Privacy Policy

Which data protection obligations apply to us depends on whose data is involved, so it is worth being precise about the two distinct roles we hold.

• We are a processor for the CRM data inside your workspace — the accounts, contacts, opportunities, emails, calendar events, and call transcripts your organization puts into Flo or connects to it. Your organization is the controller: it decides what goes in and why, and we act on its instructions. If you are an employee of a Flo customer and want to exercise a right over that data, your employer is the right first point of contact, though you may also contact us and we will assist them in responding.
• We are a controller for the data we collect to run our own business — your account details, how you use the Service, billing information, and support correspondence. For that data, the rights described below are exercised directly against us.

Where we act as a processor, our obligations are set out in the data processing agreement with your organization, which governs if it conflicts with this policy.

We collect the following categories of information:

• Account information — your name, email address, organization, and role, provided when you or your administrator create an account.
• Connected-service data — when you connect a third-party account (such as Google), we access data from that service to provide the Service, as described below.
• Usage data — information about how you interact with the Service, including log data, device and browser information, and diagnostic events.
• Record-change data — when a record is saved, we record which field changed, on which record, by which user, and whether a person or one of our automated features made the change. We use this to find work the Service could be doing for you automatically instead of asking you to type it. We do not record the values you entered as part of this, and we do not track time spent on screen, keystrokes, mouse movement, or page views. This data is retained for a limited period and then deleted.

We use information to:

• Provide, maintain, and improve the Service;
• Keep your CRM records current by organizing your email, calendar, and meeting activity into accounts, contacts, and deals;
• Generate AI summaries, coaching insights, and suggested next steps for your revenue team;
• Identify data entry the Service could handle automatically, so we can recommend or enable features that remove it;
• Secure the Service and prevent fraud or abuse; and
• Comply with legal obligations.

Where data protection law requires us to identify a lawful basis for processing personal data as a controller, we rely on the following.

• Performance of a contract — to create and administer your account, provide the Service, and bill for it.
• Legitimate interests — to secure the Service, prevent fraud and abuse, understand how the Service is used so we can improve it, and communicate with you about it. We rely on this basis only where our interest is not overridden by your rights, and you may object at any time as described below.
• Legal obligation — to meet tax, accounting, and other statutory requirements, and to respond to lawful requests from authorities.
• Consent — where we ask for it specifically, such as when you connect a third-party account. You may withdraw consent at any time, which does not affect processing already carried out.

Where we act as a processor for your organization’s CRM data, the lawful basis is determined by that organization as controller, not by us.

When you connect your Google account, Flo requests read-only access to the following, and only to provide the features described:

• Gmail (read-only messages and metadata) — to associate email conversations with the relevant accounts, contacts, and deals, and to generate summaries and suggested follow-ups.
• Google Calendar (read-only) — to surface upcoming meetings and match them to the right accounts and deals.
• Google Meet (read-only) — to associate meeting recordings and transcripts with the relevant accounts and deals and to generate call insights.

Flo does not send email, modify, or delete any content in your Google account. You can revoke Flo’s access at any time from your Google Account’s security settings or from within the Service.

Flo’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only use Google user data to provide or improve user-facing features that are prominent in the Service’s user interface.
• We do not transfer or sell Google user data for serving advertisements.
• We do not use or transfer Google user data to determine creditworthiness or for lending purposes.
• We do not allow humans to read Google user data unless we first obtain your affirmative agreement for specific messages, doing so is necessary for security purposes (such as investigating abuse), to comply with applicable law, or the data has been aggregated and anonymized for internal operations.

Service features that use artificial intelligence are powered solely by Anthropic’s Claude models, accessed through the Anthropic API. Under Anthropic’s commercial terms, the prompts we send and the outputs we receive are not used to train Anthropic’s models. Google user data processed this way is not used to train generalized AI or machine-learning models, and its use complies with the Limited Use requirements above.

Flo is an AI-native CRM, so it is worth being explicit about what that means for your data. Features such as call summaries, coaching insights, suggested follow-ups, lead scoring, and the Ask Flo assistant work by sending relevant content — which can include email bodies, call transcripts, and account or contact records — to our AI subprocessor for processing, and returning the result to you.

