Privacy Policy

Flowtify ("we," "our," or "us") is a Canadian software company based in Calgary, Alberta, providing AI-powered business automation tools for Canadian businesses and agencies. This Privacy Policy applies to all products and services offered under the Flowtify brand, including Flowtify Automations, Flowtify Proposals, and LeadRadar by Flowtify (collectively, the "Services").

This policy explains what personal information we collect, why we collect it, how we use and protect it, and your rights as a user. By creating an account or using any of our Services, you agree to the practices described in this Privacy Policy.

We are committed to complying with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's federal private-sector privacy law, as well as applicable provincial privacy legislation.

2a. Account Information
When you register for any Flowtify product, we collect your full name, email address, and a securely hashed password. We may also collect your company name, phone number, and billing address if provided during account setup or subscription management. This information is used to create and manage your account across all Flowtify products.

2b. Usage Data
We automatically collect information about how you interact with our Services. This includes pages visited, features used, buttons clicked, session duration, login timestamps, and browser/device type. This data helps us understand how our products are being used and where we can improve the user experience. Usage data is not sold or shared with third parties for advertising purposes.

2c. Payment Data
All payment transactions are processed securely through Stripe, a PCI-DSS compliant payment processor. Flowtify does not store, transmit, or have access to your full credit card number, CVV, or banking details. We retain only the information Stripe provides us after a transaction is completed, such as the last 4 digits of your card, card brand, billing postal code, and transaction status. For full details on how Stripe handles your payment data, please review Stripe's Privacy Policy at stripe.com/privacy.

2d. LeadRadar-Specific Data
LeadRadar by Flowtify uses the Google Maps API to retrieve publicly available business information, including business names, addresses, phone numbers, websites, and Google ratings. This data is sourced from Google's public directory and is used solely to generate lead lists for our users. We do not collect, store, or process personal data belonging to private individuals through LeadRadar. Search queries, filters applied, and lead exports performed by users are stored in association with their account for billing, usage tracking, and export history purposes.

2e. Email and Communications Data
When you interact with Flowtify via email, support requests, or in-app messages, we retain records of those communications to provide support and improve our Services. Transactional emails (such as welcome emails, password resets, and billing notifications) are delivered through Brevo (formerly Sendinblue). We track email delivery status and open rates for operational purposes only.

We use the personal information we collect for the following purposes:

• To provide and operate the Services: Your account information is used to authenticate your identity, manage your subscriptions, and give you access to the features included in your plan across Flowtify Automations, Flowtify Proposals, and LeadRadar.
• To process payments: Billing information is used to process subscription charges, issue receipts, and manage plan upgrades, downgrades, or cancellations through Stripe.
• To send transactional communications: We send emails related to your account activity, including registration confirmations, password reset requests, subscription renewals, payment receipts, and important product updates. These emails are operational and cannot be opted out of while you maintain an active account.
• To improve our products: Aggregated and anonymized usage data helps us identify bugs, prioritize new features, and optimize the performance of our Services.
• To prevent fraud and ensure security: We monitor account activity to detect suspicious behaviour, unauthorized access attempts, and potential abuse of our platform.
• To comply with legal obligations: We may use or disclose your information when required to do so by applicable Canadian law, court order, or regulatory authority.

Your data is stored in a PostgreSQL database hosted on Neon, a cloud database provider with servers located in the United States. While our company is based in Calgary, Alberta, Canada, some data may be stored or processed in the United States as part of our infrastructure. By using our Services, you consent to this cross-border transfer of data.

We take the security of your personal information seriously and implement the following measures:

• All data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
• Passwords are hashed using industry-standard algorithms and are never stored in plain text.
• User sessions are managed using JSON Web Tokens (JWT) with expiry controls.
• Access to production databases is restricted to authorized personnel only.
• We perform regular reviews of our security practices and third-party dependencies.

While we make every effort to protect your data, no method of transmission or storage is 100% secure. We encourage users to choose strong, unique passwords and to notify us immediately at legal@flowtify.ca if they suspect unauthorized access to their account.

