Privacy Policy

Data Controller — we determine how and why your account, billing, and usage data are processed.

Data Processor — for the lead data you upload to Klozeo, you remain the Data Controller. We process that data exclusively on your behalf and according to your instructions.

When you create an account, we collect:

• Email address
• Name (if provided)
• Authentication credentials (stored as secure hashes — never in plain text)
• Profile information

You control what lead data you store. This data belongs entirely to you. Typical fields include:

• Business names and contact information
• Addresses and geographic location data
• Phone numbers and email addresses
• Website URLs and social media links
• Business categories and custom attributes
• Notes and scoring metadata

We collect anonymized analytics data to understand how the Service is used and improve it. See Section 6 — Analytics & Tracking for full details on the tools we use and the data they collect.

When you use the Klozeo API, we log request metadata (endpoint, timestamp, HTTP status, rate-limit counters) to enforce plan limits and ensure service stability. This data does not include request payloads.

Payments are processed by Stripe, Inc. We never store credit card numbers or full payment details. We retain only a Stripe customer ID and subscription status. See Stripe's Privacy Policy for details.

• We do not sell your data
• We do not share your data with third parties for their marketing or advertising purposes
• We do not use your data to train AI or machine-learning models
• We do not access your lead data except when strictly required to provide technical support at your request

We use account and operational data to:

• Provision, operate, and maintain the Service
• Process payments and send billing-related communications
• Send transactional emails (password resets, security alerts, plan changes)
• Respond to support requests
• Monitor service health, detect abuse, and prevent fraud
• Comply with legal and regulatory obligations

• Right to access — obtain a copy of the personal data we hold about you
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure — request deletion of your personal data ("right to be forgotten")
• Right to restrict processing — limit how we use your data in specific circumstances
• Right to data portability — receive your data in a machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés)

You can access and export your lead data at any time using the built-in export features (CSV, JSON, XLSX).

You can delete your account and all associated data via the Service settings, or by contacting us through our contact page.

• Right to know what personal information is collected and how it is used
• Right to know whether your personal information is sold or disclosed (we do not sell it)
• Right to opt out of the sale of personal information
• Right to access and delete your personal information
• Right to non-discrimination for exercising your privacy rights

• Account creation and management
• Processing your lead data as instructed
• Processing payments and managing subscriptions
• Providing customer support

• Maintaining a secure and functional platform
• Analyzing anonymized usage patterns to improve the Service
• Detecting and preventing fraud or abuse
• Enforcing our Terms of Service

• Tax and accounting obligations
• Responding to lawful requests from competent authorities

We use Umami, a privacy-first, open-source analytics platform, to measure aggregate website traffic.

• Does not use cookies or browser storage of any kind
• Does not track users across websites or sessions
• Does not collect personally identifiable information
• IP addresses are anonymized and never stored
• Collects: page views, referrer, device type, browser, anonymized country — all in aggregate

Because Umami operates without cookies and without collecting personal data, it does not require consent under the GDPR or the ePrivacy Directive.

We use PostHog to understand how users interact with the Klozeo dashboard — which features are used, where friction occurs, and how to improve the product experience.

PostHog collects:

• Page views and navigation events within the dashboard
• Feature interactions (clicks, form submissions, API usage patterns)
• Session metadata (browser, OS, viewport — no screen recordings)
• A pseudonymous user identifier stored in a browser cookie

PostHog sets a first-party cookie (ph_*) in your browser to maintain session continuity. This cookie does not track you across third-party websites.

The legal basis for PostHog analytics is legitimate interest (Art. 6(1)(f) GDPR) — understanding product usage is necessary to operate and improve the Service. PostHog data is retained for 12 months.

PostHog is self-hosted on our EU infrastructure. No data is sent to PostHog Cloud servers outside the EU.

Required to operate the Service. These cannot be disabled. They include:

• Session cookies — keep you authenticated during your visit
• Security cookies — protect against CSRF and other attacks

Legal basis: Art. 6(1)(f) GDPR. Exempt from consent under the ePrivacy Directive.

PostHog sets a first-party ph_* cookie to maintain session continuity for product analytics. See Section 6.2 for full details.

We do not use advertising, retargeting, or third-party tracking cookies. We do not share cookie data with ad networks or data brokers.

Stripe may set cookies on payment pages. Refer to Stripe's Privacy Policy for details.

• Stripe, Inc. — payment processing and billing
• Cloud infrastructure providers — hosting on EU-based servers
• PostHog — self-hosted product analytics (EU infrastructure)

Each provider has access only to the data strictly necessary to perform their function and is bound by confidentiality obligations.

We may disclose personal data if required by law or in response to valid legal process (court orders, subpoenas), or to protect the rights, safety, or property of LB FRAME or our users.

In the event of a merger, acquisition, or asset sale, personal data may be transferred as part of the transaction. We will notify affected users in advance.

• Encryption in transit (HTTPS/TLS) for all data exchanges
• Encrypted storage for sensitive fields
• Access controls and API key authentication
• Regular security assessments

No method of internet transmission is 100% secure. We apply industry-standard protections but cannot guarantee absolute security.

• Account and lead data: retained for as long as your account is active
• Lead data: permanently deleted within 30 days of account termination
• Backups: retained for up to 90 days after deletion
• Legal holds: certain data may be retained longer as required by law