Privacy Policy

Effective Date: March 15, 2026 Last Updated: October 29, 2026 Company: Keilani Media Group LLC ("CustomerFlows," "we," "us," or "our") Address: 30 N Gould St, Sheridan, WY 82801, United States Contact: privacy@customerflows.com

1. Introduction

CustomerFlows is a revenue operating system for home service businesses. This Privacy Policy describes how Keilani Media Group LLC, doing business as CustomerFlows, collects, uses, stores, shares, and protects your personal information when you visit our website at customerflows.com, use our web application at app.customerflows.com, or interact with any of our services (collectively, the "Service").

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described here, please do not use the Service.

This Privacy Policy applies to two categories of individuals:

Visitors: People who visit our marketing website, read our content, or use tools such as the ROI Calculator.
Customers: Businesses and their authorized users who create an account and use the CustomerFlows platform to manage leads, conversations, pipelines, and related business operations.

1.1 Who Is Responsible for Your Data

We are the controller of the personal information about our website visitors, our customers' account users and billing contacts, and people who contact us or sign up for our emails. This policy explains how we handle it.
Our customers are the controller of the information about their own customers and leads (their contacts, conversations, deals and chat transcripts). We process that information only on their instructions, as their processor, under our Data Processing Agreement. If you are one of our customers' customers, please contact that business first; we will help them respond to you.

2. Information We Collect

2.1 Information You Provide Directly

When you create an account, subscribe to a plan, or contact us, we collect:

Account information: Name, email address, phone number, business name, business address, and trade type (e.g., HVAC, roofing, plumbing).
Billing information: Payment card details and billing address. Payment card information is processed and stored exclusively by our payment processor, Stripe, Inc. We do not store complete card numbers on our servers.
Communication content: Messages you send to us via email, contact forms, or support channels.
WhatsApp Business configuration: When you connect a phone number to the Service, we collect the phone number and associated WhatsApp Business Account (WABA) identifiers required to send and receive messages on your behalf through the Meta WhatsApp Cloud API.

2.2 Information Generated Through Your Use of the Service

When you use the CustomerFlows platform, the following data is generated and stored:

Lead and contact records: Names, phone numbers, email addresses, and other details of the leads and customers that you or your end-customers create within the platform.
Conversation data: WhatsApp messages, chatbot interactions, and other communications processed through the unified inbox. These messages are transmitted via the Meta WhatsApp Cloud API and stored within our systems to enable inbox, pipeline, and automation features.
Pipeline and deal data: Deal names, values, stages, notes, and associated activities.
Automation and workflow data: Rules, triggers, conditions, and execution logs for workflows you create.
AI interaction data: Messages, prompts and responses when the AI assistant answers and qualifies leads or helps with conversations, and the business information (knowledge) you give it. See Section 5A for how AI features handle data.

2.3 Information Collected Automatically

When you visit our website or use the application, we automatically collect:

Device and browser information: IP address, browser type and version, operating system, device type, screen resolution, and language preference.
Usage data: Pages viewed, features used, clicks, session duration, referring URL, and interactions within the application.
Tracking data: If you arrive at our website via a marketing campaign, we collect campaign attribution data including UTM parameters, Google Click Identifiers (GCLID), and Meta Click Identifiers (FBCLID) to attribute leads to their marketing source.
Cookies and similar technologies: See Section 7 for details.

