What We Collect,
Why, and How to Get It Back.

What this Policy covers.

This Privacy Policy describes how CloserCircle ("we," "us," or "our") collects, uses, stores, shares, and protects information about you when you:

• Visit our website at closercircle.polsia.app or any subdomain we operate.
• Create an account, sign in to the AI Mentor, or use the student dashboard.
• Take the Investment Strategy Assessment or use other coaching tools.
• Purchase a course, subscription, or pay a deal-funding deposit.
• Submit a deal for funding partnership review.
• Submit a testimonial, support request, or communicate with us by email.

If you arrive at CloserCircle from a partner referral, that partner may share basic lead information with us using a referral link. We'll treat anything a partner shares under this same Policy.

The categories of data we handle.

What we do not collect

• We do not collect your full card number, CVV, or expiration date. Those are handled entirely by our PCI-DSS-compliant payment processor. We only ever see the last 4 digits of your card and the brand (Visa/Mastercard/etc.).
• We do not collect government-issued ID numbers, Social Security numbers, or biometric data.
• We do not use third-party advertising trackers that follow you off our site.

The reasons we touch any of this.

We use the data above to operate the platform and serve you. Specifically:

• Deliver your courses. Track lessons, unlock content based on your tier, show tier-upgrade paths, save your progress across devices.
• Personalize the AI Mentor. Use your assessment answers and course progress to generate a personalized strategy plan, roadmaps, and objection-handling language. Personalization happens within your own data — your inputs feed a model call that returns output tailored to you; we do not blend your answers with other students' answers for personalization purposes.
• Process payments and refunds. Create order records, calculate refund eligibility based on the published rules, communicate refund status, and process approved refunds through our payment processor.
• Review deal submissions. Provide submitted deals to our capital partner network for funding-partnership review; communicate deal-review status to you.
• Send transactional communications. Order confirmations, refund-eligibility prompts, deal-review notices, important policy updates, security alerts. These messages are tied to your account activity and are not marketing.
• Improve the platform. Aggregate, de-identified analytics on which courses and pages are most useful, where students get stuck, and how well the assessment maps to actual outcomes. Aggregated skill scores across student archetypes may be reported as research — but never in a way that identifies an individual student.
• Respond to legal requests. When required by valid legal process, we disclose data to law enforcement or regulators as detailed in Section 8 below.

How card payments get handled.

Card payments on CloserCircle are processed through the Polsia platform's payment infrastructure, which integrates with Stripe under the hood.

What our payment processor sees

• Your full card number, expiration date, and CVV — entered into a fully PCI-DSS-compliant processor-hosted form.
• Billing name and billing address, as required by the card networks.
• The transaction amount and a unique order ID we generate.

What CloserCircle sees

• The last 4 digits of the card and the brand (e.g., "Visa ending in 4242").
• The transaction ID returned by our payment processor.
• Charge status (succeeded, failed, refunded, partially refunded).
• The amount charged, including taxes.

We never store, transmit, log, or have programmatic access to your full card number. If a payment fails or you dispute the charge, we work through our payment processor to resolve it and do not have independent access to your card's sensitive details.

What the AI Mentor actually does with your input.

The AI Mentor uses a generative AI model to give you personalized strategy coaching based on your assessment answers and any follow-up questions you ask in a session. The model is provided by a third-party AI vendor (OpenAI).

What we send to the AI provider

• Your assessment answers, the system prompt instructing the model on its role, and (optionally) your follow-up conversation in a mentor session.
• We do not send your name, email, payment information, or account ID with each prompt.

What comes back

• A personalized strategy plan, archetype, skill score, roadmap, and objection-handling language — generated just for you based on your inputs.

What is retained by the AI provider

Per our arrangement with the AI vendor, prompts and responses are processed to deliver the service but are not used to train the vendor's underlying foundation models. We store the output of the assessment in your account (so you can return to it) but do not store the full conversation transcript unless you explicitly opt in to chat history.

Relevance disclaimer: AI-generated coaching is informational. It is based on your input and the patterns in our training material. It does not account for your complete personal, financial, legal, or tax situation. Use it as a starting point, not as a substitute for advice from a licensed professional in your jurisdiction. The model's output for your investment archetype reflects general patterns among investors with similar profiles — not predictions about your specific outcomes.

We don't sell your data. Period.

We share your data only with the parties necessary to operate the Service, and only with the minimum necessary information. Specifically:

Service providers (data processors)

• Payment processor: receives billing details to charge your card. PCI-DSS compliant, SOC 2 Type II audited.
• AI provider: receives your assessment prompt and returns personalized output. Used to deliver the AI Mentor; not used to train foundation models.
• Hosting provider: stores our application data, encrypted at rest, in secured US data centers.
• Email delivery: transactional emails (order confirmations, refund prompts, deal-review notices) are routed through a transactional email provider.
• Analytics providers: Google Analytics 4 (site usage, anonymized visitor IDs) and the Polsia analytics pixel (visitor attribution, anonymized visitor IDs).
• Cloud storage: if you upload documents (deal photos, verification proof), they're stored with a US-based cloud storage provider.

Capital partners (deal-funding service)

If you submit a deal through the deal-funding partnership service, we share the deal information you provide (property details, requested capital amount, deal stage, narrative, optional photos) with our network of capital partners for the purpose of evaluating funding-partnership fit. We do not share your account information, your course history, or unrelated profile details with capital partners.

