Legal

CloseFlow Privacy Policy

Version 1.0Effective July 12, 2026

CloseFlow Privacy Policy

Version 1.0 · Effective July 12, 2026

Thank you for choosing CloseFlow. This Privacy Policy explains what information we collect, why we collect it, how we use it, and the choices you have. We wrote it in plain English because we believe privacy should be understandable, not buried in legal jargon.

CloseFlow is a business management platform for owner-operated pressure washing companies. We help you send quotes and proposals, manage customers, create invoices, accept payments, and grow your business. This policy describes how we handle information across all of those features.

Who this policy applies to

This policy covers two groups of people:

Business owners and their employees — the pressure washing companies who subscribe to CloseFlow and use it to run their business.
Your customers — the homeowners and property owners who receive quotes, proposals, and invoices from a CloseFlow subscriber.

Where we say "you," we mean whichever group you belong to. Some sections are specific to one group, and we note that clearly.

What information we collect

Information you give us directly

When you create a CloseFlow account (business owner or employee):

Your email address and password (passwords are encrypted — we never see or store them in plain text).
Your first and last name.
If you sign up with Google, the name and email address associated with your Google account.

When you set up your business profile:

Business name, owner name, business email, phone number, and address.
Your website, logo, tax rate, payment terms, currency, timezone, and business hours.
Whether you have connected a Stripe account for payments.
How soon proposals expire and which automatic invoice reminders you want turned on.

When you add your customers:

Customer name, address, phone number, and email address.
Notes and any details you choose to save about the job.

When you create quotes, estimates, and invoices:

Job title, service type (driveway cleaning, house wash, roof wash, etc.), description, and line items.
Pricing, discounts, tax, expiration dates, and due dates.
Status information (draft, sent, accepted, declined, paid, etc.).

When you customize your Project Hub (customer-facing proposal page):

A company introduction, before-and-after photos, team and equipment photos, and captions.
Links to your Google reviews, Facebook, Instagram, and website.
Your license number, insurance details, and certifications.
Frequently asked questions and "why choose us" points.
An optional welcome video (YouTube, Vimeo, or Loom link, or an uploaded file).

When you contact support:

Your name, email, subject, a description of your issue, a category and priority, and any file attachments you choose to upload.

When you accept our Terms of Service:

A record that you accepted, which version you accepted, and the date and time.

Information we collect automatically

Account activity: when you log in, which features you use, and the actions you take (such as creating, sending, or viewing a quote or invoice). We record this so your dashboard and analytics are accurate and so we can keep an audit trail.
Quote and invoice activity: when a proposal is viewed, accepted, declined, or downloaded, so you can track each job.
Customer messages: when a customer submits a question through your proposal page, including their name, email, and message.
Admin activity logs: when an owner or employee takes an administrative action, we record who did it, what they did, and when. This is for security and accountability.
Technical information: basic device and browser information needed to run the app securely.

Information about your customers

When you send a quote or invoice to your customer, CloseFlow stores the customer's name and contact details so the proposal and invoice pages can display them. If your customer submits a question or replies, we store that message and any attachments. Your customers can also view their invoice and pay through a secure token-protected link.

Why we collect it and how we use it

We collect information only to run CloseFlow and the features you signed up for. Specifically:

To create and manage your account — authenticate you, keep you logged in securely, and show your profile.
To run your business tools — store customers, build quotes and estimates, create invoices, and manage your Project Hub.
To let customers respond — show proposals, accept quotes, request changes, view invoices, and pay online.
To send notifications — tell you and your customers when a proposal is sent or viewed, an invoice is due or paid, a support ticket is updated, or a trial is ending. These can be in-app notifications or emails.
To process payments — connect your Stripe account so you can collect payments, and show you basic payment status (paid, pending, etc.).
To provide analytics and business insights — summarize your quotes, invoices, revenue, and customer activity so you can make better decisions.
To provide AI-assisted drafting — help you draft proposal messages, invoice reminders, and analytics insights. These are always drafts that you review and approve before anything is sent.
To support you — answer your support tickets and keep a history of the conversation.
To keep the platform secure — log administrative actions, enforce role-based permissions, and investigate problems.
To comply with legal obligations — keep records where the law requires it.

We do not use your information to sell to third parties, and we do not show you advertising based on your data.

Who we share your information with

We share information only with the services needed to run CloseFlow, and only as described here. We never sell your data.