We use a limited number of trusted third-party services to operate Flowtify. Each of these providers has their own privacy policy governing how they handle data:

• Stripe — Used to process all subscription payments. Stripe collects and stores your payment card details in compliance with PCI-DSS standards. Flowtify does not have access to your full card information. Learn more at stripe.com/privacy.
• Brevo (formerly Sendinblue) — Used to deliver transactional emails such as welcome messages, password resets, and billing notifications. Brevo receives your email address and name for the purpose of delivering these messages. Learn more at brevo.com/legal/privacypolicy.
• Google Maps API — Used exclusively within LeadRadar to retrieve publicly available business data from Google's directory. Flowtify uses this API in accordance with Google's Terms of Service and API usage policies. Learn more at policies.google.com/privacy.
• Apify — Used within Flowtify Automations to collect publicly available social media data for analytics and reporting purposes. Apify processes only public data and does not access private or authenticated social media accounts on your behalf without explicit authorization. Learn more at apify.com/privacy-policy.

We do not sell, rent, or share your personal information with any third party for advertising, marketing, or commercial purposes beyond what is described above.

We retain your personal information for as long as your account remains active or as necessary to provide you with our Services. Specifically:

• Account data (name, email, subscription history) is retained for the duration of your account and for up to 2 years after account deletion, for legal and billing record-keeping purposes.
• Usage data is retained for up to 12 months in identifiable form, after which it may be aggregated and anonymized indefinitely.
• Payment records are retained for a minimum of 7 years in accordance with Canadian tax and accounting regulations.
• LeadRadar search and export history is retained for the duration of your subscription and deleted within 90 days of account closure.

If you request deletion of your account, we will remove your personal data from our active systems within 30 days, subject to any legal retention obligations described above.

As a Canadian resident, you have the following rights regarding your personal information under PIPEDA:

• Right to Access: You have the right to request a copy of the personal information we hold about you, including how it is being used and with whom it has been shared.
• Right to Correction: If you believe any personal information we hold about you is inaccurate or incomplete, you have the right to request that we correct it.
• Right to Deletion: You may request that we delete your personal information from our systems, subject to our legal retention obligations. Deletion requests will be processed within 30 days.
• Right to Withdraw Consent: Where our processing of your data is based on your consent, you may withdraw that consent at any time. Please note that withdrawal of consent may affect your ability to use certain features of our Services.
• Right to File a Complaint: If you believe we have not handled your personal information in accordance with PIPEDA, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

To exercise any of these rights, please contact us at legal@flowtify.ca with the subject line "Privacy Request." We will respond within 30 days of receiving your request.

Flowtify uses a minimal number of cookies and local storage mechanisms to operate our Services:

• Authentication cookies: We use secure, HTTP-only cookies to maintain your login session across Flowtify products. These cookies expire automatically when your session ends or after a set period of inactivity.
• Preference cookies: We may store your UI preferences (such as annual vs. monthly pricing toggle) in your browser's local storage to improve your experience.
• Analytics: We may use privacy-respecting analytics tools to understand aggregate usage patterns across our platform. We do not use Google Analytics or any third-party advertising trackers. No personal data is shared with advertising networks.

You can control cookie behaviour through your browser settings. Disabling cookies may affect your ability to log in and use certain features of our Services.

Our Services are intended for use by businesses and professionals and are not directed at individuals under the age of 16. We do not knowingly collect personal information from anyone under 16 years of age.

If we become aware that a user under the age of 16 has created an account or provided us with personal information, we will take prompt steps to delete that information and close the account. If you believe a minor has registered for our Services, please contact us immediately at legal@flowtify.ca.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will notify you by sending an email to the address associated with your account and by posting a notice on our website at flowtify.ca.

The updated policy will take effect 14 days after the notification is sent, unless a longer notice period is required by law. We encourage you to review this policy periodically. Your continued use of our Services after the effective date of any changes constitutes your acceptance of the updated policy.