Privacy Policy

1. Data we collect

We collect the following categories of data when you sign up for, configure, or use the service:

• Account information — your name, email address, company name, and password (hashed).
• ICP preferences — target industries, regions, company sizes, seniorities, and other filter configurations you supply.
• Lead data — names, work emails, LinkedIn URLs, company information, and enrichment fields produced by your active pipelines. This data belongs to you; we process it on your behalf.
• Usage data — pages viewed, actions taken, API calls made, error logs, and timestamps, used to operate and improve the service.
• Billing metadata — payment reference numbers, plan tier, and activation timestamps. We do not store full card or bank account numbers; payment processing is handled by external gateways (Easebuzz / XflowPay).

2. How we store data

All data is stored in Supabase Postgres on managed infrastructure with row-level security (RLS) enforced at the database layer. Data is encrypted at rest and in transit (TLS 1.2+). Backups are retained for 30 days. We do not sell, rent, or share your data with third parties for marketing purposes.

3. How we process data

To deliver the service we share necessary data with the following sub-processors:

• Supabase — primary database and authentication.
• Anthropic (Claude API) — message generation, ICP scoring, icebreaker drafting. Lead and prompt data is sent to Anthropic for inference; Anthropic does not train on our API traffic.
• Apify — lead discovery and enrichment via the actors we operate on your behalf.
• Resend — transactional and outreach email delivery.
• Vercel — application hosting and edge runtime.
• Easebuzz / XflowPay — payment processing.

4. Data retention

Account and lead data is retained for the duration of your active subscription plus 90 days after cancellation, after which it is permanently deleted unless you have requested earlier deletion or longer retention is required by law. Logs and aggregated analytics may be retained for up to 12 months in a non-identifiable form for service improvement.

5. Your rights

Depending on where you live, you have the following rights with respect to your personal data:

• Right of access — receive a copy of the personal data we hold about you.
• Right of rectification — correct inaccurate personal data.
• Right of deletion — request that we erase your personal data.
• Right of portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing for direct marketing or based on legitimate interests.
• Right to withdraw consent — at any time, where processing is based on consent.

To exercise any of these rights, email privacy@flow-forges.com. We respond within 30 days.

6. GDPR (European users)

For users in the European Economic Area, United Kingdom, and Switzerland, we act as a data processor for the lead data your pipelines produce and as a data controller for your account information. Our legal bases for processing are contract performance and legitimate interests in operating and improving the service. EU/UK users have the right to lodge a complaint with their local supervisory authority.

7. CCPA (California users)

California residents have the right to know what personal information is collected, to request deletion, and to opt out of sale of personal information. We do not sell personal information. To exercise these rights email privacy@flow-forges.com.

8. Security

We follow industry-standard practices including TLS encryption, hashed passwords (bcrypt), service-role isolation for privileged operations, row-level security in the database, and least-privilege access for all team members. No system is perfectly secure; if you believe your account has been compromised email privacy@flow-forges.com immediately.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified via email to the address on file at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.

10. Contact for data requests

For privacy questions or data subject requests:
privacy@flow-forges.com