Legal disclosures

We disclose your data when we believe in good faith that it is necessary to:

• Comply with a valid legal process (court order, subpoena, lawful government request).
• Enforce our Terms of Service or other agreements.
• Detect, prevent, or otherwise address fraud, security, or technical issues.
• Protect against harm to the rights, property, or safety of us, our users, or the public as required or permitted by law.

Business transfers

If CloserCircle is acquired, merged, or sells substantially all of its assets, your data may be transferred to the acquiring entity under this same Privacy Policy. We will notify you by email at least 30 days before the transfer takes effect.

What sits in your browser.

We use cookies and similar storage technologies for the following purposes:

Strictly necessary

• Session token: keeps you signed in across pages.
• CSRF token: protects form submissions from cross-site forgery.
• Anonymous visitor ID: identifies a unique browser session for short-term analytics.

Functional

• Course progress: remembers which lessons you've completed so progress is preserved across devices.
• UTM parameters: keeps your referral source attribution so we can credit the partner that referred you.

Analytics

We use Google Analytics 4 to understand aggregate, anonymized site usage: which pages are visited, which buttons are clicked, what country/city roughly you're in, what device you used. We also use the Polsia analytics pixel to count unique visitors to our platform. Both use IP-anonymized identifiers; neither tracks you across other sites.

We do not use advertising cookies, retargeting pixels, or third-party tracking on social media platforms.

How long we keep things, and how to remove them.

Retention periods

• Account data: retained while your account is active. On closure, account data is anonymized within 30 days and purged within 90 days except where we're required to retain it for tax, accounting, or legal compliance (e.g., order records — see below).
• Order and billing data: retained for at least 7 years to satisfy US tax and accounting obligations (orders constitute financial records).
• Course progress: retained while your account is active. Purged on account closure.
• Assessment answers and AI Mentor output: retained while your account is active. Purged on account closure.
• Deal submissions and refund-eligibility deal proof: retained for at least 3 years after the last activity on the deal, for fraud review and dispute resolution.
• Testimonials: retained until you ask us to remove them; can be removed at any time.
• Analytics: aggregated, anonymized analytics are retained indefinitely; raw, identifiable event logs are retained for 26 months then purged.
• Support correspondence: retained for 2 years after the last exchange, then purged.

Your rights and how to exercise them

You can do any of the following by emailing support@closercircle.polsia.app from the email address on your account (so we can verify identity):

We may request identity verification to prevent fraud — for example, confirm control of the email address on the account or recent order history. This is standard and protects your account from being accessed by someone pretending to be you.

18 and up only.

CloserCircle is intended for adults. We do not knowingly collect personal data from anyone under 18 years of age. The Service is not directed at children, and we do not market to children. If we learn that we have inadvertently collected data from a user under 18, we will delete it as soon as possible.

If you believe we have collected data from someone under 18, please contact us at support@closercircle.polsia.app so we can delete it.

Your regional rights, in plain English.

California (CCPA / CPRA)

If you're a California resident, you have the right to:

• Know what categories of personal information we collect and how we use them (covered above).
• Request access to or deletion of your personal information (covered in Section 8).
• Opt out of any "sale" or "sharing" of personal information. We do not sell personal information. We also do not share personal information for "cross-context behavioral advertising."
• Limit the use of sensitive personal information. We do not collect sensitive personal information as defined under California law.
• Not be discriminated against for exercising these rights.

To exercise these rights, follow the access/deletion process in Section 8.

EU / UK (GDPR-style rights)

If you're in the European Economic Area, the United Kingdom, or Switzerland, you have the right to:

• Access: request a copy of your data.
• Rectification: correct inaccurate data.
• Erasure: request deletion ("right to be forgotten").
• Restriction: ask us to pause processing while a dispute is resolved.
• Portability: receive your data in a structured, commonly used, machine-readable format.
• Objection: object to processing based on legitimate interest or for direct marketing.
• Withdraw consent: at any time, where processing is based on consent.
• Lodge a complaint with your local data protection authority.

Our legal bases for processing under GDPR are: contract (to deliver the courses you purchased), legitimate interest (to operate, secure, and improve the platform), legal obligation (to retain records required by tax and accounting law), and consent (for marketing emails, testimonials, and any optional data not strictly required to operate the Service).

Data transfers outside the EU/UK

Our primary data hosting is in the United States. If you're located in the EEA, UK, or Switzerland, your data will be transferred to and stored in the US. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission for these transfers, and we require all US-based processors to provide adequate security commitments.

How we protect your data.

We protect your data with a layered set of controls:

• Transport encryption: all data in transit is encrypted with TLS 1.2 or higher.
• At-rest encryption: database records are encrypted at rest using industry-standard AES-256; backups are similarly encrypted.
• Access control: only authorized personnel can access production data, on a least-privilege basis. Database credentials are rotated regularly.
• Incident response: if we discover a breach affecting your personal data, we will notify you by email within 72 hours of discovery, consistent with applicable law.
• Payment data: never touches our application servers — handled entirely by the PCI-DSS-compliant payment processor.

No system is perfectly secure. If you believe your account has been compromised or you notice suspicious activity, change your password immediately and contact us at support@closercircle.polsia.app.

If this Policy changes, you'll know.

If we make material changes to this Privacy Policy:

• We will revise the "Last updated" date below.
• We will email active account holders at least 14 days before the new Policy takes effect.
• For changes that broaden what we collect or how we use your data, we'll ask for fresh consent where required by law.
• If you do not accept the new Policy, you can close your account and request deletion per Section 8.

Non-material changes (clarifications, typo fixes, formatting) become effective immediately on posting.

Short answers to what people actually ask.