Privacy Policy

1. The short version

• We use your customers' messages only to draft and send your replies and to show you your inbox and reports.
• We don't sell data, we don't use it for advertising, and we don't use your messages to train AI models.
• Message text is deleted after 12 months. You can ask us to delete everything sooner.
• No third-party trackers or ad pixels run on our site.

2. What we collect

Your account. Your email address, a securely hashed password (or your Google account ID if you sign in with Google), and basic account settings.

Your business profile. What you tell us or let us read from your website: business name, services, service area, hours, phone, pricing notes, FAQ, tone, signature and similar details. This is what the AI uses to write your drafts.

Connected inboxes. To read new inquiries and send approved replies, we store the sign-in details for the inboxes you connect (an app password, IMAP/SMTP settings, or a Microsoft sign-in token). These are encrypted at rest. We check only for new messages that arrive after you connect; we don't import your old mail.

Customer inquiries. The messages your customers send you and the details in them (such as name, email address, phone number, address, the job they need, and any timing or budget they mention), plus the drafts and replies, their status, and when they were sent. Newsletters, automatic replies and bulk mail are filtered out and not stored.

Billing. Payments are handled by Stripe. We keep your Stripe customer and subscription IDs, plan and billing dates. We never see or store your full card number.

Usage and technical data. Basic logs (such as IP address, browser type and errors) to keep the service secure and working, page-view counts with a daily-rotating hashed IP, and a first-party cookie that remembers which page or link brought you to us, so we know which outreach works.

The live demo on our homepage. Text you type into the demo is sent to the AI model to write the example reply and is not stored. We count demo requests per IP address in memory, for one day, to prevent abuse.

3. How we use it

• To receive inquiries, sort them (new lead, existing customer, spam), draft replies, notify you, and send the replies you approve from your own email account.
• To send follow-ups, after-hours acknowledgments, review requests or reports that you've turned on.
• To run your account: sign-in, billing, support, and emails about your trial and account. Setup tips can be switched off with the link in each one.
• To keep the service secure, fix problems, and understand in aggregate how the product is used.

For your customers' information, we act on your behalf as your service provider. We don't contact your customers except by sending messages you approved or features you turned on.

4. Who processes data for us

We use a small number of service providers, each only for the job listed:

• Google (Gemini API) drafts replies and sorts inquiries. It receives the inquiry text and your business profile for each draft. We use Google's paid API service, under which Google doesn't use the content to improve its products.
• Stripe processes payments and stores card details.
• Render hosts our application, database and cache in the United States.
• Our email provider delivers account emails (verification, password resets, trial and billing notices). Replies to your customers go out through your own connected email account, not ours.
• Sentry receives error reports so we can fix bugs. We configure it not to collect personal information.

When you connect Gmail, Google Workspace, Outlook or another provider, messages move between EmergentFlow and that provider under your own account with them. We may also disclose information if the law requires it, or as part of a sale or merger of EmergentFlow, in which case this policy continues to apply to it.

5. Security

Connections are encrypted with HTTPS, inbox credentials are encrypted at rest, passwords are hashed, and access to production data is limited to the founder for running and supporting the service. One-tap approve links expire after 72 hours and work once. No system is perfectly secure; if we learn of a breach that affects your data, we'll tell you promptly.

6. How long we keep it

• Message text (inquiries, drafts and replies) is deleted 12 months after it was received or written.
• Lead records (name, contact details, status, dates) stay while your account is open, so your history and reports keep working.
• When you delete your account or ask us to, we delete your business profile, connected inbox credentials, leads and messages within 30 days. Database backups roll over on a short schedule, after which deleted data is gone from them too.
• Billing records are kept as long as tax and accounting law requires.

7. Your choices and rights

You can see and edit your business profile, disconnect inboxes, and delete your account from the app. You can ask us for a copy of your data, to correct it, or to delete it by emailing emergentflow.io@gmail.com. If one of your customers asks you to delete their information, email us the address or phone number and we'll delete it. Depending on where you live, you may have additional rights under local law; we'll honor them.

8. Cookies

We use a session cookie to keep you signed in and a first-party cookie that remembers how you first found us (kept for 30 days). We don't use advertising cookies or third-party trackers.

9. Children

EmergentFlow is a business tool for adults. We don't knowingly collect information from children under 16.

10. Changes and contact

If we make material changes to this policy, we'll email account owners before they take effect. Questions or requests: emergentflow.io@gmail.com. EmergentFlow is run from Kalispell, Montana.