Privacy Policy

1. Overview

This Privacy Policy explains how SyncFlo AI ("SyncFlo," "we," "us," or "our") collects, uses, shares, stores, and protects personal information when you visit our websites, use the SyncFlo AI dashboard, connect third-party services, use WhatsApp Business automation, voice agents, analytics, billing, support, or related services (collectively, the "Services").

If you use SyncFlo on behalf of a company or client, you are responsible for making sure you have permission to provide personal information to us and to use the Services for that organization. For privacy questions or rights requests, contact us at support@syncflo.xyz.

2. Personal Information We Collect

We may collect the following categories of information, depending on how you use the Services:

• Account information: name, email address, password credentials, company name, role, and account settings.
• Contact and customer data: names, phone numbers, email addresses, tags, lead details, booking details, order details, support tickets, conversation metadata, and imported contact lists.
• Messaging and communication data: WhatsApp messages, templates, flows, replies, delivery statuses, attachments, phone numbers, conversation transcripts, AI-generated responses, handoff notes, and related logs.
• Voice and call data: voice agent configuration, phone numbers, call metadata, recordings or transcripts where enabled, campaign leads, call outcomes, and quality review notes.
• Payment and billing data: subscription plan, invoices, transaction identifiers, payment status, billing contact details, and limited payment metadata. Full card or payment credentials are generally handled by payment processors.
• Integration data: information from connected services such as WhatsApp/Meta, CRM, calendar, payment, e-commerce, knowledge base, analytics, or automation providers.
• Usage, device, and log data: IP address, browser type, device identifiers, pages viewed, feature usage, session events, error logs, approximate location, referral URLs, and cookie or similar tracking data.
• Support and business communications: messages you send to us, feedback, onboarding answers, verification materials, and files you upload.

We ask that you do not upload sensitive personal information unless it is necessary for your lawful use of the Services and you have the required rights, consent, or legal basis to do so.

3. Sources of Information

We collect information directly from you, from users invited to your workspace, from your customers or leads when they interact with your connected channels, from connected third-party integrations, from service providers, and automatically through the Services.

4. How We Use Information

We use personal information to:

• provide, operate, secure, monitor, and improve the Services;
• create accounts, authenticate users, manage teams, and provide customer support;
• connect and operate WhatsApp Business, voice, payment, CRM, calendar, and other integrations;
• send, receive, route, analyze, and automate business communications on your behalf;
• generate AI responses, summaries, recommendations, classifications, and workflow outputs;
• process subscriptions, invoices, renewals, refunds, and billing communications;
• detect fraud, abuse, security incidents, policy violations, and service reliability issues;
• send service notices, product updates, onboarding emails, and marketing communications where permitted;
• comply with legal obligations, enforce our Terms, and protect our rights and users.

5. Legal Bases Under GDPR and UK GDPR

If GDPR or UK GDPR applies, we process personal information under one or more of the following legal bases:

• Contract: to provide the Services, manage accounts, process subscriptions, and deliver support.
• Legitimate interests: to secure and improve the Services, prevent abuse, understand usage, and communicate with business users, where those interests are not overridden by individual rights.
• Consent: for optional cookies, certain marketing, and other processing where consent is required. You may withdraw consent at any time.
• Legal obligation: to comply with tax, accounting, consumer protection, law enforcement, and other legal requirements.

6. AI, Automation, and Human Review

SyncFlo uses AI and automation to help generate replies, classify conversations, summarize content, recommend actions, score leads, analyze sentiment, and operate voice or messaging workflows. Outputs may be inaccurate or incomplete and should be reviewed where the context is important. You remain responsible for configuring automations, reviewing outputs, and using the Services lawfully.

We may process prompts, messages, transcripts, knowledge base content, and related metadata through AI infrastructure and subprocessors to provide these features. We do not sell your customer message content. We do not intentionally use your customer message content to train third-party foundation models unless you separately enable or agree to that use.

7. Cookies and Analytics

We use cookies, local storage, and similar technologies to keep you signed in, remember preferences, measure usage, improve features, and protect the Services. Analytics tools, including PostHog or similar providers, may collect product usage and device data. You can control cookies through your browser settings and, where available, through our cookie banner or consent controls.

