1. Information We Collect

We collect information you provide directly to us, as well as information automatically collected through your use of our Service.

A. Information You Provide to Us

• Name
• Email Address
• Phone Number
• Billing Address
• Company Name and Business Information
• Calendar Account Information (for scheduling appointments via Google Calendar)
• Call recordings and transcripts (when you use our AI voice services)
• Assistant Configuration Data (system prompts, voice preferences, business hours)

B. Information Collected Automatically

• Device Identifiers (IP address, online identifiers)
• Log and Usage Data (browsing history, interaction with our website, service metrics)
• Geolocation data (approximate location based on IP address)
• Performance Data (error logs, system performance indicators)

2. How We Use Your Information

We use the information we collect for the following purposes:

• Providing the Service: Processing inbound calls, managing calendar appointments, generating call transcripts and summaries, and delivering AI voice responses
• Improving our Service: Analytics, debugging, monitoring usage patterns, and internal research
• Security: Detecting security incidents, protecting against malicious or fraudulent activity
• Customer Support: Responding to your inquiries and resolving disputes
• Compliance: Fulfilling legal obligations and enforcing our Terms of Service
• Marketing: With your consent, we may send you promotional communications (you may opt-out at any time)

Note on AI/ML Training: We do not use call recordings, transcripts, or any customer data to train or improve generalized artificial intelligence or machine learning models. Your data is used exclusively to provide the specific services you request.

3. Third-Party Service Providers

We rely on trusted third-party partners to operate our Service. These partners are contractually obligated to protect your data and may only process it according to our instructions. These include voice processing, payment processing, and database hosting providers.

We do not share, sell, or rent your personal information to third parties for their own marketing purposes. We strictly limit sharing to what is necessary to deliver our Service to you.

4. Google User Data (Calendar API)

InboundFlow integrates with Google Workspace APIs solely to provide calendar management features.

What we access:

• Basic profile information (name, email)
• Google Calendar data (view, create, edit events)
• Only the specific permissions you grant during OAuth consent

How we use it:

• To sync your calendar and manage appointments booked through our AI voice agent
• We do not use Google User Data for advertising, profiling, or developing AI/ML models

Retention & Deletion:

• We retain Google Calendar data only while your account is active and calendar integration is enabled
• If you disconnect your Google account or delete your InboundFlow account, we delete all associated Google data within 21 days
• You may request immediate deletion by contacting us at privacy@inboundflow.app

Limited Use Disclosure: InboundFlow's use of information received from Google APIs adheres to Google API Services User Data Policy, including the Limited Use requirements.

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve our website. You may control cookies through your browser settings or our cookie consent banner. Types of cookies we use:

• Essential cookies: Required for the Service to function
• Analytics cookies: Help us understand how you use our Service
• Preference cookies: Remember your settings and preferences

6. Data Retention

We retain your personal information for as long as necessary to provide our Services and fulfill the purposes outlined in this Privacy Policy. Specifically:

• Account Information: Retained while your account is active and for 90 days after account closure
• Call Recordings and Transcripts: Retained according to your retention settings (default: 90 days)
• Usage and Log Data: Retained for up to 2 years for security and analytics purposes
• Payment Records: Retained for 7 years to comply with tax and accounting requirements
• Google Calendar Data: Deleted within 21 days of disconnection or account closure

You may request deletion of your data by contacting us at privacy@inboundflow.app.

7. How We Protect Your Information

We implement industry-standard security measures to protect your data, including:

• SSL/TLS encryption for data in transit
• Encryption of sensitive data at rest
• Regular security assessments and updates
• Access controls and authentication requirements
• Secure data centers with physical security measures
• Employee training and background checks
• Intrusion detection and prevention systems
• Regular backups and disaster recovery procedures

While no method of transmission over the internet or electronic storage is 100% secure, we take reasonable measures to safeguard your information.

8. Your Privacy Rights

A. US Residents (CCPA and State Privacy Laws)

If you are a resident of California, Washington, or other states with comprehensive privacy laws, you have the following rights:

• Right to Know: Request information about the categories and specific pieces of personal information we collect
• Right to Delete: Request deletion of your personal information (subject to legal exceptions)
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing: We do not sell your personal information. We do not engage in "sharing" for cross-context behavioral advertising
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

B. Canadian Residents (PIPEDA)

If you are a Canadian resident, you have rights under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), including:

• The right to access your personal information
• The right to challenge the accuracy of your information
• The right to withdraw consent for certain uses of your information
• The right to file a complaint with the Privacy Commissioner of Canada

C. Exercising Your Rights

To submit a request, please contact us at privacy@inboundflow.app. We will verify your identity using the information you provide (e.g., name, email address, phone number). Authorized agents may submit requests on your behalf with appropriate documentation. We aim to respond within 30–45 days. If we deny your request, we will explain the reason and provide information on how to appeal.

D. Account Access and Control

You can access and update your account information through your account dashboard or by contacting us. You may also:

• Opt-Out of Communications: Unsubscribe from promotional emails using the link in those emails (you cannot opt out of service-related communications)
• Disconnect Calendar: Remove Google Calendar integration at any time through your Settings page
• Export Data: Request a copy of your data in a portable format

9. Call Recording Consent

Your use of the Services constitutes consent to call recording for quality assurance, training, and service delivery purposes. You are responsible for obtaining necessary consent from call participants as required by applicable law in your jurisdiction.

10. Do Not Track

Our Service does not currently respond to "Do Not Track" (DNT) signals from browsers. You may adjust your browser settings to enable DNT if desired.

11. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that a child under 18 has provided us with information, we will take steps to delete it immediately.

12. International Data Transfers

All data processing activities undertaken by InboundFlow take place in the United States. If you are accessing our Service from Canada or other regions, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country. By using our Service, you consent to this transfer.

13. Third-Party Websites and Links

Our Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies before providing any information to them.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by:

• Posting the updated policy on this page
• Updating the "Last updated" date
• Sending you an email notification (for material changes)

Your continued use of the Service after the changes constitute your acceptance of the revised policy.

15. Contact Us & Data Protection Officer

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

InboundFlow Inc. Privacy Team
1004 Commercial Avenue
Anacortes, WA 98221
United States
Email: privacy@inboundflow.app

Data Protection Department: Email: privacy@inboundflow.app

16. Complaints and Dispute Resolution

If you believe we have not complied with this Privacy Policy or applicable privacy laws, please contact us first at privacy@inboundflow.app. We will investigate and attempt to resolve any complaints within 30 days.

For Canadian residents:

• Office of the Privacy Commissioner of Canada: 1-800-282-1376 or priv.gc.ca
• Commission d'accès à l'information du Québec (for Quebec residents)

For US residents:

• Your state Attorney General's office
• Federal Trade Commission (FTC): ftc.gov