Privacy Notice

01. Crucial Distinction: Account Information vs. Prospect Records

To understand your rights and our obligations under data protection regulations (including the Nigeria Data Protection Act 2023 - NDPA), it is necessary to distinguish two separate categories of data handled by Closecraft:

02. Information We Collect & Why

• Identity & Authentication: Name, work email address, and securely salted bcrypt password hashes. We collect this to authenticate authorized workspace users and assign sales responsibilities.
• Workspace Configuration: Organization name, slug, team member roles, seat allocations, and custom follow-up pipeline stages.
• Commercial & Sales Operations Data: Enquiry contact details, communication notes, appointments scheduled, deal stages, and opportunity values. Used strictly to compute Next Best Actions, follow-up SLAs, and prevent revenue leakage within your isolated tenant.
• Audit Trails: Timestamped records of consequential system actions (emergency support access, member role updates, invoice verification). Kept for tenant security and regulatory compliance.

03. Role of Bachs (Payment Provider)

Closecraft partners with Bachs (Bachs.io) as our authorized payment gateway for workspace subscriptions and managed service pilot settlements.

• Closecraft never collects, stores, or processes your raw credit/debit card numbers or bank credentials on our servers.
• When you choose to pay, you are redirected to Bachs secure hosted checkout. Bachs collects and processes payment details under their own regulated security and PCI-DSS compliance frameworks.
• Bachs transmits cryptographic server-to-server webhook events (`collection.succeeded`) to notify Closecraft of verified collections. We store only the transaction reference (`bachsCheckoutId`), amount, and timestamp.

04. Multi-Tenant Isolation & Database Security

We enforce strict multi-tenancy and Database Row-Level Security (RLS) at the PostgreSQL database engine level. Every enquiry, conversation, deal, and invoice is cryptographically and logically bound to its parent organization ID.

Tenant isolation policies prevent cross-tenant data access. No member of another organization can query, update, or view your customer records. AI qualification models operate on scoped prompt context and never cross-train on or disclose data between customer workspaces.

05. Data Retention & Justified Records

We retain account data for the duration of your active workspace subscription. If a workspace is closed or subscription cancelled:

• Workspace data remains accessible in read-only mode during the 7-day grace period.
• Customer organizations may request an export or permanent erasure of prospect records at any time.
• Financial records, invoice numbers, and verified transaction receipts are retained for a statutory period of 6 years in compliance with Nigerian tax and accounting legislation.

06. Your Privacy Rights & Request Route

Under applicable data protection laws, you have the right to access, rectify, port, or request the deletion of your personal data.

07. Contacting Our Privacy Officer

For any questions regarding this Privacy Notice or our data handling practices, please contact: