Privacy Policy

Who is responsible

CierrApp (cierrapp.com) is a service operated by Kevin Florentino, an individual, located in Calle El Coral 60, Santo Domingo, Distrito Nacional, Dominican Republic ("CierrApp", "we"). When the company that will operate CierrApp is incorporated, we will update this policy with its legal name and notify client organizations.

For any privacy or personal data question, write to legal@cierrapp.com.

Who this applies to and our role

CierrApp is a cloud sales CRM for businesses (B2B): it organizes leads, appointments, deals, collections and commissions, and offers an artificial intelligence setter that answers messages and books calls. Our customers are organizations ("client organizations"), not individual consumers.

For user account data and technical service data, CierrApp acts as data controller.

For the data of leads, prospects and clients that each organization uploads to or receives in CierrApp, the organization is the controller and CierrApp acts as processor: we process it only on the organization's instructions and to provide the service. If you are a lead or client of an organization that uses CierrApp, contact that organization first; if you write to us, we will pass your request on.

What data we process

Account data: name, email address, role, the organization you belong to, access codes and sign-in logs.

Data each organization uploads or receives: leads and clients (name, email, phone, social media handle, notes), appointments, sales pipeline stages, payments, payment plans and commissions.

Conversations: messages prospects send to the organization through Instagram, Facebook or WhatsApp via its integrations, including voice notes, which are transcribed to text so they can be answered.

Google Calendar data, only if you connect your account (see "Google user data").

Technical data: IP address, browser and request data, used for security and to limit sign-in attempts. We only use cookies and local storage needed to keep you signed in; we do not use advertising cookies.

What we use it for and on what basis

To provide the service each organization subscribes to (performance of contract): showing its information to its team according to role, booking and reminding appointments, calculating collections and commissions, generating reports and answering messages with the AI setter when the organization turns it on.

To send service emails (access codes, notices and reminders), provide support and keep the service secure (legitimate interest and performance of contract).

To send the organization's conversion events to Meta (Conversions API), only when the organization connects that integration and under its responsibility to have the required consent or legal basis; identifiers are hashed when Meta allows it.

To comply with legal obligations.

We do not sell personal data or use it for our own advertising.

Google user data

If you connect your Google Calendar account, we only request the permissions needed to check your availability (busy time ranges) and to create, update and cancel in your calendar the events for the appointments you manage in CierrApp. Specifically: calendar.events (appointment events) and, for availability, calendar.freebusy (busy/free only) or, if Google does not offer it, the narrowest scope available (calendar.events.freebusy or calendar.readonly); from it we only use busy time ranges and we do not store the contents of your events..

We use that data only to show real free slots and keep your appointments in sync. We do not use it for advertising, we do not sell it, we do not transfer it to third parties except the providers needed to deliver this feature, we do not use it to train generalized artificial intelligence models, and no person reads it unless you give explicit permission for support, for security reasons or to comply with the law.

CierrApp's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Access tokens are stored encrypted. You can revoke access at any time from CierrApp settings or at https://myaccount.google.com/permissions; when you do, we stop reading your calendar and delete the tokens.

Use of artificial intelligence

CierrApp includes an AI setter ("Sofi") that answers prospects' messages on behalf of the organization, and an internal assistant ("Clara") that answers questions about CRM data. Both use language models from Anthropic. The organization decides whether to turn them on and can hand any conversation over to a person.

Messages and the necessary context are sent to the model provider only to generate the answer. Under Anthropic's commercial terms, that data is not used to train its models. Google Calendar data is not sent to AI models except what is strictly necessary to propose a time slot within the conversation itself.

Organizations must inform their prospects, where the law requires it, that they may be talking to an automated assistant.

Providers (subprocessors)

We use these providers, which process data on our behalf and only to provide the service: Supabase (database, authentication and functions; USA), Cloudflare (hosting and network; global), Resend (email delivery; USA), Anthropic (language models for the AI setter and Clara; USA), Deepgram (voice provider: converts to text the voice notes the AI setter receives and processes; USA) and Telegram (internal operational alerts for the CierrApp team; global).

Integrations the organization itself connects, which receive or send data only as needed: Meta (Instagram, Facebook, WhatsApp and Conversions API), ManyChat, Calendly, GoHighLevel, RealOffice and Google Calendar. Each is also governed by its own policies.

Authorities, when a law or a valid order requires it.

International transfers

CierrApp is operated from the Dominican Republic, but its providers store and process data mainly in the United States and on Cloudflare's global network. By using the service, client organizations and their users accept those transfers, which we make with providers offering adequate contractual and technical safeguards, in accordance with Dominican Law 172-13 on personal data protection.

How long we keep it

For as long as the organization's account is active. When an organization leaves the service, we provide an export on request and delete or anonymize its data within 90 days, except data we must keep by law. Backups are kept for up to 30 days, so deleted data also disappears from them within that period.

Technical security logs are kept as long as needed for that purpose. Google tokens are deleted when the integration is disconnected.

Your rights and how to request deletion

Under Law 172-13 you can request access to your data, its correction, its deletion, or object to its processing, and request a portable copy where possible, by writing to legal@cierrapp.com from the email linked to your account. We will answer within the legal time limits and, as a rule, within 30 days.

If you are a lead or client of an organization that uses CierrApp, the request is handled by that organization as controller; we help it comply.

If you are not satisfied, you can go to the competent authorities of the Dominican Republic or file a habeas data action.

How we protect it

All traffic is encrypted over HTTPS. Each person only sees the data of their organization and role, and that rule is enforced by the database itself (row-level security), not only by the screen. Integration keys are stored encrypted and never reach the browser. No system is infallible: if a breach affects your data, we will notify affected organizations without undue delay.

Minors

CierrApp is a professional tool and is not directed at anyone under 18. We do not knowingly process minors' data; if we find that it happened, we will delete it.

Changes to this policy

If we change this policy, we will publish the new version on this page with its date. If the change is significant, we will notify organizations by email before it takes effect.