Privacy Policy

We collect information you provide directly to us, such as when you create an account, use the platform, or contact us for support. This includes:

• Account Information: Name, email address, password, and company name.
• Billing Information: Payment method details (processed securely via Stripe — we do not store card numbers).
• Contact & Lead Data: Phone numbers, email addresses, and business information of leads and customers you upload to the platform.
• Call Data: Recordings, transcripts, and metadata of AI calls placed through the platform.
• Usage Data: How you interact with the platform, including pages visited, features used, and time spent.
• Device & Technical Data: IP address, browser type, operating system, and cookies.
• Referral & Payout Information: If you participate in our referral program, your referral code, the relationship between referrer and referred accounts, commission records, and the payout details you choose to provide (PayPal email, or bank account holder name, bank name, routing and account numbers).

We use the information we collect to:

• Provide, maintain, and improve the ClinchRev platform
• Process payments and manage your subscription
• Authenticate your identity and secure your account
• Enable AI-powered calling and email outreach on your behalf
• Send transactional communications (invoices, call summaries, OTP codes)
• Provide customer support and respond to your requests
• Monitor usage to prevent fraud and abuse
• Comply with legal obligations

We do not sell your personal data or your customers' data to any third parties.

We may share your information with:

• Service Providers (Sub-processors): Trusted third-party vendors who help us operate the platform — see Section 3a below for the complete list. These providers are bound by data processing agreements and may not use your data for their own purposes.
• HubSpot (if you enable sync): Contact and deal data you sync is sent to your own HubSpot account via the HubSpot CRM API.
• Law Enforcement: If required by applicable law, court order, or governmental authority.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with notice to affected users.

ClinchRev relies on the following sub-processors to deliver the service. Each is bound by a Data Processing Agreement (DPA) and processes data only for the purposes described:

• Google (Workspace APIs) — Gmail send/read, Google Calendar event creation. Used only when you connect a Google account. See Section 3b for the Limited Use disclosure.
• Microsoft (Graph API) — Outlook send/read, Microsoft Calendar event creation. Used only when you connect a Microsoft account. We request the minimum scopes required (Mail.Send, Mail.Read, Calendars.ReadWrite, User.Read) and never access OneDrive, Teams, SharePoint, or any other Graph resource.
• Twilio Inc. — Phone number provisioning, outbound call routing, SMS delivery. Twilio processes call metadata and audio in transit. Data is stored in the U.S.
• OpenAI — GPT Live / Realtime voice on sales calls. Processes call audio and transcripts to run the AI agent. ClinchRev calls the OpenAI API directly.
• Stripe — Payment processing for ClinchRev subscriptions and for your own customer billing if enabled. We never store full card numbers — Stripe handles all PCI-scope data.
• HubSpot — Only invoked when you explicitly connect your own HubSpot account. We sync the records you authorize and never read other HubSpot data.
• Apollo.io — Optional lead-data enrichment when you provide your own Apollo API key. We do not share your data with Apollo beyond the search parameters you specify.
• Zoho Mail — Optional outbound email when you connect a Zoho mailbox via SMTP/IMAP. The mailbox credentials you supply are transmitted over TLS and used only to send and receive on your behalf. They are held in ClinchRev's database, and ClinchRev does not apply its own encryption to them there.
• Resend — Transactional email delivery for ClinchRev system emails (password resets, billing receipts). Not used for your outreach campaigns.
• DigitalOcean — Cloud infrastructure hosting and object storage (DigitalOcean Spaces), located in the United States. Traffic to and from the platform is encrypted in transit over TLS. Stored files and database backups carry whatever server-side encryption DigitalOcean applies at the platform level; ClinchRev does not add encryption of its own on top of it. Platform-level encryption does not decide who may read a stored file — that is governed by the access permissions set on the file.
• OpenAI / Anthropic / Google Gemini — Large-language-model inference for AI script generation, lead enrichment summaries, and agent dialog. We use the providers' zero-retention API tiers where available; no model training on your data.

An up-to-date list of sub-processors is maintained at clinchrev.com/legal/subprocessors. We will notify customers at least 30 days before adding a new sub-processor.

ClinchRev's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, with respect to data accessed via Google Gmail API (gmail.send, gmail.readonly) and Google Calendar API (calendar):

• We use Google user data only to provide and improve user-facing features that are prominent in the requesting application — sending outreach emails, detecting replies to those emails, and booking meetings on the user's behalf.
• We do not transfer Google user data to third parties except: (a) as necessary to provide or improve the user-facing features above, (b) with the user's affirmative consent, (c) to comply with applicable laws, or (d) as part of a merger or acquisition with notice to users.
• We do not use Google user data to serve advertisements, build advertising profiles, or for any advertising-related purpose.
• We do not allow humans to read Google user data unless: (a) we have obtained the user's affirmative agreement to view specific messages, (b) it is necessary for security purposes (e.g., investigating abuse), (c) it is necessary to comply with applicable law, or (d) the data is aggregated and used for internal operations in accordance with applicable privacy laws.
• For Gmail gmail.readonly scope, we read only messages threaded with emails ClinchRev sent to detect replies — we do not scan your personal inbox.

Users may revoke ClinchRev's access to their Google account at any time from Google's permissions page or from within ClinchRev Settings → Connected Accounts.

When you connect a Microsoft 365 / Outlook account, ClinchRev accesses Microsoft Graph API using only the minimum scopes required:

• Mail.Send — Send outreach emails on your behalf
• Mail.Read — Detect replies to outreach we sent (limited to threaded messages)
• Calendars.ReadWrite — Book meetings on your Outlook Calendar
• User.Read — Read your basic profile to display the connected account in Settings
• offline_access — Refresh tokens so you don't have to reconnect daily

We do not access OneDrive, SharePoint, Teams, Microsoft 365 Groups, contacts beyond message recipients, or any other Microsoft Graph resource. Access can be revoked anytime at Microsoft Account Consent Manager or from within ClinchRev Settings → Connected Accounts.