Stripe — handles all payment processing. When you or your customer pays, the card details go directly to Stripe. We never see or store full card numbers. We store only Stripe's identifiers and masked card details (brand, last four digits, expiration). See the Stripe section below.
Google — only if you choose "Sign in with Google." Google confirms your identity and shares your basic profile (name and email) with us. See the Google Authentication section below.
Our email delivery provider — sends transactional emails on our behalf, such as proposal and invoice emails, reminders, and support notifications. The provider only sees what is needed to deliver the message.
Our AI/LLM provider — only when you use an AI drafting feature. We send the relevant business context (for example, invoice details) so the model can generate a draft. The output comes back to you as an editable draft. See the AI Features section below.
Our hosting and infrastructure platform (Base44) — stores and processes your data to run the app. Base44 operates the servers, database, and security infrastructure that CloseFlow is built on.
Service partners when legally required — if we are legally obligated to share information (for example, a valid legal request), we will share only what is required.

We do not share your customer list, quotes, or financial data with marketing companies, data brokers, or advertisers.

How Stripe handles payment information

CloseFlow uses Stripe to process payments. Stripe is a PCI-DSS compliant payment processor, which means it meets the highest security standards for handling card data.

Card numbers never touch CloseFlow. When you add a payment method or your customer pays, the card details are entered directly on Stripe's secure pages. CloseFlow never receives, stores, or transmits full card numbers.
What we store instead: a Stripe customer ID, a Stripe subscription ID, the card brand (Visa, Mastercard, etc.), the last four digits, and the expiration date. This is enough to show you which card is on file — not enough to charge it.
Billing management: subscription billing, plan changes, cancellations, and refunds are handled through Stripe. You can manage your payment methods and billing history through the Stripe customer portal, linked from your Subscription page.
Stripe's privacy policy is available at stripe.com/privacy.

How Google Authentication works

If you choose "Sign in with Google," Google verifies who you are and then tells CloseFlow that you are authenticated. Here is exactly what happens:

Google sends us your name and email address so we can create or match your CloseFlow account.
Google does not send us your Google password.
We do not get access to your Google emails, contacts, files, or anything else in your Google account — only the basic profile information needed to sign you in.
You can review and revoke CloseFlow's access at any time from your Google account security settings. Revoking access stops new sign-ins via Google; you can still sign in with email and password if you have one set.

If you are an employee invited by an owner, you sign in with email and password (with a one-time verification code the first time), not Google.

Cookies and session management

CloseFlow uses a session token to keep you signed in between page loads. This is how you stay logged in without entering your password on every screen.
We do not use advertising cookies, tracking cookies, or third-party analytics cookies that follow you around the internet.
When you log out, your session ends. When you close the app, the session remains only if your browser keeps it; otherwise you will be asked to sign in again.
Your customer-facing proposal and invoice pages use a secure, unique token in the link so the right customer sees the right document — no login required for them, but the token cannot be guessed.

Security measures

We work to protect your information using industry-standard practices:

Encrypted passwords. Passwords are hashed and salted by our platform — we never store them in plain text and cannot see your actual password.
Role-based access control. Owners, managers, support staff, and analysts each see only what their role allows. Customers are separate and cannot access business tools. See Employee Access Controls below.
Row-level security. Your data is isolated so that only you (and authorized staff helping you) can reach it.
Private file storage for attachments. Files you attach to support tickets are stored privately. They can only be opened through a short-lived, permission-checked signed link — not a public URL.
Encryption in transit. Data sent between your device and CloseFlow is encrypted using HTTPS.
Audit logging. Administrative actions are recorded so we can review who did what and when.
Payment security handled by Stripe. Card data is protected by Stripe's PCI-DSS compliant systems, not by us.
Separate admin authentication. Employees and owners sign in through a dedicated admin login, separate from customer login.

No system is perfectly secure. If a security incident ever affects your data, we will notify affected users promptly and take steps to contain and fix it.

Employee access controls

If you run a team, you can invite employees to help manage your CloseFlow account. Each employee gets a role, and each role limits what they can see and do:

Owner — full access to everything, including managing employees, announcements, legal documents, and all data.
Manager — access to the dashboard, users, subscriptions, support, analytics, and activity log. Cannot manage employees, announcements, or legal documents.
Support — access to the dashboard, users, subscriptions, and support tickets. Cannot see analytics, announcements, or employee management.
Analyst — access to the dashboard and analytics only, and read-only (cannot change data).

Employees sign in with their own email and password through the admin login. Every administrative action they take is logged. You can change an employee's role or disable their access at any time. Customers signing in through the regular login never see admin tools.

AI features

CloseFlow includes optional AI-assisted features that help you work faster. These include:

Drafting proposal introduction messages for quote emails.
Drafting invoice reminder messages for overdue or upcoming invoices.
Generating analytics insights and business coach suggestions from your business data.
Answering natural-language questions about your business analytics.

