Privacy Policy

1. Scope and who we are

This Privacy Policy explains how UltimateCloser.Ai ("Ultimate Closer," "we," "us," "our") handles personal information when you visit our website, create an account, connect a Shopify or WooCommerce store, install our application, plugin or tracking script, or use our AI agents, dashboard and APIs (the "Service"). It should be read with our Terms of Service and Data Processing Addendum.

UltimateCloser.Ai is strictly a software and technology service provider. We license on-store shopper engagement, intent analytics and cart-recovery software — the 24/7 Closer concierge agent and the Exit Recovery Specialist agent — together with catalog synchronization, live sales tracking and the optional AdSync Google Ads and Meta Ads automation for connected Shopify and WooCommerce stores. We do not provide marketing coaching, sales training programs, guarantees of advertising performance, or professional financial or legal advice, so this Policy covers software use and nothing else.

This Policy, together with our Terms of Service, is governed by and construed in accordance with the laws of the State of Nevada.

Opt-in by design. Our on-site AI features operate on an opt-in basis: a shopper chooses whether to engage the agent and whether to share an email address, every marketing message carries a one-click unsubscribe, and Global Privacy Control signals are respected. We use only first-party signals from the merchant's own storefront. We do not run third-party advertising or data-broker trackers through the Service, we do not sell or share shopper personal information for cross-context behavioural advertising, and we accept no third-party tracking on the merchant's behalf.

2. Controller and processor roles

• Merchant account data. For information about you as our customer — your name, login, billing and support history — we are the controller (or "business").
• Shopper data from your store. For information about your store's visitors and customers, you are the controller and we act as your processor / service provider, processing that data only on your instructions to deliver the Service. You are responsible for your storefront privacy notice, tracking disclosures, lawful basis or consent where required, and for passing on shopper requests, which the Service is built to support.

3. Merchant and account data we collect

• Account information: name, business name, email address, authentication credentials (passwords are stored hashed), workspace settings and reply-to address.
• Store connection data: your Shopify or WooCommerce store address, platform type, installation and authorization records, encrypted access tokens or API credentials, tracking keys, and whether the storefront app, plugin, script and order-event connection are active.
• Billing data: your chosen plan, subscription and customer identifiers from Stripe or Shopify, invoice and commission statement history, plan status, and payment outcomes. Direct website and WooCommerce purchases are processed by Stripe. If you purchase UltimateCloser.AI for Shopify through the Shopify App Store, Shopify processes the payment directly and includes it on your Shopify invoice. We do not store full card numbers; payment-card details are handled by the applicable payment provider.
• Integration credentials: third-party API keys you choose to connect for legacy platform modules, stored encrypted.
• Ad account data (AdSync): if you connect Google Ads or Meta Ads, we store the authorization records and access and refresh tokens for those accounts (encrypted and kept server-side only), your ad account and campaign identifiers, and campaign, budget, spend and performance metrics returned by those platforms. We use them only to run the automation you enabled and to show your reporting. We never receive or handle your ad spend — that is billed to you by Google and Meta — and you can disconnect an ad account at any time, which revokes our access.
• Usage, device and log data: IP address, browser and device type, pages and dashboard features used, timestamps, and error and audit logs.
• Support communications: emails and messages you send us.

4. Shopper and store-visitor data we process

When our script or app embed is active on your storefront, we process the following on your behalf so the agents can work:

• Session and behaviour signals: a pseudonymous visitor or session identifier, pages and products viewed, time on page, repeat-visit counts, cart-add and checkout-start events, exit-intent events, referrer, coarse location derived from IP, device and browser type.
• Interaction logs: conversations with the 24/7 Closer and Exit Recovery Specialist — shopper messages, agent responses, recommended products, objections handled, and timestamps — stored as transcripts visible to you in your dashboard.
• Contact details voluntarily provided: an email address (and, where you enable it, name) that a shopper submits to the agent, for example to receive a cart reminder or a future sale, restock or clearance alert, together with the consent and unsubscribe state for that address.
• Recovery message records: messages sent, delivery and open or click events where available, unsubscribe events, and an attribution token used to match a completed order back to the interaction that recovered it.
• Order data received from your commerce platform: order identifier, order value, currency, timestamps, line-item context and — where present — the customer email or identifier used for attribution matching. We do not need or intentionally store full payment card data.