2.4 Information About Your End-Customers

When your end-customers interact with your business through CustomerFlows (for example, by sending a WhatsApp message to your connected business number), the following data is collected and stored within your CustomerFlows account:

Phone number and WhatsApp profile name
Message content and timestamps
Engagement data (e.g., messages read, links clicked)
Any information your end-customer voluntarily provides during a chatbot conversation (e.g., name, service type, address, preferred appointment time)

You are the data controller for your end-customer data. We process this data on your behalf as a data processor. You are responsible for ensuring that your collection and use of end-customer data complies with all applicable laws, including obtaining any necessary consents for WhatsApp communication.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 To Provide and Operate the Service

Creating and managing your account
Processing WhatsApp messages and chatbot conversations
Displaying leads, contacts, and deals in your CRM pipeline
Executing automation workflows you configure
Running AI-powered lead qualification and conversation assistance
Processing subscription payments and managing billing
Providing customer support

3.2 To Improve the Service

Analyzing usage patterns to improve features and user experience
Identifying and fixing bugs and performance issues
Developing new features based on aggregated usage trends
We do not use your business data or your end-customers' data to train AI models.

3.3 To Communicate With You

Sending transactional emails (account confirmation, password reset, billing receipts)
Sending product updates and feature announcements relevant to your account
Responding to your support requests and inquiries
Sending marketing communications if you have opted in (you may unsubscribe at any time)

3.4 To Ensure Security and Prevent Fraud

Detecting and preventing unauthorized access, fraud, and abuse
Enforcing our Terms of Service
Complying with legal obligations

3.5 For Marketing Attribution

Connecting ad clicks to lead creation and deal outcomes within your account, so you can see which marketing campaigns produce revenue
Generating aggregated, anonymized benchmarks for our published research and statistics (no individual business data is ever identifiable in published material)

3.6 Legal Bases for Processing (EEA and UK)

If you are in the European Economic Area (EEA) or the United Kingdom, we rely on these legal bases under the GDPR and UK GDPR for the information we control:

Purpose	Legal basis
Creating and running your account, providing the Service, billing	Performance of our contract with you
Customer support and service emails (account, security, billing)	Performance of our contract with you
Keeping records for tax and accounting	Compliance with a legal obligation
Security, fraud prevention and enforcing our terms	Our legitimate interests in keeping the Service and our users safe
Improving the Service from usage data	Our legitimate interests in making the Service better
Website analytics cookies and marketing attribution on our website	Your consent, which you can withdraw at any time
Marketing emails	Your consent, or our legitimate interests where the law allows emailing existing customers; you can unsubscribe at any time

Where we rely on legitimate interests, we have weighed them against your rights and you can object (see Section 10.4).

We do not sell your personal information. We share information only in the following circumstances:

4.1 Third-Party Service Providers

We use the following service providers to operate CustomerFlows. Each receives only the data it needs to perform its function, under a contract that requires it to protect that data. The current list of the providers that process our customers' data is also published as our sub-processor list.

Provider	Purpose	Data shared	Location	Privacy policy
Cloudflare, Inc.	Hosting, storage, content delivery and security; runs our AI features (Workers AI, AI Search, AI Gateway)	All data processed by the Service, including messages and AI conversations	Global network; stored data mainly in the United States	https://www.cloudflare.com/privacypolicy/
Supabase, Inc.	Database and sign-in	All data stored in the platform; account sign-in details	United States (AWS us-east-1)	https://supabase.com/privacy
Railway Corp.	Hosting for some of our application services	Data processed by those services, and their logs	United States	https://railway.com/legal/privacy
Stripe, Inc.	Payment processing	Billing name, email, payment card details, billing address	United States	https://stripe.com/privacy
Meta Platforms, Inc. (WhatsApp Cloud API)	WhatsApp messaging	Phone numbers, message content and media, delivery status, WhatsApp Business Account settings	Global	https://www.whatsapp.com/legal/privacy-policy
Meta Platforms, Inc. (Marketing API and Conversions API)	Advertising attribution, lead ads and conversion reporting you turn on	Campaign data, click identifiers (FBCLID, fbc/fbp), hashed email and phone, conversion values and times	Global	https://www.facebook.com/privacy/policy/
Meta Platforms, Inc. (Facebook Login)	Sign-in with Facebook	Facebook account email, name and identifier	Global	https://www.facebook.com/privacy/policy/
Google LLC (Google Analytics)	Website analytics, with your consent	Device and usage data, IP address	United States / Global	https://policies.google.com/privacy
Google LLC (Google Ads API)	Advertising attribution and conversion reporting you turn on	Campaign data, click identifiers (GCLID), hashed email and phone, conversion values and times	United States / Global	https://policies.google.com/privacy
Google LLC (Google sign-in)	Sign-in with Google	Google account email, name and identifier	United States / Global	https://policies.google.com/privacy
Resend, Inc.	Sending and receiving email	Email addresses and email content	United States	https://resend.com/legal/privacy-policy
GitHub, Inc.	Source code hosting; runs our encrypted nightly database backup	An encrypted copy of our database while the backup runs	United States	https://docs.github.com/site-policy/privacy-policies/github-general-privacy-statement