• AI features are powered solely by Anthropic’s Claude models, accessed through the Anthropic API.
• Under Anthropic’s commercial terms, the prompts we send and the outputs we receive are not used to train Anthropic’s models.
• We do not use your data to train our own models, and we do not sell it or share it with other AI providers.
• AI outputs are suggestions, not decisions. Flo does not take consequential action on a person automatically — a member of your team reviews and acts. Outputs can be inaccurate, and should be treated as a draft rather than a record of fact.

We do not sell your personal information. We share information only with:

• Service providers (subprocessors) who host and support the Service under contractual confidentiality and data-protection obligations. These include our hosting, database, AI, email, error-monitoring, background-job, and payment providers, together with the third-party services you choose to connect. A current list is available on request and is maintained as part of our data processing agreement;
• Other users within your own organization, consistent with your organization’s configuration; and
• Authorities when required by law or to protect the rights, safety, and security of users and the Service.

We are based in the United States and the Service is hosted there. If you access Flo from outside the United States, or if your data concerns people located elsewhere, that information is transferred to and processed in the United States, where data protection law differs from the law in your country.

Where we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland, we do so under a transfer mechanism recognized by applicable law, and we take account of the circumstances of the transfer when assessing whether the protection travels with it. You can contact us for details of the mechanism relied on for a particular transfer.

We retain information for as long as your account is active or as needed to provide the Service, and thereafter as required to comply with our legal obligations, resolve disputes, and enforce our agreements.

Within the Service, administrators at your organization configure retention windows for their own workspace, and an automated process applies them. Unless changed, activity records are retained for 365 days, generated data exports expire after 30 days, captured conversations that could not be matched to an account are removed after 45 days, and record-change data is deleted after 400 days. Your organization can also place a legal hold that pauses this process where data must be preserved.

While your organization is a customer, we keep its security and audit records for as long as the workspace is open, so that you can ask us who did what and when. We do not delete them on a rolling schedule.

When a workspace is closed we delete its records, and we keep its security log for a further 24 months from the closing date before deleting that too. Our security log is append-only and cannot be deleted at the point of closure, so we instead remove the personal information from it — who acted, from where, and the values that changed — keeping only the fact that an event occurred, when, and to what kind of record.

We protect information using encryption in transit and at rest, access controls, tenant isolation, and an append-only audit log. No method of transmission or storage is completely secure, but we work to protect your data using industry-standard safeguards. If we become aware of a personal data breach affecting your information, we will notify you and the relevant authorities as required by applicable law.

Depending on where you live, you may have some or all of the following rights over your personal data. Where we act as a processor for your organization, we will pass your request to them and assist in answering it.

• Access — to be told whether we process your personal data and to receive a copy.
• Rectification — to have inaccurate data corrected and incomplete data completed.
• Erasure — to have your data deleted where one of the grounds in applicable law applies.
• Restriction — to limit how we process your data while a dispute about it is resolved.
• Portability — to receive data you provided in a structured, commonly used, machine-readable format, and to have it sent to another provider where technically feasible.
• Objection — to object to processing we carry out on the basis of legitimate interests, including profiling based on it.
• Withdrawal of consent — where we rely on consent, to withdraw it at any time.
• Automated decision-making — not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not make such decisions; AI outputs in Flo are reviewed by a person before anyone acts on them.

To exercise any of these, contact us at privacy@getflo.ai. We will respond within one month, and will tell you if we need longer because the request is complex. We do not charge for this, and we will not treat you differently for asking. We may need to verify your identity before acting.

If you believe we have handled your personal data unlawfully, you have the right to lodge a complaint with your local data protection supervisory authority. We would appreciate the chance to address your concern first.

You can disconnect a third-party account at any time from within the Service. To revoke Google access directly, visit your Google Account permissions.

We may update this Privacy Policy from time to time. When we do, we will revise the effective date above and, where appropriate, provide additional notice.

For questions about this Privacy Policy, our data practices, or to exercise any of the rights above, contact Click & Flow, Inc. at privacy@getflo.ai.

For questions about the Service that are not related to privacy, contact support@clickandflow.xyz.