Scope and who controls your data
The controller and Program Operator is Marcos Antonio Soris Duque, an individual and sole proprietor. ClosetMindAI identifies the product, brand and Ambassador Program and is not a separate LLC, corporation or other legal entity. The contact address is 19900 NW 37th Ave Lot B66, Miami Gardens, Florida 33056, United States, and the privacy contact is closetmindai.support@gmail.com. This Notice covers Ambassador applications, accounts, public profiles, referrals, attribution, commissions, payment preferences and related administration.
Information we collect
We may collect your verified account email and Firebase user identifier; preferred public and legal names; country; social handles; approximate audience size; content category; example links; application answers; age confirmation; policy acceptances; Ambassador status, category and code; and program communications. For a manual payment preference, we may collect Zelle, Apple Cash, Xoom or Wise as the method, the recipient name, the email or phone associated with that destination and, for Xoom or Wise, the destination country. Do not submit bank or routing numbers, IBAN, SWIFT, card details, tax identifiers, passwords, identity documents, health information or other sensitive data in application fields or links.
Where information comes from
Information comes from you, Firebase Authentication, your browser or device, Cloudflare security services, Ambassador links and codes, ClosetMindAI mobile referral claims, verified Apple or Google subscription events, and authorized program administrators. The application email must match a verified Firebase account.
Why we use it
We use information to create and secure accounts; review applications; operate and communicate about the Program; issue public profiles, links and codes; attribute referrals; verify conversions; calculate, display and reconcile commissions and reversals; coordinate manual payments; enforce Program terms; prevent abuse; maintain audits; and comply with legal, accounting and tax duties. Where applicable, processing relies on steps requested before a contract, performance of the Program agreement, legitimate interests in operating and securing the Program, legal obligations, or consent for genuinely optional communications.
Public Ambassador profile
If you are approved and activate your participation, your chosen display name, referral slug and code, optional avatar, approved social handles, public tier and Founding Ambassador number may become public. Your legal name, account email, application responses and payment preference are not included in the public profile.
Referral links, cookies and attribution
Opening an active Ambassador link can create a minimal click record and a signed first-party cm_ref cookie. The cookie is HttpOnly, uses SameSite=Lax and lasts up to the current 30-day attribution window. It contains a click identifier and expiry, not a name or email. Click records may include the Ambassador code, allowlisted campaign parameters, landing path, broad device category and Cloudflare-provided country code. Under the current configuration, an unclaimed click is scheduled for deletion after the 30-day window plus a 7-day safety buffer. A valid claimed attribution is locked to protect both the user and Ambassador.
Subscription and commission records
Apple and Google remain the payment processors for mobile Premium subscriptions. ClosetMindAI receives verified product, platform, amount and currency when available, purchase, renewal, expiry or refund dates, and hashed store transaction or order identifiers. These records support Premium status, attribution, commission calculations, reversals and audits. Ambassadors receive only anonymized referral labels and aggregate or sanitized earnings data, never referred-user names, emails, wardrobe content, payment methods or store transaction identifiers.
Payout preferences and payments
The portal may record Zelle, Apple Cash, Xoom or Wise as a manual payment preference, together with the minimum recipient and destination contact described above. Payments are reviewed and completed manually outside the portal; selecting or saving a method does not send money, verify a recipient or activate an automatic payout provider. If a payment is recorded, ClosetMindAI may keep a private payment reference and confirmation screenshot for accounting, support and dispute records. A confirmation email and screenshot may be queued only after an authorized administrator records the payment and only when an approved email provider is configured; this Notice does not represent that automated email delivery is currently active. The selected payment or email provider processes information under its own privacy terms.
Analytics, security and fraud prevention
We use allowlisted event names, coarse performance records, rate limits, Turnstile, referral validation, duplicate controls, self-referral prevention and verified store environments to measure and protect the Program. Cloudflare and Turnstile may process an IP address and request metadata transiently. The Program database does not intentionally store full IP addresses; it uses derived security signals and short-lived counters. Live automated fraud scoring is not currently enabled, and one signal alone is not intended to produce an irreversible enforcement decision.