We do not send your data to OpenAI or Anthropic as part of the Service.

4.2 Legal Requirements

We may disclose your information if required by law, subpoena, court order, or government request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

4.3 Business Transfers

If Keilani Media Group LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change via email or prominent notice on our website.

We may share your information in other ways if you give us explicit consent to do so.

5. Google User Data Disclosure

CustomerFlows integrates with Google services to provide advertising attribution and account authentication. This section describes how we access, use, store, share, and protect Google user data in compliance with the Google API Services User Data Policy and the Google APIs Terms of Service.

5.1 Google User Data We Access

When you connect your Google account to CustomerFlows, we access the following data depending on which Google services you authorize:

Google OAuth (Authentication):

Your Google account email address
Your Google account display name
Your Google account profile identifier

Google Ads (Advertising Attribution):

Campaign names, ad group names, and keyword data
Ad spend and cost data
Click identifiers (GCLID) associated with website visitors who convert to leads
Campaign performance metrics (impressions, clicks, conversions)
Google Ads account and customer identifiers

We request only the minimum permissions (OAuth scopes) necessary to provide the features described above. We do not access your Gmail, Google Drive, Google Calendar, Google Contacts, or any other Google service data unless explicitly stated and authorized by you.

5.2 How We Use Google User Data

We use Google user data exclusively for the following purposes:

Google OAuth data is used solely to authenticate your identity when connecting Google services to your CustomerFlows account. We use your email and name to identify your account within CustomerFlows. We do not use Google OAuth data for marketing, advertising, profiling, or any purpose unrelated to service authentication.

Google Ads data is used to:

Display your campaign performance (spend, leads, revenue, and profit return) within the CustomerFlows attribution dashboard
Connect ad clicks (via GCLID) to leads and closed deals in your pipeline, so you can see which campaigns produce paying customers
Upload offline conversion events back to your Google Ads account when a deal is closed, so Google's bidding algorithms can optimize for your actual business outcomes
Calculate PROAS (Profit Return on Ad Spend) and ROAS (Return on Ad Spend) metrics per campaign

We do not use Google Ads data to target advertising to you. We do not use Google user data to build user profiles for advertising purposes. We do not use Google user data for any purpose that is not directly described in this section.

We do not sell, rent, lease, or trade Google user data to any third party.

We share Google user data only in the following limited circumstances:

Back to Google (offline conversions): When you close a deal in CustomerFlows that originated from a Google Ad click, we send a conversion event back to your Google Ads account via the Google Ads API. This event includes the original click identifier (GCLID), the conversion value (deal amount), and the conversion timestamp. This data is sent to your own Google Ads account — not to any third party.

Infrastructure providers: Google user data may be stored on infrastructure operated by our cloud hosting provider as part of normal service operation. Our hosting provider processes this data solely on our behalf under a data processing agreement and does not access, use, or share it independently.

We do not share Google user data with any advertising networks, data brokers, analytics providers, or any other third parties beyond what is described above.

