpoint, or the enrich_lead tool of the MCP server). It receives the lead’s SIREN and nothing else. The dashboard never calls it. The company data it returns fills only the lead’s empty, unlocked fields.

When someone signs up, verifies their email, creates a first lead or connects an app or API key for the first time, we post an alert to our internal Discord channel. Discord (United States) receives it. Each alert carries the account’s email address and, if the person accepted the cookie banner, the source of its first visit (Section 7.2). Depending on the event, it also carries the sign-up method, sign-up language, origin (direct or from a connected app), plan and trial end date, or the connection channel and time since sign-up. It carries no lead data, name, message or password. Waitlist and contact form alerts say only that an entry or message arrived.

We may disclose personal data if required by law or by a court decision, or to protect the rights, safety, or property of LB FRAME or our users.

In the event of a merger, acquisition, or asset sale, personal data may be transferred as part of the transaction. We will notify affected users in advance.

The owner and the active members of a workspace you own or join see your email address, whatever their role and on any plan. In the dashboard, they see it wherever it names a person, such as the Do not contact panel. They also read it in API and MCP responses and in exports, as the assignee of a lead and as the author of a note. An AI assistant or app that a member connects receives what that member reads, so it can receive your email address too (Section 9.2). Webhooks carry neither the assignee nor the note author.

In the dashboard, a member who is removed or leaves appears as a former member. Their email address stays in API and MCP responses and in exports, on the leads assigned to them, on the notes they wrote and on the assigned entries of the lead history, until their account is deleted or, for a deleted lead, until its history values are erased. Other members do not see pending invitations. No account outside the workspace sees your email address.

• Encryption in transit (HTTPS/TLS) for all data exchanges
• Passwords stored as hashes
• Access controls by workspace and role, API key authentication
• Vulnerability scans (Go and JavaScript dependencies, secrets in the source code, container images) that must pass before every release

No method of internet transmission is 100% secure. We apply industry-standard protections but cannot guarantee absolute security.

• Technical contact events (pseudonymous metadata): 400 days
• A/B test measurement (random visitor identifier, test, variant, actions): 13 months
• Account and lead data: retained for as long as your account is active
• Lead data: permanently deleted within 30 days of account termination
• Lead history: kept for as long as the owner account exists, then deleted with that account. The values in the history of a lead deleted more than 30 days ago (before and after, note text, attribute values, assignee) are erased by a daily job, so they are gone within 31 days of the deletion. The action, date, member or API key that acted, channel, reason and names of the changed fields remain. Backups keep those values for up to 90 days after the erase, so about 120 days after the deletion. The history of a lead that is not deleted is not purged, including the text of a deleted note. Members see each other’s email addresses in the dashboard and, on assigned entries, in the API (Section 9.6). A removed member’s email address stays on those entries until their account is deleted or, for a deleted lead, until its history values are erased. When a member deletes their account, their actor identifier is removed from other owners’ history
• Assistant save records: a separate record per save request, kept 30 days then deleted by the automatic retention purge. It links the member, workspace and connection to the lead identifiers, the outcome and a request fingerprint, with no contact values and no conversation text
• Webhook events: the content of an event is erased as soon as your endpoint accepts it. If delivery fails for good, or the webhook is paused, it is kept 72 hours after the event so that you can redeliver it, then erased. Delivery receipts (event, state, dates, HTTP status), with no lead data, are kept until the webhook or the account is deleted
• Backups: encrypted and stored in Cloudflare R2 (EU jurisdiction), retained for at most 90 days; deleted data may therefore remain in backups for up to 90 days after deletion. The history values of a deleted lead are erased within 31 days of the deletion and may remain in backups for up to 90 days after that erase
• API keys: a key is deleted when you revoke it; only a minimal audit record remains (key name and dates, no fingerprint). Keys and their audit records are deleted with your account
• Newsletter: unsubscribing stops the newsletter and the guide follow-ups immediately. Klozeo then keeps only your email address, in an opposition list, so that we never write to you again; the newsletter record, including any first name and link tokens it contained, is deleted
• Leads Bible guide requests and waitlist: kept for 3 years after our last contact with you. Waitlist entries of people who have not created an account are also deleted 3 months after sign-ups reopen
• Legal obligations: certain data may be retained longer where required by law

An automatic retention purge runs every day at 03:30 UTC. In particular, it applies the guide request and waitlist retention periods, deletes expired temporary authorizations and retries pending account deletions.