Low-intent exclusions. By design the Service ignores casual browsing signals and non-buying pages such as blog and policy pages, and it never contacts people who have not interacted with your storefront. We do not buy, rent or ingest third-party contact lists, and we do not build cross-merchant profiles of shoppers or share one merchant's shopper data with another merchant.

5. Catalog synchronization data

With the platform access you authorize, we read and periodically refresh your product catalog — product and variant titles, descriptions, images, options, prices, compare-at prices, SKUs, categories or collections, tags and inventory availability — and store it in your workspace so agent answers are grounded in your real data. Catalog data is business data, not personal information, unless you place personal information inside product fields. It is used only to serve your store's agents and is deleted with your workspace as described in Section 10.

6. Store events and live sales tracking

Shopify can transmit order, checkout and app events to us over signed HTTPS webhooks, whose signatures we verify before processing. For WooCommerce, the authorized integration, WordPress plugin and tracking script transmit or allow us to retrieve the corresponding catalog, storefront and order events using platform credentials and store-specific tracking identifiers. These events populate your live sales feed, compute performance metrics and recovered-revenue attribution, and calculate commissions described in our Terms. Stripe separately transmits signed subscription and payment events for Stripe-billed purchases, while Shopify transmits app-subscription and billing status for purchases billed through the Shopify App Store. We store only the fields needed for these purposes and reject or ignore unrelated or unauthorized event data.

7. AI processing of conversations and messages

To generate agent replies and recovery copy we send the necessary context — the shopper's message, relevant catalog entries and the interaction context — to our AI model providers (for example Google's Gemini models) as our subprocessors, under contract terms that restrict use to serving your request. We instruct the agents to avoid requesting sensitive personal information from shoppers, and you must not configure them to collect it.

We do not use your shopper conversations, catalog data or store data to train general-purpose AI models, and our AI subprocessors are contractually prohibited from doing so with data submitted through our enterprise APIs. AI output can be inaccurate; see Section 5 of our Terms.

8. How we use information and legal bases

• To provide the Service — run the agents, sync your catalog, track sales, attribute recoveries, show dashboards. Legal basis: performance of a contract with you; for shopper data, your instructions as controller.
• To bill you — process subscription and commission charges, issue statements, handle refunds and disputes. Legal basis: contract and legal obligation.
• To secure the Service — authenticate users, detect abuse and fraud, enforce our Terms, keep audit logs. Legal basis: legitimate interests and legal obligation.
• To support you — answer requests, send service, security and billing notices. Legal basis: contract and legitimate interests.
• To improve the Service — diagnostics and aggregated, de-identified statistics that do not identify you, your store or your shoppers. Legal basis: legitimate interests.
• Marketing to merchants — where permitted, with opt-out in every message. Legal basis: consent or legitimate interests, depending on your jurisdiction.

We do not sell personal information and we do not share it for cross-context behavioural advertising.

9. Sharing, subprocessors and international transfers

We share personal information only with service providers acting on our behalf, under confidentiality and data-protection terms:

• Cloud hosting, database and authentication infrastructure — to run the Service and store your workspace data with row-level authorization.
• Stripe — payment processing, subscription and commission billing, receipts, refunds, tax compliance and the customer portal for direct website and WooCommerce purchases. Stripe handles that data under its own privacy notice.
• Shopify — commerce-platform services, catalog, storefront and order data, plus direct app-subscription and payment processing when UltimateCloser.AI for Shopify is purchased through the Shopify App Store. Shopify handles app-store billing data under its own privacy notice and its agreement with the merchant.
• WooCommerce, WordPress and Automattic — commerce and publishing platforms that transmit or provide catalog, storefront and order data at your instruction.
• AI model providers — to generate agent responses and message copy.
• Email delivery providers — to send platform notices and, for the Exit Recovery Specialist, recovery messages sent in your name.
• Analytics and error monitoring — to keep the Service reliable.

We may also disclose information where required by law, to respond to lawful requests, to protect our rights or the safety of others, or in connection with a merger, acquisition or asset sale, in which case we will require the recipient to honor this Policy.

International transfers. We and our subprocessors operate in the United States and other countries. Where personal information is transferred out of the EEA, the UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable), together with technical and organizational measures. A current subprocessor list is available on request at privacy@ultimatecloser.ai.