5.4 How We Store and Protect Google User Data

Google user data is stored and protected using the same security measures we apply to all customer data:

Encryption in transit: All data transmitted between your browser, our servers, and Google's APIs is encrypted using TLS 1.2 or higher.
Encryption at rest: Stored Google user data is encrypted at rest using AES-256 encryption.
Access control: Access to Google user data within our systems is restricted to authorized personnel on a need-to-know basis. All access is protected by multi-factor authentication and logged for audit purposes.
Infrastructure security: Data is hosted on infrastructure that maintains SOC 2 Type II compliance within the United States.
OAuth token security: Google OAuth access tokens and refresh tokens are stored encrypted and are never exposed to client-side code, logged in plaintext, or shared with any third party.

5.5 Google User Data Retention and Deletion

Google OAuth data (email, name, profile ID): Retained for the duration of your active CustomerFlows account. Deleted within 30 days of account closure or upon your request.

Google Ads campaign and performance data: Retained for the duration of your active subscription to provide attribution reporting. Deleted within 90 days of account closure or disconnection of the Google Ads integration.

Google Ads click identifiers (GCLID): Retained as part of lead and deal records for the duration of your subscription to maintain attribution accuracy. Deleted within 90 days of account closure.

Google OAuth tokens: Access tokens and refresh tokens are deleted immediately when you disconnect your Google account from CustomerFlows, or within 30 days of account closure.

How to request deletion: You may request deletion of all Google user data at any time by:

Disconnecting Google services from the Integrations page in your CustomerFlows account (this revokes our access and deletes stored tokens immediately)
Emailing privacy@customerflows.com to request deletion of all Google-related data
Deleting your CustomerFlows account from Settings, which deletes all data including Google user data

You may also revoke CustomerFlows' access to your Google account at any time by visiting your Google Account permissions page at https://myaccount.google.com/permissions.

Upon receiving a deletion request, we will delete or anonymize all Google user data within 30 days and confirm the deletion to you in writing.

5.6 Google API Services Compliance

CustomerFlows' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5A. AI Features

CustomerFlows uses AI to answer new inquiries, ask your qualifying questions, summarize conversations and score leads.

Where it runs: Our AI features run on Cloudflare's AI services (Workers AI, AI Search and AI Gateway), within our own Cloudflare account. We do not send conversation data to OpenAI or Anthropic.
What it sees: The messages in the conversation, the answers to your qualifying questions, and the business information you add for the assistant to answer from.
No training on your data: We do not use your data or your end-customers' data to train AI models, and our AI provider does not use it to train its models.
People stay in charge: Lead scores and qualification answers help your team decide whom to contact first. They do not produce decisions with legal or similarly significant effects about anyone, and your team can read every conversation and take over at any time. You can switch the AI assistant off in your settings.
How long we keep it: AI conversations are kept while the workspace exists. We are building automatic deletion of AI records after 30 days; until it is in place, we delete them on request (privacy@customerflows.com).

6. Meta User Data Disclosure

CustomerFlows integrates with Meta services (Facebook, Instagram, and WhatsApp) to provide social advertising attribution, offline conversion tracking, WhatsApp messaging, and optional account authentication. This section describes how we access, use, store, share, and protect Meta user data in compliance with Meta's Platform Terms and Developer Policies.

6.1 Meta User Data We Access

When you connect your Meta account(s) to CustomerFlows, we access the following data depending on which Meta services you authorize:

Facebook Login (Authentication):

Your Facebook account email address
Your Facebook account display name
Your Facebook profile identifier

Meta Marketing API (Advertising Attribution):

Ad account identifiers and account names
Campaign names, ad set names, and ad names
Ad spend and cost data
Performance metrics (impressions, clicks, reach, conversions)
Click identifiers (FBCLID) associated with website visitors who convert to leads

Meta Conversions API (Offline Conversion Upload):

We send conversion event data TO Meta on your behalf (this is outbound data, not data we access from Meta)
Events include: event name (e.g., "Purchase"), event timestamp, conversion value, and hashed customer identifiers (email and/or phone number hashed with SHA-256 before transmission)

WhatsApp Cloud API (Messaging):

Phone numbers and WhatsApp profile names of people who message your business number
Message content and delivery status
WhatsApp Business Account (WABA) configuration identifiers

We request only the minimum permissions necessary. We do not access your personal Facebook posts, photos, friends list, Instagram content, or any Meta data unrelated to advertising and WhatsApp messaging.

