WinnerCloser Privacy Policy

This Privacy Policy explains how WinnerCloser collects, uses, discloses, and protects personal data when you use our services, websites, and applications (the "Service"). It also describes your rights under applicable data protection laws, including the EU General Data Protection Regulation ("GDPR").

If you do not agree with this Privacy Policy, please do not use the Service.

1) Who We Are

WinnerCloser is the controller of personal data processed in connection with the Service, except where we process personal data on behalf of a customer acting as controller (for example, when a user uploads third-party content). In those cases, WinnerCloser may act as a processor for that specific content.

Controller: WinnerCloser (Paris, France)

Contact: through our contact form

2) Scope

This Privacy Policy applies to:

• Visitors to our website and landing pages
• Users who create an account and use the Service
• Individuals whose data may be included in content uploaded or entered into the Service by users (e.g., meeting notes, transcripts, contacts, emails)

3) Data We Collect

3.1 Data you provide to us

• Account data: name, email, password (hashed), profile details, role.
• Workspace data: workspace/company name, configuration settings, plan/entitlements.
• Billing data (if applicable): billing address, subscription status, invoices.
• (Note: payment processing may be handled by a third-party provider; if you later connect Stripe, Stripe will process payment card data directly.)
• Support communications: messages, attachments, and other information you send to support.
• Content you upload or enter: meeting notes, documents (e.g., annual reports), screenshots, audio files, CRM fields, comments, prompts and instructions.

3.2 Data we collect automatically

• Usage data: feature usage, actions taken in the Service, timestamps, system events.
• Device and log data: IP address, browser type, device identifiers, operating system, referrer URLs, pages visited.
• Cookies and similar technologies: used for authentication, security, and analytics (see Section 11).

3.3 Data from integrations (optional)

If you connect third-party services in the future (e.g., email, calendar, CRM, LinkedIn, analytics), we may process data received from those services according to your configuration and permissions.

4) How We Use Personal Data

We use personal data to:

• Provide and operate the Service (authentication, account administration, core functionality).
• Process and analyze content you submit (including AI-assisted processing such as summarization, extraction, recommendations, and drafting).
• Improve and maintain the Service (debugging, performance monitoring, feature development).
• Security and fraud prevention (abuse detection, access control, audit logs).
• Communicate with you (service messages, confirmations, updates, administrative notices).
• Customer support (responding to inquiries, troubleshooting).
• Legal compliance (tax, accounting, lawful requests).
• Marketing (where permitted) (product updates, newsletters; you can opt out anytime).

5) Legal Bases (GDPR)

We process personal data under one or more of the following legal bases:

• Contract: to provide the Service you requested.
• Legitimate interests: to secure, improve, and operate the Service (balanced against your rights).
• Consent: where required (e.g., certain cookies/marketing communications).
• Legal obligation: to comply with applicable laws.

6) AI Processing and User Responsibilities

6.1 AI features

WinnerCloser offers AI features to help structure and accelerate sales workflows (e.g., summarizing meeting notes, generating account briefs, drafting outreach, extracting signals). AI features may process text, documents, audio, or screenshots provided by users.

6.2 User responsibility for permissions

You are solely responsible for ensuring you have all rights and permissions required to:

• record conversations,
• upload audio, transcripts, notes, screenshots, documents, or other third-party content,
• process personal data of third parties (prospects, customers, colleagues), and
• use company data or confidential information in the Service.

WinnerCloser is not responsible for content you upload or the legality of your data collection. If you do not have permission to upload or record third-party content, do not use those features.

6.3 No legal or professional advice

AI outputs are generated from data you provide and may be incomplete or inaccurate. WinnerCloser does not provide legal advice, and you must validate outputs before relying on them.

7) How We Share Data

We do not sell your personal data.

We may share personal data with:

• Service providers (sub-processors) who help us run the Service (see Section 8).
• Affiliates and contractors as needed for operations (subject to confidentiality).
• Legal authorities if required by law or to protect rights, safety, and security.
• In a transaction (merger, acquisition, sale of assets), with appropriate safeguards.

8) Sub-processors (Service Providers)

We use vetted service providers ("sub-processors") to operate the Service. Depending on your usage, data may be processed by:

• OpenAI (USA) – AI processing (transcription, summarization, generation).
• Railway (USA) – Application hosting, managed databases, infrastructure operations.
• Postmark (USA) – Transactional email delivery (account emails, notifications).
• Scaleway Object Storage (EU) – File storage for documents and media you upload (S3-compatible object storage).

We require sub-processors to process data only on our instructions and to implement appropriate security measures.

9) International Data Transfers

WinnerCloser is operated from the European Union, but some sub-processors are located in the United States (e.g., OpenAI, Railway, Postmark). As a result, personal data may be transferred outside the EEA/UK/Switzerland.

When transferring personal data internationally, we rely on appropriate safeguards, such as:

• EU Standard Contractual Clauses (SCCs), and
• additional technical and organizational measures where appropriate (e.g., access controls, encryption in transit, minimization).

For file storage, we may store uploaded documents and media in the EU via Scaleway Object Storage, which reduces cross-border exposure for stored files. However, if you use AI features, some relevant content may still be transmitted to AI providers in the USA.

You can request information about our transfer safeguards by contacting us through our contact form.

10) Data Retention

We retain personal data only as long as necessary for the purposes described in this Privacy Policy, including:

• providing the Service,
• complying with legal obligations,
• resolving disputes,
• enforcing agreements.

Retention depends on data category:

• Account and workspace data: retained while your account is active.
• Uploaded content (documents, notes, audio): retained until you delete it or close your account, subject to backup retention.
• Logs and security events: retained for a limited period for security and troubleshooting.

You can request deletion of your account and associated data, subject to legal retention requirements.

11) Cookies and Tracking

We use cookies and similar technologies for:

• authentication and session security,
• preferences,
• analytics and performance (where enabled),
• fraud prevention and abuse detection.

You can control cookies through browser settings. Some cookies are necessary for the Service to function.

12) Security Measures

We implement reasonable technical and organizational measures to protect personal data, including:

• access controls,
• encryption in transit (HTTPS/TLS),
• least-privilege permissions,
• monitoring and logging,
• secure storage practices.

No system is 100% secure. You are responsible for keeping your login credentials confidential.

13) Your Rights (EEA/UK/Switzerland)

Depending on your location, you may have rights to:

• access your personal data,
• rectify inaccurate data,
• delete data ("right to be forgotten"),
• restrict processing,
• data portability,
• object to processing (including marketing),
• withdraw consent (where applicable).

To exercise your rights, contact us through our contact form. We may need to verify your identity.

14) Children's Privacy

The Service is not intended for children under 16 (or the age required by local law). We do not knowingly collect personal data from children.

15) Third-Party Links and Integrations

The Service may contain links to third-party websites or allow integrations with third-party services. Their privacy practices are governed by their own policies. We are not responsible for third-party services.

16) Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If changes are material, we will provide notice through the Service or by email where appropriate. The "Effective date" will indicate when the latest version applies.

17) Acceptance

You do not accept this Privacy Policy on this page. Your acceptance occurs when you accept our Terms of Service during sign-up or when you continue using the Service after we notify you of material updates, where permitted by law.

For convenience, the Terms of Service reference this Privacy Policy. If you do not agree, please do not use the Service.

Annex A — Sub-processors