10. Retention and deletion

• Account and billing records — kept while your account is active and afterwards as required for tax, accounting, dispute-resolution and legal purposes (generally up to 7 years for financial records).
• Behaviour and intent signals — retained for the period needed to run attribution and reporting, then deleted or aggregated.
• Conversation transcripts, captured emails and recovery message records — retained while your workspace is active so you can review them, and deleted on your instruction or with your workspace.
• Catalog data — refreshed on sync and deleted when the store is disconnected or the workspace is deleted.
• Store data after disconnecting — when you uninstall the app or plugin, remove the tracking script, revoke credentials, or close your account, we stop new collection through the disconnected integration and delete or de-identify shopper personal information within 90 days, except where retention is legally required. Suppression and unsubscribe records may be kept longer to honor opt-outs.

You can request earlier deletion of specific records, or export of your data, by contacting privacy@ultimatecloser.ai.

11. Security

We use encryption in transit (TLS), encryption of stored access tokens and API keys, row-level database authorization that isolates each workspace, least-privilege service credentials, signature verification on inbound webhooks, access controls and audit logging. No system is perfectly secure and we cannot guarantee absolute security. If a personal-data breach affects your store data, we will notify you without undue delay and cooperate with your own notification obligations as set out in the DPA.

12. GDPR and UK GDPR rights

Where the GDPR or UK GDPR applies, you have the right to access, rectify, erase, restrict or port your personal information, to object to processing based on legitimate interests, and to withdraw consent where processing is consent-based. You may also lodge a complaint with your supervisory authority.

For shopper data, requests should be directed to the merchant, who is the controller. If a shopper contacts us directly, we will refer them to the merchant and assist the merchant in responding. Merchants can act on shopper access, correction, deletion and opt-out requests through the dashboard or by contacting us.

13. California and U.S. state privacy rights

Under the CCPA/CPRA and comparable state laws (including Virginia, Colorado, Connecticut, Utah and Texas), residents may request to know what personal information we collect, to access or delete it, to correct inaccuracies, and to opt out of sale or sharing for cross-context behavioural advertising. We do not sell or share personal information in that sense, and we do not use or disclose sensitive personal information for purposes beyond providing the Service. We will not discriminate against you for exercising these rights.

When we process shopper data for a merchant, we act as a service provider and use that information only to perform the Service under our contract. To exercise your rights, email privacy@ultimatecloser.ai; we may need to verify your identity, and authorized agents may submit requests with proof of authority.

14. Cookies, tracking scripts and shopper choices

Our website uses only the cookies and local storage needed to run sign-in, sessions and essential site functionality. On Shopify and WooCommerce merchant storefronts, our app embed, plugin or script sets a pseudonymous visitor identifier in the shopper's browser to recognise a returning session, measure intent and prevent duplicate messaging. It respects Global Privacy Control signals and known bot traffic is excluded.

Opt-in, first-party only, no third-party tracking liability. The on-site AI features engage only when a shopper chooses to interact, and an email address is collected only when a shopper voluntarily provides one. The identifiers we set are first-party and used solely to deliver the Service on the merchant's own storefront. We do not deploy third-party advertising pixels, ad-network tags or data-broker trackers through the Service, we do not build cross-site profiles, and we do not sell or share shopper personal information for cross-context behavioural advertising. Any advertising or analytics tag a merchant adds to its own storefront, and any tag on our own marketing website, is separate from the Service and governed by the party that installed it.

Merchants are responsible for disclosing our script in their storefront privacy or cookie notice and, where required by law (for example in the EEA and UK), for obtaining consent before it runs. Every marketing message includes a one-click unsubscribe, and shoppers may opt out of future messages at any time using that link or the Unsubscribe page.

15. Prohibited data categories

We do not accept Protected Health Information. Ultimate Closer is not HIPAA-compliant and processing medical or health data through the Service is prohibited. You must also not use the Service to process government identifiers, full payment card numbers, precise geolocation, biometric data, or children's data. See Section 10 of the Terms.

16. Children

The Service is not directed to anyone under 18 and we do not knowingly collect information from children. Merchants must not deploy the agents on stores directed to children.

17. Changes and how to contact us

We will post updates to this Policy with a revised date and, for material changes, notify account holders by email. Privacy questions, rights requests and subprocessor list requests: privacy@ultimatecloser.ai. Support: support@ultimatecloser.ai. Legal: legal@ultimatecloser.ai.