6.2 How We Use Meta User Data

Facebook Login data is used solely to authenticate your identity when signing in to CustomerFlows. We use your email and name to identify your account. We do not use Facebook Login data for marketing, advertising, profiling, or any purpose unrelated to service authentication.

Meta Marketing API data is used to:

Display your Facebook and Instagram campaign performance (spend, leads, revenue, profit return) in the CustomerFlows attribution dashboard
Connect ad clicks (via FBCLID) to leads and closed deals in your pipeline
Compare Meta campaign performance alongside Google Ads campaigns
Calculate PROAS (Profit Return on Ad Spend) and ROAS (Return on Ad Spend) per campaign

Meta Conversions API data is used to:

Upload offline conversion events when a deal closes in your pipeline, so Meta's bidding algorithms learn which ad clicks produce paying customers
Improve the quality of your ad targeting over time by providing Meta with real business outcome signals (signed contracts, not just clicks or form fills)
All customer data sent to Meta via the Conversions API is hashed using SHA-256 before transmission — we never send plain-text personal information

WhatsApp Cloud API data is used to:

Deliver and receive messages between your business and your customers
Power the AI chatbot for lead qualification
Display conversations in your unified inbox
Create deal records in your pipeline from qualified leads

We do not use Meta user data to build advertising profiles about you. We do not use Meta user data for any purpose not directly described in this section.

We do not sell, rent, lease, or trade Meta user data to any third party.

We share Meta user data only in the following limited circumstances:

Back to Meta (Conversions API): When you close a deal that originated from a Meta ad, we send a hashed conversion event back to your Meta ad account via the Conversions API. This event includes a hashed customer identifier (SHA-256 hashed email or phone), the conversion value, and the event timestamp. This data is sent to your own Meta ad account to improve your campaign performance.

Back to Meta (WhatsApp): Messages sent through the CustomerFlows inbox are delivered via Meta's WhatsApp Cloud API. Meta processes these messages in accordance with their WhatsApp Privacy Policy.

AI features (conversation context): When the AI assistant replies to WhatsApp messages, the conversation is processed by our AI features, which run on Cloudflare. See Section 5A.

Infrastructure providers: Meta user data may be stored on infrastructure operated by our cloud hosting provider as part of normal service operation, under a data processing agreement.

We do not share Meta user data with advertising networks, data brokers, or any other third parties beyond what is described above.

6.4 How We Store and Protect Meta User Data

Meta user data is stored and protected using the same security measures we apply to all customer data:

Encryption in transit: All data transmitted between your browser, our servers, and Meta's APIs is encrypted using TLS 1.2 or higher.
Encryption at rest: Stored Meta user data is encrypted at rest using AES-256 encryption.
Access control: Access to Meta user data within our systems is restricted to authorized personnel on a need-to-know basis, protected by multi-factor authentication and audit logging.
Infrastructure security: Data is hosted on infrastructure that maintains SOC 2 Type II compliance within the United States.
Token security: Meta OAuth access tokens and system user tokens are stored encrypted and are never exposed to client-side code, logged in plaintext, or shared with any third party.
Data hashing: All customer personal data sent to Meta via the Conversions API is hashed using SHA-256 before leaving our servers. We never transmit plain-text customer email addresses or phone numbers to Meta.

6.5 Meta User Data Retention and Deletion

Facebook Login data (email, name, profile ID): Retained for the duration of your active CustomerFlows account. Deleted within 30 days of account closure or upon your request.

Meta Marketing API data (campaigns, spend, performance): Retained for the duration of your active subscription to provide attribution reporting. Deleted within 90 days of account closure or disconnection of the Meta Ads integration.

