Privacy Policy

Account Information: Name, email address, and brokerage name collected upon registration.

Client Data: Lead information (names, phone numbers, emails, notes, pipeline stages) entered into the CRM. You retain full ownership of this data.

Payment Information: Processed via Stripe. We do not store full credit card numbers; we retain only the last four digits and basic billing details.

Usage Data: Automatically collected metrics, including IP address, browser type, and session duration.

Third-Party Integrations: Read-only access requested during Google Contacts synchronization. We do not store persistent access tokens post-session.

We use collected information solely to provide and improve AgentFlow services, specifically to:

• Operate and maintain the platform.
• Process subscription payments.
• Transmit automated follow-up digests and SMS reminders.
• Provide customer support.
• Monitor platform security and resolve technical issues.

Note: We do not send promotional communications without explicit consent.

We do not sell, rent, or trade your personal or client data. We disclose information only under the following circumstances:

• Service Providers: Shared with trusted partners to facilitate our service delivery (Stripe for payments, Resend for email, Supabase for database hosting, and Cloudflare for security).
• Legal Obligations: Disclosed if required by subpoena, court order, or similar legal mandate.
• Business Transfers: Transferred in connection with a merger, acquisition, or sale of assets.

We implement industry-standard encryption for data in transit and at rest. Authentication requires email magic links or Google single sign-on (SSO). However, no electronic transmission or storage system is entirely secure; we cannot guarantee absolute data security against unauthorized access.

Retention: Data is retained while your account remains active.

Deletion: Upon account cancellation, personal data is erased or irreversibly anonymized within 30 days.

User Rights: You may access, correct, or request deletion of your data at any time. You may also export your client data in CSV format directly via the application.

We utilize only strictly necessary cookies to maintain session state and basic interface preferences. We do not use advertising cookies, tracking pixels, or behavioral profiling.

Security Cookies: Cloudflare sets a __cf_bm cookie on authentication pages to distinguish between human and automated traffic. It expires after 30 minutes of inactivity, contains no personally identifiable information, and is mandatory for form security.

Our authentication pages utilize Cloudflare Turnstile to prevent automated abuse (e.g., bot traffic, credential stuffing).

Data Processed: Cloudflare automatically receives your IP address, browser/OS metadata, basic configuration settings, and a request timestamp. Behavior signals are processed only if a challenge renders and are not used for user fingerprinting.

Data Handling: Cloudflare issues a temporary pass/fail token. AgentFlow does not access or store raw signals. Cloudflare processes this data under its own privacy policy (cloudflare.com/privacypolicy).

Opt-Out: Users opting out of Turnstile evaluation must contact privacy@agent-flow.app to establish alternative authentication.

AgentFlow operates in the United States. Information collected is processed and stored on U.S. servers.

AgentFlow is intended exclusively for adult professionals. Users must be at least 18 years of age.

For privacy-related inquiries or to exercise data rights, contact us at:

Email: privacy@agent-flow.app

Website: agent-flow.app