Privacy Policy

This policy applies to the personal data Closeout handles through our website (usecloseout.com) and the Closeout platform. It covers visitors and users of the site and platform, current and prospective customers and their staff, people who attend our events or webinars or subscribe to our updates, and our vendors and partners. For this data, Closeout is the data controller.

The case files, settlement records, and health information your firm uploads or syncs into Closeout ("Customer Data") are processed on your firm's behalf, as a data processor, under your customer agreement and, where protected health information is involved, our Business Associate Agreement. Your firm is the controller of that data; if we receive a privacy request about Customer Data, we will forward it to your firm. This policy describes both the personal data we collect as a controller and how Customer Data is protected.

We collect the following categories of data:

• Account informationYour name, work email, role, and the firm you belong to, used to authenticate you and route audit-log entries.
• Case, lien, and settlement dataThe closeouts, liens, settlements, and disbursements you create, the core of the product, stored with strict per-firm scoping.
• Documents, including health informationFiles you upload or sync, such as payoff letters, EOBs, medical records, and settlement statements. These may contain protected health information; see section 4.
• Data from connected systemsWhen you connect a case management system such as Clio, we import the matters, documents, and fields you choose, using access you authorize and can revoke.
• Audit logsEvery change writes an entry: who, what, when, and from which IP, required by ABA Rule 1.15 and your state bar.
• Operational dataLogin timestamps, device and browser, IP for security monitoring, and standard cookies or local-storage tokens for keeping you signed in.
• Communications and marketing informationWhat you send us when you contact support, request a demo, respond to a survey, or subscribe to updates, and records of the messages we exchange.
• Social media interactionsIf you engage with our accounts on platforms such as LinkedIn, X, Reddit, YouTube, or Instagram, we may receive your username, profile information, and the content of your interaction.
• Information from third partiesContact and business details we receive from partners, marketing vendors, and event organizers, which we may combine with the data above and use as described in this policy.

We use the data described above only for the purposes below, and we do not use your firm's or clients' data for advertising. Where the GDPR or UK GDPR applies, the legal bases are the Article 6 bases named in the table, performance of a contract, legitimate interests, consent, or a legal obligation.

Closeout also creates de-identified and aggregated information from activity across the platform, for example how liens resolve, typical reductions by carrier or lienholder, and response times. Once information is de-identified and aggregated, it no longer identifies any individual, client, case, or firm, and is no longer personal data or protected health information; we de-identify consistent with applicable law, including HIPAA. We may use this information to operate, secure, and improve Closeout and to develop benchmarks and insights about how settlements and liens resolve. We do not sell or disclose identifiable personal information or protected health information, and other firms never see your records or any indication that your firm contributed.

Personal injury documents contain protected health information (PHI), so this deserves its own section.

Medical records, bills, and EOBs you place in Closeout are handled as PHI. Closeout processes PHI as a business associate under a signed HIPAA Business Associate Agreement. PHI is encrypted in transit and at rest, access-controlled, isolated to your firm, and written to a tamper-evident audit trail.

Our AI extraction reads document text to surface the fields that matter, which your team reviews and confirms before they are saved. The AI runs under a Business Associate Agreement on a zero-retention basis, meaning the AI provider does not retain your content after a request is processed. Your client data is never used to train shared, public, or third-party AI models; any model improvement happens only on the de-identified, aggregated data described in section 3.

We do not sell, rent, or share your data with advertisers, data brokers, or marketers, and we do not share your firm's identifiable case data with other firms. We share personal data only in these limited circumstances:

• Sub-processors. A small set of vetted infrastructure providers, each bound by a data processing agreement: Amazon Web Services (hosting, database, and file storage; United States), Anthropic (document AI extraction, under a BAA on a zero-retention basis; United States), and Amazon SES (transactional email; United States).
• Payment partners. Electronic disbursement, when enabled, runs through a regulated payment partner that moves funds only on transfers you authorize. We never store your bank login credentials.
• Legal and safety. Where required by law, legal process, or to protect rights, safety, and the integrity of the service.
• Connected applications. When you connect a case management system such as Clio, data flows between Closeout and that application under the access you authorize and can revoke; that application's own terms govern how it handles your data.
• Affiliates. With companies in the Closeout corporate group, if any, which may use the data only in a manner consistent with this policy.
• Links to other sites. Our site may link to sites we do not operate; their own privacy policies, not this one, govern the data you share there.
• Business transfers. In connection with a merger, acquisition, or sale of assets, subject to this policy's commitments.

Data is encrypted in transit and at rest, isolated per firm at the database boundary, and protected by least-privilege access controls. Every change is recorded to a tamper-evident audit trail. No system is perfectly secure, but security is foundational to how Closeout is built and operated. You can read more on our Security page.

Closeout is a United States company and stores and processes data in the United States. If you access Closeout from outside the U.S., your data is transferred to and processed here. Where a transfer of personal data is subject to laws that require additional safeguards, we rely on recognized mechanisms such as the European Commission's Standard Contractual Clauses or equivalent protections.

We keep Customer Data for as long as your firm maintains its account, and for a limited window afterward so you can export it, unless you ask us to delete it sooner. Operational data is kept only as long as needed for the purpose it was collected.

Audit-log entries are retained as required for ABA Rule 1.15 and state bar compliance, and cannot be deleted on request. We may also retain limited data where we are legally required to, for example for tax, audit, or dispute purposes.

California (CCPA/CPRA). California residents may request to know, delete, or correct their personal information and to opt out of its sale or sharing. Closeout does not sell or share personal information, and we will not discriminate against you for exercising your rights.

EEA and UK (GDPR). Where the GDPR or UK GDPR applies, we process personal data on the legal bases of performing our contract, complying with legal obligations, your consent, and our legitimate interests in operating and securing the service. Where we act as a processor for a firm, that firm is the controller, and we will direct requests to them.

Closeout is a professional tool intended for law firms and their staff. It is not directed to anyone under 18, and we do not knowingly collect personal information from children; if we learn we have, we will delete it. Case documents may reference minor claimants; that content is Customer Data your firm controls and is handled under this policy and our agreements.

You can request access to, correction of, export of, or deletion of the data your firm has stored in Closeout, and, where applicable, restriction, portability, objection, and withdrawal of consent. Email privacy@usecloseout.com and we will respond within 30 days. You may also lodge a complaint with your local supervisory authority.

To protect your data, we may need to verify your identity before acting on a request, and we will not fulfill a request we cannot reasonably verify. You may use an authorized agent, who must show signed permission to act on your behalf. We will not discriminate against you for exercising your rights. Even after deletion, some data may persist in backups for a limited period before it is overwritten.

Audit-log entries cannot be deleted; they are retained as required for ABA Rule 1.15 compliance, scoped to your firm, and never shared with third parties.

We may update this policy as the product and the law evolve. When changes are material, we will provide reasonable notice. The "last updated" date at the top always reflects the current version, and your continued use of Closeout after an update takes effect constitutes acceptance of it.

If you have questions about this policy or how we handle your data, email privacy@usecloseout.com or write to us at:

Closeout Technologies, Inc.
2800 Post Oak Boulevard, Suite 5600
Houston, Texas 77056
United States