Meta click identifiers (FBCLID): Retained as part of lead and deal records for the duration of your subscription. Deleted within 90 days of account closure.

WhatsApp conversation data: Retained for the duration of your subscription to power the inbox, pipeline, and automation features. Deleted within 90 days of account closure.

Meta OAuth and API tokens: Deleted immediately when you disconnect your Meta account from CustomerFlows, or within 30 days of account closure.

How to request deletion: You may request deletion of all Meta user data at any time by:

Disconnecting Meta services from the Integrations page in your CustomerFlows account
Emailing privacy@customerflows.com to request deletion of all Meta-related data
Deleting your CustomerFlows account from Settings, which deletes all data including Meta user data

You may also revoke CustomerFlows' access to your Meta account at any time by visiting your Facebook Settings → Apps and Websites at https://www.facebook.com/settings?tab=applications.

Upon receiving a deletion request, we will delete or anonymize all Meta user data within 30 days and confirm the deletion to you in writing.

6.6 Meta Platform Compliance

CustomerFlows' use of data received from Meta APIs complies with the Meta Platform Terms and Meta Developer Policies. We process Meta user data only for the purposes described in this section and only with the explicit authorization of the user who connects their Meta account.

7. Cookies and Tracking Technologies

7.1 Cookies We Use

Cookie Category	Purpose	Examples	Required?
Strictly Necessary	Authentication, session management, security	Session ID, CSRF token	Yes — the Service cannot function without these
Analytics	Understanding how visitors use our website and application	Google Analytics (`_ga`, `_gid`)	No — you may opt out
Marketing Attribution	Connecting ad clicks to conversions	GCLID, FBCLID, UTM parameters stored in first-party cookies	No — you may opt out

Consent: Visitors in the EEA, the UK and Switzerland are asked for consent before we set analytics or marketing attribution cookies, on our website and in the application. One choice covers both. You can change it at any time from the "Cookie settings" link in the footer of our website or in the application's account menu.
Browser settings: Most browsers let you block or delete cookies. Blocking strictly necessary cookies may stop the Service from working correctly.
Google Analytics opt-out: You can install the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout.

See our Cookie Policy for the full list of cookies.

8. Data Retention

We keep personal information only as long as we need it for the purposes in this policy:

Data	How long we keep it
Account and workspace data	While your account is active. If your subscription ends, the workspace becomes read-only for 30 days, is then archived for 30 days, and is permanently deleted by day 90. If you delete your workspace yourself, it is held for 29 days so it can be restored on request, then permanently deleted on day 30.
Your end-customers' data (contacts, conversations, deals, AI conversations)	While your workspace exists, on the schedule above. When you delete a contact, it is removed from view at once and deleted from your workspace after 30 days. Some internal records, such as event history and AI records, are removed on request while we finish automatic deletion across all our systems.
WhatsApp media you archive	30 days
Contact import and export files	7 days (import error reports: 30 days)
Database backups	Nightly encrypted backups are kept for 7 days, so deleted data can remain in a backup for up to 7 days before it expires.
System logs	About 7 to 14 days, as set by our hosting providers
Billing records	7 years, to meet tax and accounting obligations (held by Stripe)
Email unsubscribe and suppression records	Kept so that we never email you again after you opt out
Website analytics	Up to 14 months in Google Analytics
Support correspondence	2 years after the last message

When you ask us to delete your information, we will do so within 30 days, except where the law requires us to keep it. See Section 10.

9. Data Security

We implement industry-standard technical and organizational measures to protect your information:

Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.
Encryption at rest: Stored data is encrypted at rest using AES-256 encryption.
Access control: Employee and contractor access to customer data is restricted on a need-to-know basis and protected by multi-factor authentication.
Infrastructure security: Our hosting and database providers maintain SOC 2 Type II reports.
Backups: We take an encrypted backup of our database every night and keep each backup for 7 days.
Incident response: We maintain an incident response plan. In the event of a data breach affecting your personal information, we will notify you within 72 hours of becoming aware of the breach, as required by applicable law.

