Privacy Policy
Last updated: October 21, 2026
This policy explains what personal information ClosingCode collects, how we use it and the choices you have. ClosingCode is operated by DRUKXPERT.PL sp. z o.o., ul. Małopolska 41, 45-301 Opole, Poland (a limited liability company registered in Poland: District Court for Opole, 8th Commercial Division of the National Court Register, KRS 0001068018, NIP (tax ID) 7543364276). We are based in the European Union, so the EU General Data Protection Regulation (GDPR) applies to all personal information we handle, wherever the person lives.
1. Our two roles
- For information about our customers – the people who create an account, join the waiting list or contact us (name, email, phone, office, billing) – we decide how it is used. Under the GDPR we are the controller; under US state laws we are the business.
- For information our customers put into the service about their own clients and the other parties of a transaction, or about the US companies whose IRS filings they prepare (“Customer Data”), we act only on our customer’s instructions: we are a processor / service provider. If you are a home buyer or seller, an agent or an LLC owner and want to see or change your information, please contact the coordinator or office that works with you; we will help them answer you.
2. What we collect
- Account dataExamples: name, email, phone, office name, role, language, time zone, sign-in provider (Google or Microsoft) if you use oneSource: you
- Customer DataExamples: property address, dates, price, names and contact details of clients and parties, notes, checklists, messages, uploaded documents, agreements accepted by typing a nameSource: our customers, and people who use a status, upload, intake or agreement link
- LLC Desk data (when available)Examples: the LLC’s name, address and EIN; the owner’s name, address, country and tax identification numbers; transactions between the owner and the LLC; bank statement rows the owner confirms; signed forms; fax and mail receiptsSource: our customers and the LLC owner
- Money dataExamples: income, expenses, mileage and invoices the coordinator enters; a bank statement file uploaded to match payments is read and not storedSource: our customers
- Security and usage dataExamples: sign-in times, IP address (security events keep it in hashed form), device and browser, actions recorded in the history of changesSource: automatically
- Billing dataExamples: plan, invoices, payment status; card details are handled by the payment provider, not by usSource: you and the payment provider
- Waiting list and communicationsExamples: name, email, role, state or country, the tool you use today, messages and support requestsSource: you
| Category | Examples | Source |
|---|---|---|
| Account data | name, email, phone, office name, role, language, time zone, sign-in provider (Google or Microsoft) if you use one | you |
| Customer Data | property address, dates, price, names and contact details of clients and parties, notes, checklists, messages, uploaded documents, agreements accepted by typing a name | our customers, and people who use a status, upload, intake or agreement link |
| LLC Desk data (when available) | the LLC’s name, address and EIN; the owner’s name, address, country and tax identification numbers; transactions between the owner and the LLC; bank statement rows the owner confirms; signed forms; fax and mail receipts | our customers and the LLC owner |
| Money data | income, expenses, mileage and invoices the coordinator enters; a bank statement file uploaded to match payments is read and not stored | our customers |
| Security and usage data | sign-in times, IP address (security events keep it in hashed form), device and browser, actions recorded in the history of changes | automatically |
| Billing data | plan, invoices, payment status; card details are handled by the payment provider, not by us | you and the payment provider |
| Waiting list and communications | name, email, role, state or country, the tool you use today, messages and support requests | you |
You need to give us your email address to use the service; everything else is optional or needed only for the feature you use. The service is for adults; we do not knowingly collect information from children under 16.
3. How we use it
- to provide and secure the service (sign-in, two-step verification, encryption, history of changes, fraud and abuse prevention);
- to send the messages, faxes and letters you approve, and service emails such as sign-in links, invitations and notices about your account;
- to give support and do migrations you ask for, bill you and keep required business and tax records;
- to contact people on the waiting list about the launch;
- to improve the service using aggregated, de-identified usage information (never LLC Desk tax information).
Legal bases under the GDPR: performance of our contract with you, our legitimate interests in running and improving a secure service and in contacting people who joined our waiting list, compliance with legal obligations and, where needed, your consent.
We do not sell personal information and we do not share it for cross-context behavioral advertising. We do not use Customer Data to train artificial intelligence models. We do not make decisions with legal or similarly significant effects about anyone based only on automated processing.
LLC Desk tax information is used and disclosed only to prepare and send the filing the owner authorized and to keep its proof (including through the fax, mail and AI providers below). It is never used for marketing or any other purpose without the owner’s separate written consent where Section 7216 of the US Internal Revenue Code requires it.
