Privacy Policy

We collect information you provide directly to us, such as when you create an account, use the platform, or contact us for support. This includes:

• Account Information: Name, email address, password, and company name.
• Billing Information: Payment method details (processed securely via Stripe — we do not store card numbers).
• Contact & Lead Data: Phone numbers, email addresses, and business information of leads and customers you upload to the platform.
• Call Data: Recordings, transcripts, and metadata of AI calls placed through the platform.
• Usage Data: How you interact with the platform, including pages visited, features used, and time spent.
• Device & Technical Data: IP address, browser type, operating system, and cookies.

We use the information we collect to:

• Provide, maintain, and improve the ClinchRev platform
• Process payments and manage your subscription
• Authenticate your identity and secure your account
• Enable AI-powered calling and email outreach on your behalf
• Send transactional communications (invoices, call summaries, OTP codes)
• Provide customer support and respond to your requests
• Monitor usage to prevent fraud and abuse
• Comply with legal obligations

We do not sell your personal data or your customers' data to any third parties.

We may share your information with:

• Service Providers (Sub-processors): Trusted third-party vendors who help us operate the platform — see Section 3a below for the complete list. These providers are bound by data processing agreements and may not use your data for their own purposes.
• HubSpot (if you enable sync): Contact and deal data you sync is sent to your own HubSpot account via the HubSpot CRM API.
• Law Enforcement: If required by applicable law, court order, or governmental authority.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with notice to affected users.

ClinchRev relies on the following sub-processors to deliver the service. Each is bound by a Data Processing Agreement (DPA) and processes data only for the purposes described:

• Google (Workspace APIs) — Gmail send/read, Google Calendar event creation. Used only when you connect a Google account. See Section 3b for the Limited Use disclosure.
• Microsoft (Graph API) — Outlook send/read, Microsoft Calendar event creation. Used only when you connect a Microsoft account. We request the minimum scopes required (Mail.Send, Mail.Read, Calendars.ReadWrite, User.Read) and never access OneDrive, Teams, SharePoint, or any other Graph resource.
• Twilio Inc. — Phone number provisioning, outbound call routing, SMS delivery. Twilio processes call metadata and audio in transit. Data is stored in the U.S.
• VAPI — AI voice synthesis and call orchestration. Processes call audio + transcripts on our behalf to run the AI agent.
• Stripe — Payment processing for ClinchRev subscriptions and for your own customer billing if enabled. We never store full card numbers — Stripe handles all PCI-scope data.
• HubSpot — Only invoked when you explicitly connect your own HubSpot account. We sync the records you authorize and never read other HubSpot data.
• Apollo.io — Optional lead-data enrichment when you provide your own Apollo API key. We do not share your data with Apollo beyond the search parameters you specify.
• Zoho Mail — Optional outbound email when you connect a Zoho mailbox via SMTP/IMAP. Credentials are encrypted at rest and used only to send/receive on your behalf.
• Resend — Transactional email delivery for ClinchRev system emails (password resets, billing receipts). Not used for your outreach campaigns.
• DigitalOcean / AWS — Cloud infrastructure hosting. Data is stored encrypted at rest (AES-256) and encrypted in transit (TLS 1.2+).
• OpenAI / Anthropic / Google Gemini — Large-language-model inference for AI script generation, lead enrichment summaries, and agent dialog. We use the providers' zero-retention API tiers where available; no model training on your data.

An up-to-date list of sub-processors is maintained at clinchrev.com/legal/subprocessors. We will notify customers at least 30 days before adding a new sub-processor.

ClinchRev's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, with respect to data accessed via Google Gmail API (gmail.send, gmail.readonly) and Google Calendar API (calendar):

• We use Google user data only to provide and improve user-facing features that are prominent in the requesting application — sending outreach emails, detecting replies to those emails, and booking meetings on the user's behalf.
• We do not transfer Google user data to third parties except: (a) as necessary to provide or improve the user-facing features above, (b) with the user's affirmative consent, (c) to comply with applicable laws, or (d) as part of a merger or acquisition with notice to users.
• We do not use Google user data to serve advertisements, build advertising profiles, or for any advertising-related purpose.
• We do not allow humans to read Google user data unless: (a) we have obtained the user's affirmative agreement to view specific messages, (b) it is necessary for security purposes (e.g., investigating abuse), (c) it is necessary to comply with applicable law, or (d) the data is aggregated and used for internal operations in accordance with applicable privacy laws.
• For Gmail gmail.readonly scope, we read only messages threaded with emails ClinchRev sent to detect replies — we do not scan your personal inbox.

