Privacy Policy

1. Information We Collect

Information you provide directly:

• Account registration data: name, email address, phone number, and password
• Organization information: company name, billing address, and payment details
• Contact and lead data you import, enter, or create within the platform
• Policy and book of business information you record
• Communications with our support team
• Survey responses or feedback you voluntarily submit

Information collected automatically:

• Call data: call logs, duration, recordings, voicemails, and disposition notes
• SMS and messaging logs
• Usage data: features used, pages visited, actions taken, and session information
• Device and technical information: IP address, browser type, operating system, device identifiers
• Log data: server logs, error reports, and diagnostic information

Information from third parties:

• If you register using Google OAuth, we receive your name, email address, and profile picture from Google
• Payment processors may share transaction confirmation data with us

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, maintain, and improve the Agent Flowz platform
• Process payments and manage your subscription
• Send transactional communications including receipts, invoices, and account notifications
• Respond to your support requests and inquiries
• Monitor platform usage, diagnose technical issues, and improve performance
• Detect, investigate, and prevent fraudulent, unauthorized, or illegal activity
• Enforce our Terms of Service and other agreements
• Comply with applicable legal obligations
• Send product updates, feature announcements, and marketing communications (you may opt out at any time)

3. Your Contact Data

You retain full ownership of all contact lists, lead data, and client information you upload or enter into Agent Flowz. We will not:

• Use your contact lists for our own marketing or outreach campaigns
• Sell your contact lists or data to any third party
• Share your contact data with other Agent Flowz customers

We access your contact data only as necessary to deliver the Service (e.g., enabling calls and SMS through our telephony provider) or as required by law.

4. Sharing of Information

We do not sell your personal information. We may share your information with the following categories of recipients:

• Service Providers: Third-party vendors who perform services on our behalf and are contractually bound to protect your data:
  • Twilio — voice calling and SMS infrastructure
  • Stripe — payment processing and billing management
  • Supabase — database hosting and storage
  • Resend — transactional email delivery
  • Vercel / Railway — application hosting and deployment
• Legal Compliance: When required by applicable law, valid legal process (such as a subpoena or court order), or to protect the rights, property, or safety of Agent Flowz, our users, or others
• Business Transfers: In connection with a merger, acquisition, financing, reorganization, or sale of assets, provided the successor agrees to honor this Privacy Policy
• With Your Consent: For any purpose with your explicit consent

5. Call Recording

Agent Flowz enables call recording as an optional feature. You are solely responsible for complying with all applicable federal and state laws regarding call recording consent, including multi-party consent states such as California, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania, and Washington.

Call recordings are stored securely and are accessible only to authorized users within your organization. Recordings are retained for up to 12 months by default. You may request earlier deletion by contacting support@agentflowz.io.

6. Google API Services & Limited Use Disclosure

If you choose to connect your Google account to Agent Flowz (for example, to enable the AI voice assistant to add booked appointments to your Google Calendar), our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Scopes we request and why:

• openid, userinfo.email, userinfo.profile: sign-in only — to identify your AgentFlowz account and show your display name and profile picture.
• https://www.googleapis.com/auth/calendar.events: only used to create, update, and remove calendar events that the AgentFlowz AI voice assistant books on your behalf during outbound lead calls. We never list, read, or modify events that AgentFlowz itself did not create.

Limited Use: Data accessed via Google APIs is used solely to provide and improve user-facing features of Agent Flowz that are clearly visible from the user's experience (i.e., putting AI-booked meetings on the agent's calendar). Specifically:

• We do not transfer Google user data to third parties except as necessary to provide or improve the user-facing feature, to comply with applicable law, or as part of a merger, acquisition, or sale of assets.
• We do not use Google user data to serve advertising, including retargeting or personalized advertising.
• We do not allow humans to read Google user data unless we have your affirmative consent, it is necessary for security purposes, to comply with applicable law, or the data is aggregated and used for internal operations in accordance with applicable privacy/data-protection law.
• We do not use Google user data to train or improve generalized AI/ML models.

Storage: The only Google data we persist is the access/refresh token (encrypted at rest, used to call Google APIs on your behalf) and the metadata of the calendar events we create (title, start time, end time, attendee phone number — stored in our own database to render the in-app calendar view). We do not retain copies of any other calendar events.

Revoking access: You can disconnect your Google account from Agent Flowz at any time in Settings, or revoke access entirely from your Google Account permissions page. Upon disconnection we delete the stored tokens and stop creating new calendar events on your behalf.

7. Data Retention

• Active accounts: We retain your data for as long as your account is active and as needed to provide the Service
• After cancellation: We retain your data for 90 days following account cancellation or termination, giving you the opportunity to export your data. After 90 days, data is permanently deleted.
• Call recordings: Retained for 12 months by default, unless you request earlier deletion
• Billing records: Retained for 7 years as required by applicable financial regulations
• Legal holds: We may retain data longer than these periods when required by law or when subject to a legal hold

8. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption in transit using TLS/SSL for all data transmitted to and from the platform
• Encryption at rest for stored data and sensitive fields
• Role-based access controls limiting employee access to your data
• Regular security assessments and monitoring

No method of data transmission or storage over the internet is 100% secure. While we take reasonable and appropriate measures to protect your information, we cannot guarantee absolute security. In the event of a data breach affecting your personal information, we will notify you as required by applicable law.

9. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to operate the Service, including:

• Session cookies: Required to keep you logged in and maintain your session. These are deleted when you close your browser.
• Persistent cookies: Used to remember your preferences and settings across sessions
• Analytics cookies: Used to understand how users interact with the platform and improve our Service

You can control cookie settings through your browser. Disabling essential cookies will prevent you from using the Service. We honor "Do Not Track" browser signals by not setting persistent tracking cookies when such a signal is detected.

10. Your Rights & Choices

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data, subject to certain legal exceptions
• Portability: Request your data in a machine-readable format
• Opt-out of marketing: Unsubscribe from marketing emails at any time using the unsubscribe link in any email we send
• Restriction: Request that we restrict processing of your data in certain circumstances

To exercise any of these rights, contact us at support@agentflowz.io. We will respond within 30 days. We may need to verify your identity before processing your request.

California Residents (CCPA): California residents have additional rights under the California Consumer Privacy Act, including the right to know what personal information we collect and share, the right to delete personal information, and the right to opt out of the sale of personal information (we do not sell personal information). To exercise your CCPA rights, contact us at support@agentflowz.io.

11. International Data Transfers

Agent Flowz is based in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country. By using the Service, you consent to this transfer.

12. Children's Privacy

The Service is not directed to, and we do not knowingly collect personal information from, individuals under the age of 18. If we become aware that we have collected personal information from a minor, we will take steps to delete such information. If you believe we have inadvertently collected information from a minor, please contact us at support@agentflowz.io.

13. Links to Third-Party Sites

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party site you visit.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or prominent in-app notice at least 14 days before the changes take effect. We will update the "Last updated" date at the top of this page. Continued use of the Service after the effective date of any changes constitutes your acceptance of the revised policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: