We collect as little as we need to run your AI agents, store it securely, and never sell it. This page explains exactly what we do with your data — in plain English.
The short version
Minimal data
We collect only what your agents need to function — nothing more.
Never sold
Your data is never sold, rented, or used to train external models.
Delete anytime
Cancel and we'll wipe your data within 90 days. Just ask.
Encrypted
AES-256 at rest, TLS in transit. Hosted on SOC 2 providers.
01 — INFORMATION WE COLLECT
Information we collect
We collect information you give us directly when you sign up, fill out forms, or use the OpsFlow AI service. Specifically:
Account information: Your name, business name, email address, phone number, and billing details.
Business context: Industry, workflow details, FAQ knowledge bases, and any custom instructions you give us during onboarding.
Integration credentials: API tokens and connection details for tools like Gmail, Google Calendar, Apollo.io, Stripe, etc. — stored encrypted, never shown back in plain text.
Customer data passing through your agents: Incoming emails, lead records, calendar events, and review content that your agents process on your behalf.
Usage data: Logs of agent actions, dashboard activity, and performance metrics used to generate your weekly reports.
Communications: Emails, support messages, and notes from discovery and strategy calls.
02 — HOW WE USE IT
How we use your information
We use the data we collect to:
Configure, operate, and continuously improve your AI agents.
Generate your weekly PDF reports and AI-driven recommendations.
Diagnose technical issues and improve reliability.
Comply with applicable legal and tax obligations.
We do not use your data to train third-party AI models, build advertising profiles, or share with brokers.
03 — AI AGENTS & CUSTOMER DATA
AI agents & your customers' data
Because our agents act on your behalf, they process data about your customers — the emails they send, the leads they leave, the reviews they post. Here's how we treat that data:
You remain the data controller. We act as a processor, handling customer data only on your instructions.
Confidence thresholds. Replies below a confidence threshold are escalated to you for review before being sent.
If you operate in a regulated industry (healthcare, legal, financial services), let us know during onboarding. We'll discuss additional safeguards and, where appropriate, sign a Business Associate Agreement (BAA) or Data Processing Agreement (DPA).
04 — THIRD PARTIES
Third parties we work with
We use a small set of reputable infrastructure and service providers to run OpsFlow AI:
Cloud infrastructure: AWS / Google Cloud (SOC 2 Type II certified).
AI model providers: Anthropic and OpenAI, on enterprise no-training tiers.
Payments: Stripe — we never see or store your full card number.
Email & calendar: Google Workspace APIs (only the scopes you explicitly grant).
Scheduling: Calendly, for discovery and strategy calls.
Analytics: A privacy-friendly, cookie-less analytics provider — no cross-site tracking.
Support: Email and Slack for client communications.
Each provider receives only the minimum data needed to deliver its specific function.
05 — STORAGE & SECURITY
Data storage, security & retention
Your data is encrypted with AES-256 at rest and TLS 1.2+ in transit. Access is gated by role-based controls and audited internally. Integration credentials are stored in a hardware-backed secrets vault and never logged in plain text.
Retention: we retain your data while your account is active and for up to 90 days after cancellation, in case you reactivate or request export. After 90 days, your data is permanently deleted from primary systems. Encrypted backups are rotated out within 30 days of that point.
06 — YOUR RIGHTS
Your rights
Depending on where you live (GDPR for the UK/EU, CCPA for California, and similar in Canada and Australia), you have the right to:
Access the personal data we hold about you.
Correct inaccurate or incomplete data.
Delete your account and associated data.
Export a portable copy of your data.
Restrict or object to certain processing.
Withdraw consent at any time, where processing is based on consent.
Complain to your local data protection authority.
To exercise any of these rights, email privacy@opsflowai.com — we respond within 30 days.
07 — COOKIES & TRACKING
Cookies & tracking
We use a small number of essential cookies — for example, to keep you signed in to your dashboard. We do not use third-party advertising cookies or cross-site trackers, and we don't run Facebook or Google ad pixels.
For aggregate visitor analytics we use a privacy-friendly tool that does not set persistent identifiers or share data with advertising networks.
08 — INTERNATIONAL TRANSFERS
International transfers
We serve clients in the US, UK, Australia, and Canada. Data may be processed in any of these regions, depending on where our infrastructure providers operate. For data leaving the UK or EU, we rely on Standard Contractual Clauses approved by the European Commission and the UK Information Commissioner's Office.
09 — CHILDREN'S PRIVACY
Children's privacy
OpsFlow AI is a B2B service for businesses and business owners. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
10 — UPDATES
Updates to this policy
We may update this policy from time to time as the service evolves. The "Last updated" date at the top reflects the most recent revision. For material changes, we'll notify active clients by email at least 14 days before the changes take effect.
11 — CONTACT US
Contact us
Questions about this policy, or want to exercise any of the rights above? Get in touch — we read every message.