How these work, honestly:

AI generates drafts only. Nothing is ever sent automatically. Every AI-written message appears as an editable draft that you review, edit, and approve before it goes out.
What we send to the AI provider: only the relevant context needed to produce the draft — for example, the invoice details when drafting a reminder, or summarized analytics when generating insights.
What we do not send: we do not send your password, full payment card numbers (we do not have them), or data unrelated to the task.
No model training on your data. We do not use your business data to train AI models.
You can opt out by simply not using the AI features; all core features work without them.

In-app and email notifications

We send notifications to keep you and your customers informed:

In-app notifications appear in the notification bell in your header — for example, when a support ticket you filed gets a reply.
Email notifications are sent for important events: when a proposal or invoice is sent, when an invoice is due or overdue, when a support ticket is updated, and when your trial is ending.
You cannot turn off transactional emails that are necessary to run the service (such as invoice delivery you initiate), but you control most reminders through your business profile settings, and you can stop AI-drafted messages by not approving them.
We do not send promotional emails unless you have separately opted in.

Trial and subscription accounts

Trial accounts: when you sign up, you get a 14-day trial. We collect the same account and business profile information during the trial as during a paid subscription, so that if you subscribe, everything is already set up. If you do not subscribe, your trial data is retained until you delete it or your account is removed.
Subscription accounts: your subscription status, plan, billing cycle, and Stripe-linked payment details are stored so we can keep your account active and show you your billing information. Subscription management happens through Stripe.

How long we keep your information

Active accounts: we keep your information for as long as your account is active.
Inactive accounts: if you cancel your subscription, your data remains available so you can resubscribe and pick up where you left off. If you want it deleted, you can request deletion (see below).
Customer-facing documents: quotes, proposals, and invoices are kept so you and your customers have a record. Invoices and payment records may be retained for as long as required by tax and accounting law, even after account closure.
Support tickets: kept for as long as needed to provide support and maintain a history, then can be closed and eventually removed.
Audit logs: retained for security and accountability purposes.
Deletion requests: when you request deletion, we remove your personal data from active use. Some records (such as invoices and payment history) may be kept for legal, tax, or accounting reasons, and we will tell you if that applies.

Your rights and choices

You have the following rights regarding your information:

Access: you can see your data in the app — your profile, customers, quotes, invoices, and activity.
Export: you can export your quotes, invoices, and reports as PDF, Excel, or CSV from the relevant pages. You can request a broader export of your personal data through support.
Correct: you can edit your business profile, customer records, quotes, and invoices at any time. To correct account information you cannot edit yourself, contact support.
Delete: you can request deletion of your account and personal data through a support ticket. We will process it, subject to legal retention requirements for certain records.
Withdraw consent: you can stop using Google sign-in and revoke access from your Google account. You can turn off automatic reminders in your business settings.
Opt out of AI features: simply do not use them.
Cancel your subscription: you can cancel anytime from your Subscription page or the Stripe portal. Cancellation stops future billing but does not automatically delete your data.

If you are a customer of a CloseFlow subscriber (not the subscriber yourself) and you want your information corrected or deleted, contact the business that serves you, or reach out to us through the support channel and we will help.

Children's privacy

CloseFlow is a business tool for pressure washing companies and their customers. It is not directed at children, and we do not knowingly collect information from children under 16. If you believe a child has provided us with personal information, please contact us through support so we can delete it.

International users

CloseFlow is based in the United States, and your information is processed and stored on our platform's infrastructure. If you access CloseFlow from outside the United States, your information will still be handled on these systems. By using CloseFlow, you consent to that transfer.

We aim to give every user strong privacy rights, including the right to access, export, correct, and delete personal data, regardless of where they live. If you are in a region with specific data protection laws (such as the EU's GDPR), the rights described above apply to you, and we will do our best to honor them.

Changes to this Privacy Policy

We may update this Privacy Policy as CloseFlow evolves. When we do:

We publish a new version with a new version number and an effective date.
The current, active version is the one shown in the app under Settings → Legal → Privacy Policy.
For material changes, we will notify you through an in-app notice or email before the new policy takes effect.
Past versions are retained in the admin Legal Center for your records.
Your continued use of CloseFlow after the effective date means you accept the updated policy. If you do not agree, you can stop using the service and request deletion of your data.

Contacting us about privacy

If you have questions about this Privacy Policy or want to exercise any of your rights, the best way is to open a support ticket from within the app (Settings → Help & Support). You can choose "privacy" or "account" as the category and mark it high priority if it is urgent. We will respond as soon as we can.

This Privacy Policy reflects how CloseFlow actually works today. We will not overstate our practices, and we will update this document whenever our product meaningfully changes.