We retain your account data for as long as your account is active or as needed to provide services. Call logs and transcripts are kept for the life of your account. Call audio is held by our voice provider for 14 days, within which ClinchRev copies it into its own storage and serves your copy from there; we do not currently publish a guaranteed retention period for archived audio beyond that. You may request earlier deletion of any of it by contacting us at [email protected].

If you close your account, we will delete or anonymize your data within 30 days, unless we are required to retain it for legal or compliance purposes.

We use cookies and similar tracking technologies to remember your preferences, authenticate sessions, and analyze platform usage. You can control cookies through your browser settings, but disabling them may affect platform functionality.

We do not use third-party advertising cookies or sell cookie data.

Traffic between your browser and the platform, and between the platform and the third-party services listed in Section 3a, is encrypted in transit over TLS. Account passwords are never stored in a readable form — they are hashed with PBKDF2-SHA256, the Django framework default. Access to workspace data is restricted by role and by workspace membership, so a member of one workspace cannot read another's.

We want to be specific about what we do not do, rather than leave it to be inferred. ClinchRev does not apply its own encryption to data at rest. Files and database backups held in our hosting provider's storage carry that provider's platform-level encryption and nothing further, and credentials you supply for connected third-party services (see Section 3a) are stored without application-layer encryption. Platform-level storage encryption protects against someone obtaining the underlying disk; it does not limit who may read a stored file, which is decided by the access permissions set on that file.

No system is perfectly secure — we encourage you to use a strong, unique password and enable any available two-factor authentication.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your account and associated data
• Export your data in a portable format
• Object to or restrict processing in certain circumstances
• Withdraw consent where processing is based on consent

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

ClinchRev enables AI-powered outbound calling. As the workspace owner, you are solely responsible for ensuring that every contact you call has given proper consent under all applicable telecommunications laws, including:

• United States: Telephone Consumer Protection Act (TCPA), FCC's 2024 ruling on AI-generated voice calls, state-level robocall and two-party consent recording laws (CA, FL, IL, MA, PA, WA, and others).
• Do Not Call: Federal and state Do Not Call Registry compliance. You are responsible for scrubbing your call lists.
• United Kingdom: Privacy and Electronic Communications Regulations (PECR), Ofcom guidance on automated calling, and the Telephone Preference Service.
• European Union: ePrivacy Directive, GDPR Article 6 lawful basis requirements, and national implementation rules.
• Other jurisdictions: CASL (Canada), Australian Spam Act, and any equivalent rules in regions you target.

ClinchRev's AI agents are configured to identify themselves as AI at the beginning of the call, unprompted, and to confirm it honestly if asked later. FCC Declaratory Ruling 24-17 (CG Docket 23-362, February 2024) treats an AI-generated voice as an "artificial voice" under the TCPA, and 47 C.F.R. § 64.1200(b)(1) requires an artificial-voice call to identify the entity responsible for it at the beginning of the message. Workspace owners must not configure agent prompts to deceive recipients about the AI nature of the call, and the script guard refuses to save a script with the disclosure removed.

Call recordings and transcripts are created and retained for quality, training, and compliance purposes. Every ClinchRev script carries a locked line telling the recipient the call is recorded, delivered in the same breath as the AI disclosure; that line is reattached each time a script is saved, and a script that no longer says a call is recorded is rejected. Whether that notice satisfies the all-party consent law of a particular state for your calls is a question for your own counsel, not something the platform determines.

ClinchRev provides tooling that covers part of this — an AI disclosure and recording notice locked into every script, an internal do-not-call list enforced across your whole workspace, opt-out keyword handling, per-campaign calling windows, and per-number daily calling caps. It does not scrub your lists against the National or state Do Not Call Registries, does not store or verify consent records, does not determine whether a number is wireless or residential, and does not verify that a calling window you configure is legal where your prospects actually are. That matters because 47 C.F.R. § 64.1200(a)(2) requires prior express written consent before an artificial voice places a marketing call to a wireless number, and (a)(3) requires it for residential lines — a requirement no part of ClinchRev can satisfy on your behalf. The legal obligation to comply is yours.

ClinchRev runs a referral program: account holders may share a referral code and earn a commission (currently 10%) on subscription payments made by customers they refer, for as long as those customers remain subscribed. To operate this program we store the referral relationship between accounts, commission ledger entries tied to paid invoices, and payout records.

• Payout details: to send payouts we collect, at your choice, a PayPal email address or bank transfer details (account holder name, bank name, routing number, account number). These are stored encrypted at rest in our database, are never displayed back in full (interfaces show only the last four digits), are never sold or shared with advertisers, and are used solely to send the payouts you request.
• Masked visibility: referrers see only a masked version of a referred user's email address; referred users are not shown the referrer's personal data.
• Retention: commission and payout records are retained as financial records for as long as required for accounting and tax purposes. You may remove or replace your payout details at any time from the Referrals page; removal does not delete historical payout records.
• Fraud prevention: we may review referral activity and void commissions arising from self-referrals, fake accounts, refunded or charged-back payments, or other abuse.

The ClinchRev platform is intended for business use by adults. We do not knowingly collect personal information from anyone under 18 years of age. If you believe we have collected information from a minor, contact us immediately.

ClinchRev is operated from the United States. If you are located outside the US, your data may be transferred to and processed in the US. We take appropriate safeguards to ensure your data is protected in accordance with this policy.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a notice in the platform. Your continued use of the platform after changes become effective constitutes your acceptance of the updated policy.

If you have any questions about this Privacy Policy or how we handle your data, please contact us: