Privacy policy

Who is responsible

Closelift c/o T. Lutz Färberstrasse 17 4057 Basel Switzerland Email: hello@closelift.com

This policy covers closelift.com, the private preview, the claim page and your customer account at app.closelift.com. For the data that visitors enter on our customers' websites, our customers themselves are responsible; we process it under our data processing agreement.

This website

closelift.com is delivered through Cloudflare. Technically necessary access data such as the IP address and time are processed to deliver the site securely and to fend off attacks. closelift.com sets no cookies and does not measure visits. The only exceptions are our ad landing pages under closelift.com/l/, see Ad landing pages and Meta and Ad landing pages and Google, and the website check.

On these landing pages and on the website check page we also measure how they are used, without cookies and without storing anything on your device: per day, page and source (the ad's utm details) we count visits and note how you use the page and the form, such as how far you scroll, how long the page is visible and how far you get in the form. We do not store what you type. To tell the visitors of one day apart, we form a short value on our server from the IP address and the browser identifier. The random key for this changes daily and is not kept; we do not store the IP address or the browser identifier. If your browser sends an objection signal (Global Privacy Control or Do Not Track), we do not count. The purpose is to see which ads bring visitors and where we can improve the pages; the legal basis is our legitimate interest (Art. 6(1)(f) GDPR, Art. 31 of the Swiss Federal Act on Data Protection). We delete the figures after 180 days.

Website check

If you check a website with our website check, we send its address to Google PageSpeed Insights for the measurement and store the address checked, the result, where your visit came from (page and the ad's utm details) and a one-way hash of your IP address and browser identifier, which we use to limit the number of checks; we do not store the IP address itself. We delete this data after twelve months.

Waitlist

When you sign up for a preview, we store the address of your current website, your email address and the time you signed up. We use them to build your preview and to contact you about it. We send the confirmation email through Cloudflare.

Once you confirm, we look at your current website: the homepage and up to three more pages, evaluated automatically, partly with the help of TypeSafe. If your business fits what we build, Thomas Lutz writes to you from thomas@getcloselift.com about what he noticed on your website; Anthropic partly helps draft the text, from that evaluation alone. A few days later the link to your preview follows in the same thread, then at most one reminder. We send and receive these emails through Google Workspace. We classify your replies, partly with the help of TypeSafe, and keep their text for twelve months. Each of these emails gives our postal address and how to opt out: replying "unsubscribe" is enough, and we will not write to you again, keeping only the pseudonymised blocking markers described under "How we approach businesses".

The legal basis is your consent, which you can withdraw by email at any time. We delete unconfirmed entries after 30 days and confirmed ones at the latest twelve months after confirmation.

If you sign up on one of our ad landing pages or after the website check, we also store with the entry which landing page and which campaign (the ad's utm details) you came from, and whether you had allowed measurement on the landing page, to see which ads lead to sign-ups. We store Meta's identifiers (click identifier and pixel identifier) only if you had allowed it. The legal basis is our legitimate interest in judging whether our advertising works (Art. 6(1)(f) GDPR, Art. 31 of the Swiss Federal Act on Data Protection). We delete this information together with the entry.

Ad landing pages and Meta

For our ads on Facebook and Instagram we have our own landing pages under closelift.com/l/. Only there can the Meta Pixel run, a service of Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland (Meta). For our ads on Google the same holds for the Google tag, see Ad landing pages and Google. All other pages of closelift.com stay without the pixel, without the Google tag, without cookies and without a consent prompt.

Visitors from the European Union, the EEA, the United Kingdom, Switzerland and every other country except the USA see a notice on the landing pages with the buttons "Accept" and "Decline". The pixel loads only once you accept; scrolling on or ignoring the notice is not consent. The page learns the country from our server, which knows it from your connection (Cloudflare); it is not stored. We store your decision for six months in a cookie (closelift_consent) that holds only "granted" or "denied" and no identifier. With "Cookie settings" at the bottom of every landing page you can change your decision at any time.