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

10. Your Rights and Choices

10.1 All Users

Regardless of your location, you may:

Access your data: Request a copy of the personal information we hold about you.
Correct your data: Request correction of inaccurate or incomplete information.
Delete your data: Request deletion of your personal information, subject to legal retention requirements.
Export your data: Request a machine-readable export of your account data.
Opt out of marketing emails: Unsubscribe at any time using the link in any marketing email, or by contacting us.

10.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

Right to know: You may request that we disclose the categories and specific pieces of personal information we have collected, the sources from which it was collected, the business purposes for collection, and the categories of third parties with whom we share it.
Right to delete: You may request deletion of personal information we have collected from you, subject to certain exceptions.
Right to opt out of sale: We do not sell your personal information. If this changes in the future, we will provide a "Do Not Sell My Personal Information" link.
Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.
Right to correct: You may request that we correct inaccurate personal information.
Right to limit use of sensitive personal information: We do not use sensitive personal information for purposes beyond what is necessary to provide the Service.

To exercise any of these rights, contact us at privacy@customerflows.com. We will verify your identity before processing your request and respond within 45 days.

10.3 Residents of Other U.S. States

Several U.S. states have enacted consumer privacy laws that grant residents rights similar to those described above, including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), and Montana (MCDPA). If you are a resident of any state with an applicable consumer privacy law, you may exercise your rights by contacting us at privacy@customerflows.com.

If you are in the EEA or the UK, you have the right to:

Access the personal information we hold about you and get a copy;
Correct information that is inaccurate or incomplete;
Erase your information, where there is no reason for us to keep it;
Restrict how we use your information while a concern is looked into;
Data portability: receive information you gave us in a machine-readable format, or have it sent to another provider;
Object to processing based on our legitimate interests, and to direct marketing at any time;
Withdraw consent at any time, where we rely on consent, without affecting what we did before;
Complain to a data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EEA, the authority in the country where you live or work.

To use these rights, email privacy@customerflows.com. We will confirm your identity first and reply within one month. If you are one of our customers' customers, we will pass your request to that business, because they control your information (Section 1.1).

10.5 Other Countries

If you live in another country with a data protection law, such as Saudi Arabia's Personal Data Protection Law, you have the rights that law gives you. Contact privacy@customerflows.com and we will help.

11. Children's Privacy

CustomerFlows is designed for use by businesses and is not directed at individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected information from a person under 18, please contact us at privacy@customerflows.com and we will promptly delete it.

12. Third-Party Links

Our website and application may contain links to third-party websites, integrations, and services (e.g., Google Ads, Stripe billing portal, WhatsApp). We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party service you interact with.

13. International Data Transfers

CustomerFlows is operated from the United States. Stored data is kept mainly in the United States, and requests are processed on Cloudflare's global network, close to where they come from. Some providers in Section 4.1 operate globally.

When we transfer personal information from the EEA or the UK to the United States or another country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, and for UK data the UK International Data Transfer Addendum, together with additional safeguards such as encryption in transit and at rest. Customers who need these clauses for their own customers' data can put them in place with us by contacting privacy@customerflows.com.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes:

We will update the "Last Updated" date at the top of this page.
We will notify registered users via email at least 14 days before the changes take effect.
We will post a prominent notice on our website.

Your continued use of the Service after the updated Privacy Policy takes effect constitutes your acceptance of the changes.

15. Contact Us

If you have questions about this Privacy Policy, want to exercise your rights, or have concerns about our data practices, contact us at:

Keilani Media Group LLC d/b/a CustomerFlows 30 N Gould St Sheridan, WY 82801 United States

Email: privacy@customerflows.com Phone: +1 (307) 317-0832

We aim to respond to all privacy inquiries within 10 business days.