Who receives information
Information is available only as needed to authorized ClosetMindAI administrators and service providers, including Google/Firebase for authentication, private records and backend services and Cloudflare for hosting, security, Turnstile and web analytics. Apple and Google provide verified subscription information. Zelle, Apple Cash, Xoom, Wise or another approved manual payment process may receive necessary destination information when a payment is arranged. An approved transactional-email provider may process the Ambassador email address and private confirmation attachment when that delivery feature is configured. We may also disclose information to professional advisers, authorities when legally required, or a successor in a protected business transaction. We do not currently sell Ambassador Program personal information or use it for cross-context behavioral advertising.
How long we keep information
A signed referral cookie lasts up to 30 days, and an unclaimed referral-click record is deleted no later than 37 days after collection. Replay-protection and ordinary rate-limit records expire after approximately 24 hours. Rejected or withdrawn applications are retained for 24 months after the final decision or withdrawal. Approved Ambassador profiles and participation records are retained while active; Program agreements and acceptances, claimed attributions, subscription events, commission and ledger records, payment destinations used for a transaction, payment confirmations and screenshots, payout statements and administrative audit records are retained for seven years after account closure or the relevant financial event, whichever is later. Routine fraud signals are retained for 24 months, unless they are connected to an active investigation, dispute or legal obligation requiring longer retention. Information may be deleted sooner when it is no longer needed and no legal, accounting, security or dispute hold applies.
Account deletion and required records
When an account is deleted, ClosetMindAI disables the Ambassador profile and link, removes the active payment preference and direct account links where supported, and de-identifies certain subscription, referral and audit records. Deletion does not erase records that must be preserved for accounting, refunds, fraud prevention, dispute resolution, attribution integrity or other legal obligations. Some application content and pseudonymous records may remain until the approved retention and de-identification process is completed. Public profile information is no longer displayed after deactivation.
Security
Current safeguards include Firebase Authentication and email verification, role-based access, App Check on supported mobile endpoints, HMAC-signed server requests, replay protection, Turnstile, rate limits, restricted Firestore rules, hashed store identifiers and audit logs for sensitive administrative access. Browser session credentials are kept in session storage rather than the Program database. No security system can guarantee absolute protection.
International processing
The Program's primary backend records are processed in the United States. Cloudflare, Google/Firebase, Apple, Google Play, email and selected payment providers may process information in the United States and other countries where they operate. Where applicable law requires it, the Program Operator uses the provider's recognized transfer mechanism, contractual safeguards or other lawful basis. Privacy protections and rights may differ between countries, but this Notice continues to govern the Program Operator's handling of the information.
Automated processing
Technical rules automatically validate accounts, codes, attribution eligibility, duplicate requests, rate limits and commission calculations. Application approval, material fraud restrictions and manual payment decisions are handled by authorized administrators. No live automated fraud-scoring system or automatic payout decision is currently active. Contact us if you believe a technical rule produced an incorrect result.
Age requirement
Ambassador applicants and participants must be at least 18 years old. The current application relies on the applicant's confirmation and does not collect an identity document to verify age. If we learn that an applicant is under 18, we may reject the application and delete associated information, subject to records we are legally required to retain.
Your privacy rights
Depending on applicable law, you may request confirmation, access, correction, deletion or a portable copy of personal information, and may object to or restrict certain processing or withdraw consent where consent is the basis. You may also have rights concerning sale, targeted advertising, profiling, appeals and complaints to a regulator. We do not currently sell Program data or use it for targeted advertising. We may verify your identity and may retain information where an applicable legal exception requires it.
Changes to this Notice
We may update this Notice when the Program, providers, laws or data practices change. We will publish the new version and effective date and provide additional notice or request renewed acceptance when legally required. Historical acceptances and versions may be preserved for audit purposes.
Contact us
For privacy questions or requests, email closetmindai.support@gmail.com or write to Marcos Antonio Soris Duque, operating as ClosetMindAI, 19900 NW 37th Ave Lot B66, Miami Gardens, Florida 33056, United States. Please do not send passwords, banking credentials, tax identifiers or identity documents by ordinary email.