8. How We Share Information

We may share information with:

• Service providers and subprocessors: hosting, database, analytics, email, AI, voice, payment, CRM, support, security, and infrastructure providers who process information for us.
• Connected integrations: services you choose to connect, such as Meta/WhatsApp, payment providers, calendar providers, CRM tools, voice providers, and other business systems.
• Workspace users: team members and administrators within your account according to permissions and product settings.
• Legal and safety recipients: regulators, courts, law enforcement, auditors, professional advisors, or parties needed to enforce rights, prevent fraud, or protect safety.
• Business transfer parties: potential or actual buyers, investors, lenders, or successors in connection with a merger, acquisition, financing, restructuring, or sale of assets.

We do not sell personal information in the ordinary meaning of selling customer lists for money.

9. International Data Transfers

We may process and store information in countries other than where you or your customers are located. These countries may have data protection laws that differ from your local laws. Where required, we use appropriate transfer safeguards, such as contractual protections, data processing agreements, and standard contractual clauses or equivalent mechanisms.

10. Data Retention

We retain personal information for as long as needed to provide the Services, comply with legal and accounting requirements, resolve disputes, enforce agreements, maintain security, and preserve business records. Retention periods vary by data type. For example, account data is generally kept while the account is active, billing records may be kept for tax and accounting periods, logs may be kept for security and troubleshooting, and message or call records may be kept according to your workspace settings or product needs.

You may request deletion of personal information, subject to legal, security, billing, backup, and legitimate business retention requirements.

11. Security

We use technical and organizational safeguards designed to protect personal information, including access controls, encryption where appropriate, logging, authentication controls, and operational monitoring. No system is completely secure, and we cannot guarantee that unauthorized access, disclosure, loss, or misuse will never occur.

12. Your Privacy Rights

Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object to processing of your personal information. You may also have the right to withdraw consent, opt out of certain marketing, or lodge a complaint with a data protection authority.

To exercise rights, email support@syncflo.xyz. We may need to verify your identity and your authority to act for the relevant account or customer before completing a request.

13. GDPR and UK GDPR Rights

If GDPR or UK GDPR applies, you may have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete data;
• request deletion of data;
• request restriction of processing;
• object to processing based on legitimate interests or direct marketing;
• request data portability;
• withdraw consent where processing is based on consent;
• complain to a supervisory authority.

When we process customer data on behalf of a business customer, we generally act as a processor or service provider, and the business customer is responsible for responding to end-user privacy requests.

14. California Privacy Notice: CCPA and CPRA

This section applies to California residents if SyncFlo is subject to the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"). We may collect the categories of personal information described in Section 2, including identifiers, commercial information, internet or electronic activity, geolocation approximated from IP address, professional or business information, audio or call information where enabled, inferences from product usage, and sensitive personal information such as account credentials or message contents where necessary to provide the Services.

We use these categories for the business and commercial purposes described in Section 4.

We disclose personal information to the categories of recipients described in Section 8. We do not sell personal information for money. We also do not knowingly sell or share personal information of users under 16. Some analytics or advertising technologies may be considered "sharing" under California law if used for cross-context behavioral advertising. Where applicable, you may opt out by contacting us at support@syncflo.xyz or using available cookie controls.

California residents may have the right to:

• know the categories and specific pieces of personal information collected;
• delete personal information, subject to exceptions;
• correct inaccurate personal information;
• opt out of sale or sharing of personal information;
• limit use and disclosure of sensitive personal information where required;
• not be discriminated against for exercising privacy rights.

Submit California requests by emailing support@syncflo.xyz. If your account is managed by a business customer, we may direct your request to that customer or process it under that customer's instructions.

15. Marketing Choices

You can unsubscribe from marketing emails by using the unsubscribe link in those emails or contacting us. We may still send transactional or service-related messages, such as billing notices, security alerts, support responses, and important product updates.

16. Children

The Services are intended for business users and are not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided personal information to us, contact support@syncflo.xyz.

17. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a new "Last updated" date. If changes are material, we may provide additional notice where required by law.