With your consent, the pixel sets its own cookies (such as _fbp, set by Meta for 90 days) and sends Meta the page view, whether you joined the waitlist, your IP address, details of your browser and device, the address of the page and the ad's click identifier. If you then confirm your email address, we also report the confirmation to Meta from our server (Conversions API): with your email address as a SHA-256 hash, the IP address and browser identifier at confirmation, the click and pixel identifiers from your browser and an event identifier, so that Meta counts the pixel's and the server's report only once. Meta does not receive your website's address or your email address in plain text. The server report is not sent if you had not consented when you sent the form, or if your browser sends an objection signal when you confirm (Global Privacy Control or Do Not Track).

Meta uses the data to measure whether our ads work and to target them. If you have a Facebook or Instagram account, Meta can link the data to that account. We and Meta are joint controllers for the collection on our landing pages and the transfer to Meta (Art. 26 GDPR), under the joint controller agreement in Meta's Business Tools Terms. Meta alone is responsible for everything it does with the data afterwards; details and how long Meta keeps the data are in Meta's privacy policy at www.facebook.com/privacy/policy. You can exercise your rights with us or with Meta.

The legal basis is your consent (Art. 6(1)(a) GDPR; for cookies and access to your device, Section 25(1) of the German TDDDG). You can withdraw it at any time with effect for the future, with "Cookie settings" at the bottom of the landing page or by email to hello@closelift.com. Meta Platforms Ireland may transfer data to Meta Platforms, Inc. in the USA; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework.

For visitors whose connection comes from the USA, the pixel loads without asking first. Under the law of some US states, such as California, this may count as sharing personal information for advertising. With the link "Do Not Sell or Share My Personal Information" at the bottom of the landing page you opt out; we treat a Global Privacy Control or Do Not Track signal from your browser the same way. We do not sell personal information.

Ad landing pages and Google

For our ads on Google, such as on YouTube, in Gmail and in Google Discover, the Google Ads tag can run on the same landing pages, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google). It loads under the same rules as the Meta Pixel: outside the USA only after your consent, in the USA until you opt out. Your choice under "Cookie settings" applies to both.

With your consent, the Google tag sets its own cookies (such as _gcl_au and _gcl_aw, set by Google for 90 days) and sends Google the page view, the ad's click identifier (gclid), your IP address, details of your browser and device and the address of the page. If you then confirm your email address, the confirmation page reports the sign-up to Google as a conversion, with an event identifier so that a reloaded page does not count twice. Google does not receive your email address or your website's address. Google can also add you to our remarketing lists, so that we can show you our ads again later, for example if you have not signed up yet; you stay on them for the duration we set in Google Ads, at most 540 days.

Google uses the data to measure whether our ads work and to target them. If you have a Google account, Google can link the data to that account. Google processes the data as an independent controller under the Google Ads Controller-Controller Data Protection Terms; details and how long Google keeps the data are in Google's privacy policy at policies.google.com/privacy. You can exercise your rights with us or with Google.

The legal basis is your consent (Art. 6(1)(a) GDPR; for cookies and access to your device, Section 25(1) of the German TDDDG), which you can withdraw with "Cookie settings" at the bottom of the landing page or by email to hello@closelift.com. Google may transfer data to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework. Visitors from the USA opt out with "Do Not Sell or Share My Personal Information" or a signal from their browser, as described above.

How we approach businesses

We also build previews for businesses that have not signed up themselves, and send them a letter. For this we use only what is publicly stated on the business's current website: name, address, phone, email, opening hours, services, texts and images, and so, for a sole proprietorship, also the owner's name.

We send the letter by post to the publicly stated business address.

Businesses in the USA we contact by email instead of by letter, at the address their website gives for customers. We do not guess or buy addresses. We send at most three messages in the same thread; any reply ends the series. Our emails contain no tracking pixels and no tracked links. We send and receive the emails through Google Workspace. We classify replies, some with the help of TypeSafe, and keep their text for twelve months to handle them and to improve our messages. We do not contact businesses in the EU, the United Kingdom or Switzerland by email.

The legal basis is our legitimate interest in making businesses a concrete offer (Art. 6(1)(f) GDPR, Art. 31 of the Swiss Federal Act on Data Protection). You can object to the use of your data for direct marketing at any time (Art. 21(2) GDPR); a short email to hello@closelift.com is enough, and we then delete the preview and everything we collected for it, and no longer write to you. So that we do not write to your business again, we keep only pseudonymised blocking markers derived from your website's address, your postal address and your email address, without your name, solely to respect your objection and for as long as we write to businesses.