4. Artificial intelligence features
When you use an AI feature (reading a contract or an amendment, writing a message draft, answering a question about a deal, or translating an LLC owner’s statement), the relevant content is sent to our AI provider, Anthropic, only to produce that result. Contracts and amendments are also read a second time, independently, by Mistral AI, so that the two readings can be compared and any difference is shown to you. Our providers may not use the content to train their models and keep it only for the limited time their commercial terms allow for safety monitoring. We do not store the content with the providers. The output is a draft until a person approves it.
6. International transfers
The service is hosted in the United States, close to our customers. The independent second reading of contracts and amendments (Mistral AI) takes place in the European Union. Our team works from the European Union (Poland) and may access personal information from there when needed to run and support the service. When personal information goes from us to providers outside the European Economic Area, we rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on the EU Standard Contractual Clauses. You can ask us for a copy of these safeguards at privacy@closingcode.app.
7. How long we keep it
- Account data: while your account exists; when it is closed or your office is deleted, within 30 days – except invoices and billing records, which we keep as long as tax and accounting law requires (in Poland generally 5 years after the end of the year).
- Customer Data during early access: until the customer deletes it or closes the account, or we end early access with notice.
- Customer Data with paid plans: for as long as the customer’s subscription is active and the customer keeps it (closed deals stay available as an archive). When the subscription ends, the office is read-only for 90 days for export; after a free trial without a paid plan, for 30 days. The data is then deleted from the active service within 30 days. Our customers can delete deals at any time.
- LLC Desk documents (forms, signed copies, proofs of sending): 3 years after the later of the day the filing was sent and April 15 of the year after the tax year; documents of a filing that was never sent, 2 years after the last change. The office is told 30 days before and can keep them longer. A short record of the filing (dates, fax and mail numbers, a fingerprint of the signed copy) stays without the documents. If the office itself is deleted earlier, its LLC Desk documents are deleted with it.
- Security events (failed sign-ins, wrong codes, link guessing): 90 days. The history of changes inside an office: as long as the office’s data.
- Waiting list: until your account opens or you ask us to remove you.
- Backups: encrypted database copies are deleted after 30 days; copies made on the server before an update, after 14 days.
8. Security
We use encryption in transit (TLS), AES-256-GCM encryption by the application for every uploaded document before it is stored, encrypted backups, separation of each office’s data, sign-in links that expire, two-step verification (required for LLC Desk and for money data shared with an accountant), alerts on suspicious sign-in attempts and a history of changes. Links for clients, agents and LLC owners expire and can be cancelled.
No system is perfectly secure. If a breach affects your information, we will notify our customers without undue delay, and we will notify you and the authorities as the law requires (under the GDPR, the authority within 72 hours where required). Report security issues to security@closingcode.app.
10. Your rights
Under the GDPR you have the right to access, correct or delete your personal information, to receive a copy of it, to object to or restrict some uses, and to withdraw consent at any time. You can also complain to a supervisory authority; ours is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.
Residents of California and of other US states with privacy laws (such as Colorado, Connecticut, Texas, Virginia and others) have the right to know, access, correct and delete their personal information, to get a copy, and to opt out of sale, sharing, targeted advertising and profiling – we do none of these. We use sensitive information, such as tax identification numbers, only to provide the service you asked for. We will not discriminate against you for using your rights.
To use your rights, write to privacy@closingcode.app; an authorized agent may also write for you. We will verify your request and answer within the time the law allows (usually 30 days under the GDPR and 45 days under US state laws). If your information was entered by your transaction coordinator, agent or office, we will forward your request to them and help them answer. If we decline your request, you may appeal by replying to our answer; we will respond within the time the law allows, and if you are not satisfied you may contact your state attorney general.
11. Changes
We will post any update on this page with its date. For material changes we will notify account owners in advance, and we will update the provider list at least 30 days before a new provider starts processing Customer Data.
This policy is written in English. The Spanish version is provided for your convenience; if the two differ, the English version controls.
12. Contact
DRUKXPERT.PL sp. z o.o., ul. Małopolska 41, 45-301 Opole, Poland. Email for privacy questions: privacy@closingcode.app. We have not appointed a data protection officer; privacy@closingcode.app reaches the person responsible for data protection.