Users may revoke ClinchRev's access to their Google account at any time from Google's permissions page or from within ClinchRev Settings → Connected Accounts.

When you connect a Microsoft 365 / Outlook account, ClinchRev accesses Microsoft Graph API using only the minimum scopes required:

• Mail.Send — Send outreach emails on your behalf
• Mail.Read — Detect replies to outreach we sent (limited to threaded messages)
• Calendars.ReadWrite — Book meetings on your Outlook Calendar
• User.Read — Read your basic profile to display the connected account in Settings
• offline_access — Refresh tokens so you don't have to reconnect daily

We do not access OneDrive, SharePoint, Teams, Microsoft 365 Groups, contacts beyond message recipients, or any other Microsoft Graph resource. Access can be revoked anytime at Microsoft Account Consent Manager or from within ClinchRev Settings → Connected Accounts.

We retain your account data for as long as your account is active or as needed to provide services. Call recordings and transcripts are retained for 90 days by default. You may request earlier deletion by contacting us at [email protected].

If you close your account, we will delete or anonymize your data within 30 days, unless we are required to retain it for legal or compliance purposes.

We use cookies and similar tracking technologies to remember your preferences, authenticate sessions, and analyze platform usage. You can control cookies through your browser settings, but disabling them may affect platform functionality.

We do not use third-party advertising cookies or sell cookie data.

We implement industry-standard security measures including encryption in transit (TLS/HTTPS), encryption at rest, secure password hashing, and role-based access controls. However, no system is perfectly secure — we encourage you to use a strong, unique password and enable any available two-factor authentication.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your account and associated data
• Export your data in a portable format
• Object to or restrict processing in certain circumstances
• Withdraw consent where processing is based on consent

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

ClinchRev enables AI-powered outbound calling. As the workspace owner, you are solely responsible for ensuring that every contact you call has given proper consent under all applicable telecommunications laws, including:

• United States: Telephone Consumer Protection Act (TCPA), FCC's 2024 ruling on AI-generated voice calls, state-level robocall and two-party consent recording laws (CA, FL, IL, MA, PA, WA, and others).
• Do Not Call: Federal and state Do Not Call Registry compliance. You are responsible for scrubbing your call lists.
• United Kingdom: Privacy and Electronic Communications Regulations (PECR), Ofcom guidance on automated calling, and the Telephone Preference Service.
• European Union: ePrivacy Directive, GDPR Article 6 lawful basis requirements, and national implementation rules.
• Other jurisdictions: CASL (Canada), Australian Spam Act, and any equivalent rules in regions you target.

ClinchRev's AI agents are configured to identify themselves as AI when asked, per the FCC's February 2024 ruling. Workspace owners must not configure agent prompts to deceive recipients about the AI nature of the call.

Call recordings and transcripts may be created and retained for quality, training, and compliance purposes. In two-party-consent recording states, our default scripts include the disclosure "this call may be recorded." Disabling that disclosure is your responsibility and you accept liability for doing so.

ClinchRev provides tooling to comply (DNC scrubbing, business-hours enforcement, opt-out keyword handling, automatic AI disclosure) but the legal obligation to comply is yours.

The ClinchRev platform is intended for business use by adults. We do not knowingly collect personal information from anyone under 18 years of age. If you believe we have collected information from a minor, contact us immediately.

ClinchRev is operated from the United States. If you are located outside the US, your data may be transferred to and processed in the US. We take appropriate safeguards to ensure your data is protected in accordance with this policy.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a notice in the platform. Your continued use of the platform after changes become effective constitutes your acceptance of the updated policy.

If you have any questions about this Privacy Policy or how we handle your data, please contact us: