Privacy Policy - CloseChat AI Assistant

Last Updated: July 2, 2026

Scope

This policy describes how the CloseChat AI Assistant Chrome Extension, its Backend, and its Admin service handle data. CloseChat is an independent product and is not affiliated with WhatsApp or Meta.

Data We Handle

Account and subscription

• Email address, bcrypt-hashed password, account status, subscription status, and timestamps are stored in the CloseChat Backend.
• Authentication tokens and a browser installation identifier are stored in the browser and in Backend session records. Tokens expire and invalid sessions are rejected, but expired database rows are not currently removed by an automatic purge job.

Settings and API credentials

• Your API key, system prompt, and knowledge base are encrypted with AES-256-GCM in the CloseChat database.
• The Extension also keeps account-scoped copies of settings in chrome.storage.local, including the API key in the form needed to attach it to your requests. Chrome extension storage is not encrypted by CloseChat. Do not use a shared or untrusted browser profile.
• Model, language, emoji, feature, style, and task settings are stored as ordinary structured data in the database and/or browser storage. They are not all field-level encrypted.

Contacts, leads, and sales records

• When enabled features create a lead, CloseChat stores the WhatsApp contact identifier, lead status, confidence, activity time, and related metadata in browser storage and the Backend.
• Sales Memory and suggested-action content are encrypted in the Backend. Account-scoped browser copies are not encrypted by CloseChat.
• Tasks are stored in browser storage and as ordinary structured cloud data.
• Style Learning: raw sent-message records used to detect your writing habits stay only in this browser. The feature summaries and learned conclusions computed from them are stored in your CloseChat account (encrypted), and restore automatically when you sign in on another computer. You can delete them in Settings → Data.
• Follow-up and pipeline records are currently stored only in account-scoped browser storage.

WhatsApp content and AI processing

• The Extension reads visible WhatsApp text needed for the feature you choose. It does not upload raw chat history to the CloseChat Backend for storage.
• When you run an AI feature, the relevant messages, your instruction, system prompt, knowledge base, Sales Memory, or Style Profile are sent to the AI provider selected by your model. Every AI request — including the writing samples used for style learning — is relayed through the CloseChat Backend, which assembles the AI instruction on the server and forwards the request to OpenAI; the Backend does not store the request content or the AI response.
• Voice input uses the browser's speech-recognition service. Microphone audio and transcript handling by that service is governed by the browser provider's policy. CloseChat does not persist the voice transcript; after recognition, the transcript is sent to your selected AI provider as your Writer instruction.
• Optional AI transcription (off by default): if you turn on AI transcription in the voice panel, your voice recording is sent directly from your browser to your configured AI provider, authenticated with your own API key, to be converted into text. The recording is not stored by CloseChat and is never sent to the CloseChat Backend. The provider's privacy, retention, and training policies govern its processing of the audio. When this option is off, voice input continues to use only the browser's speech-recognition service.
• Your API key authenticates the request with that provider. Your API key is stored encrypted (AES-256-GCM) so it can sync to your other devices. When a request is relayed, the key is forwarded to OpenAI with that request and is never written to logs. The provider's privacy, retention, and training policies govern its processing.
• CloseChat does not intentionally store raw AI prompts or full AI responses in its Backend, although records you choose to create from AI output, such as tasks, lead data, memory, and pipeline information, may be saved.

Diagnostics and operational logs

• When a browser tab takes unusually long to open, the Extension may automatically send a sanitized technical diagnostic report to the CloseChat Backend. This requires a valid signed-in account session — nothing is sent while you are signed out — and the report is linked to that account. You can turn this off in Privacy Center under "Share technical diagnostics" (on by default).
• Reports are limited to sanitized error type, message, stack, allowlisted technical context (such as tab-load timing and long-task counts), Extension version, server-observed user agent, and the authenticated account identifier the report is linked to. Raw chat messages, AI prompts/responses, credentials, authorization headers, and URL query values are not intended report fields.
• The Backend emits sanitized operational logs to deployment stdout/stderr and may additionally write rotating server files when the operator explicitly enables them. Warnings and errors may also be stored in the error_logs database table. Optional rotating files are bounded by file size/count. Database error logs are automatically deleted after 30 days by default; the operator may configure a different positive period with ERROR_LOG_RETENTION_DAYS.

Data We Do Not Intentionally Collect

• General browsing history outside WhatsApp Web.
• WhatsApp media files such as photos, videos, voice notes, or documents.
• A complete copy of your WhatsApp address book.
• Raw WhatsApp chat history in the CloseChat Backend.

The Extension does read visible contact identifiers and chat text required by enabled features, as described above.

Third-Party Processing

• AI providers: OpenAI receives the content and API credential needed for the request. Review OpenAI's own policy for the account type you use.
• Browser speech-recognition provider: When you choose voice input, the browser may process microphone audio and return a transcript under its provider's own privacy and retention terms.
• AI transcription provider (optional): If you enable AI transcription for voice input, your configured AI provider receives the voice recording and your API credential for that transcription request, under its own privacy and retention terms.
• Supabase/PostgreSQL hosting: CloseChat account and cloud data may be hosted using managed database infrastructure.
• Stripe: Subscription and payment events may be processed by Stripe. CloseChat stores subscription state and webhook event records, not full card details.

Security

• Production Extension-to-Backend traffic uses HTTPS, and AI provider traffic uses HTTPS.
• Passwords are hashed. API keys, system prompts, knowledge bases, Sales Memory, and suggested actions use server-side field encryption where stated above.
• Browser storage should not be treated as encrypted storage.
• Account-scoped storage and session controls reduce cross-account exposure on the same installation, but they are not hardware-level device protection.

Retention and Deletion

• Account, settings, subscription, lead, and session records remain until deleted or invalidated through available controls or operator support. CloseChat does not currently promise automatic account deletion within a fixed number of days.
• Database diagnostic records in error_logs are removed after 30 days by default, or after the positive retention period configured by the operator. This schedule does not delete account, session, lead, or other product records.
• Privacy Center can remove the current contact's lead/memory data, clear tasks, reset style learning (deletes both the local raw records and the learned conclusions stored in your CloseChat account), remove the API key, and delete all lead records. Follow-up and pipeline data for a contact are removed locally by the current-contact delete-all action.
• Signing out clears active session state but intentionally preserves that account's namespaced local records for the next valid sign-in.
• Uninstalling the Extension normally removes its local Chrome extension storage. Cloud records are not deleted merely by uninstalling.
• Full account deletion is not currently self-service. Request it through the support contact supplied with your CloseChat subscription or purchase. The operator must verify the account owner and confirm the deletion scope and completion.

Your Choices

• Disable Lead Status, Follow-up Radar, Pipeline, or Smart To-Do in Privacy Center.
• Turn off "Share technical diagnostics" in Privacy Center (on by default) so no technical diagnostic report is sent.
• Remove your API key or clear specific saved data in Privacy Center.
• Choose which OpenAI account (API key) you use.
• Request access, correction, export, or deletion through the CloseChat support channel associated with your account.

Children

CloseChat AI Assistant is not intended for children under 13, and we do not knowingly offer accounts to children under 13.

Changes

Material policy changes should be communicated through an in-product or account communication channel. The date at the top identifies the current revision.

Contact

For privacy requests, use the CloseChat support contact included with your subscription or purchase receipt. This repository does not publish an unverified example email address or domain.

This policy describes the current implementation and is not legal advice. The operator should obtain jurisdiction-specific legal review before publication.