If you do not take over the preview, we delete its pages within two weeks after the deadline stated on the claim page, and the related working data twelve months after that.

Private preview and claim page

On your private preview and the related claim page, we measure how they are used, such as pages viewed, time spent, scroll depth and buttons clicked, as well as where the visit came from (QR code, link or typed in), the device class and the browser's language.

We set no cookies for this and store nothing on your device. To tell the visits of one day apart, we form a short value on our server from the IP address, the browser identifier and the website identifier. The random key for this changes daily and is not kept; we do not store the IP address or the full browser identifier. Recognising someone across several days or across other websites is therefore not possible.

The purpose is to judge whether our offer is clear and whether we should get in touch again. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR, Art. 31 of the Swiss Federal Act on Data Protection). If your browser sends an objection signal (Global Privacy Control or Do Not Track), we record nothing; you can object by email at any time.

We delete the records after 180 days at the latest. We keep a note of when a preview was taken over or a change request was sent, because it is part of handling the order. This measurement does not take place on our customers' published websites.

When you become a customer

When you order, we store your name, your business address, your email address, the plan you chose, your wishes about the domain, and when you accepted our terms and the data processing agreement. Stripe handles the payment; we do not receive card details.

When you submit the order form, we also record when that was, from which IP address and with which browser identifier including its language setting, together with the versions of the terms and the data processing agreement you accepted and what you ordered at which price. This serves as proof of the contract and to defend against unjustified chargebacks: if you dispute a payment with your bank, we present this information to Stripe as proof. The legal basis is the contract and our legitimate interest in being able to prove the conclusion of the contract (Art. 6(1)(b) and (f) GDPR, Art. 31 of the Swiss Federal Act on Data Protection). We delete the IP address and the browser identifier after 18 months. We keep the rest of this information as long as invoices and booking records, usually ten years; if no payment is made, we delete all of it after 30 days.

You sign in to your customer account with your email address and a one-time code that we send you by email. For this we set a technically necessary session cookie on app.closelift.com that expires after 30 days.

When you request a change through the built-in AI assistant, your request goes to Anthropic together with the content of your website, so that the change can be written. We keep the source files of your website in a private repository at GitHub, so that every version can be traced and restored. GitHub carries out the changes, and converts the videos you upload into a format every browser plays, on machines provided by Blacksmith. We keep your change requests for 180 days.

The legal basis is the contract with you (Art. 6(1)(b) GDPR). We keep invoices and booking records for as long as the law requires, usually ten years. We delete everything else 30 days after the contract ends, after handing over your content if you ask for it, unless this policy names a longer period or the law requires one. Deleted data remains in our daily backups, which we keep for 90 days, until they expire.

When you write to us

When you write to us, by email or in your customer account, we store your messages and our replies to handle your request and the customer relationship. We may use AI assistance (Anthropic) to prepare replies; a person checks every reply. We keep the messages until two years after the contract ends; if you are not a customer, for twelve months after the last message. The legal basis is the contract with you or our legitimate interest in answering enquiries (Art. 6(1)(b) and (f) GDPR, Art. 31 of the Swiss Federal Act on Data Protection).

Service providers we use

Cloudflare (USA): delivering the websites, storage, sending email. Stripe (Ireland and USA): payments. Anthropic (USA): rewriting texts, carrying out change requests and help with answering messages. Firecrawl (USA): reading public websites. TypeSafe (USA): evaluating public websites and classifying messages. GitHub (USA): keeping the websites' source files, carrying out changes and converting uploaded videos. Blacksmith (USA): machines on which these changes and conversions run. Hetzner (Germany): keeping a copy of our daily backups; the copy runs through a machine provided by GitHub, which only passes it on. Google (USA): measuring public websites, and sending and receiving our personal emails to businesses. Resend (USA): fallback for sending email, with no data in normal operation.

A data processing agreement or an equivalent arrangement is in place with all of them. For transfers to the USA we rely on certification under the EU-US and Swiss-US Data Privacy Framework or on the European Commission's standard contractual clauses.

Your rights

You can ask for information about your data, have it corrected, deleted or restricted, receive it in a common format and object to its processing. You can withdraw consent at any time. Write to us at hello@closelift.com.

You can also lodge a complaint with a data protection authority: in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC); if you live in the European Union, with the authority of your place of residence or work.