Privacy Policy

This policy explains what information FlowOps ("FlowOps", "we", "us") collects when you use the FlowOps website and app at flowopsagent.ai (the "Service"), how we use it, and the choices you have. FlowOps is used by businesses ("Customers" or "workspaces") to take bookings from their own clients ("end customers").

1. Information we collect

Account information. When you create an account: your name, email address, a password (stored only as a salted hash — we never see or store it in plain text), an optional business name, and whether your email has been verified. When you sign in we store a session record that includes your IP address and browser user-agent, used to keep you signed in and to protect accounts.

Workspace and business information. Your business name, booking-page address, time zone, opening hours, the services you offer (name, duration, the resource booked such as a room, person or vehicle), team members and their roles, and team invitations (the invited email and role; invite links are stored only as one-way hashes).

Bookings and end-customer contact information. For each booking: the end customer's name, email address, optional phone number, optional notes, the service, date and time, and its status. Bookings can be made by end customers on a public booking page, by workspace users in the dashboard, or by FlowAI on a user's request. If the customer opts in to text messages, we also store that choice and when it was made.

Text messages (SMS). Appointment texts (confirmations, reschedules and cancellations) are sent only when the end customer gives a mobile number and ticks the opt-in box on the booking form (“Text me about this appointment. Msg & data rates may apply. Reply STOP to opt out.”), or tells the business they agree. The box is never pre-ticked and texting is not required to book. Message frequency depends on your bookings. Reply STOP to any text to opt out (you'll get one confirmation and no further texts) or HELP for help. Message and data rates may apply. Mobile numbers and SMS opt-in information are never sold or shared with third parties or affiliates for marketing or promotional purposes; they are shared only with our SMS provider (Twilio) to deliver the messages.

Activity and audit records. A log of booking actions (created, rescheduled, cancelled, conflicts, failures) with the acting user, and a record of notifications sent or attempted. We use these to run the Service, troubleshoot, and show workspace owners what happened.

Technical and security data. IP addresses and request counts used for rate limiting and abuse prevention, and standard server logs kept by our hosting provider. We do not use advertising trackers or sell analytics data.

2. Google Calendar data

If a workspace owner chooses to connect Google Calendar, FlowOps asks Google for the calendar.events scope (https://www.googleapis.com/auth/calendar.events) plus basic sign-in scopes (openid and email) so we know which Google account was connected.

• What we do with it: create, update and delete calendar events for bookings made in FlowOps — for example, adding an event when a booking is confirmed, moving it when the booking is rescheduled, and removing it when the booking is cancelled. Events contain the booking's service, time, resource and the end customer's name, email, phone and notes.
• What we don't do: FlowOps does not read, copy or analyze your other calendar events, does not use Google data for advertising, does not sell it, and does not use it to train AI models. Google user data is not sent to AI providers.
• What we store: an encrypted OAuth refresh token, the connected Google account's email address, the calendar ID used, and the Google event ID for each synced booking.
• Disconnecting: the owner can disconnect Google Calendar in Administration at any time, which deletes the stored token. You can also revoke FlowOps's access from your Google Account at myaccount.google.com/permissions.

FlowOps's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. How we use information

• To provide the Service: accounts, workspaces, booking pages, availability checks, calendar sync and notifications.
• To send service emails: email verification, password resets, team invitations, and booking confirmations, changes and cancellations.
• To run FlowAI when a workspace user asks it to (see section 4).
• To secure the Service: rate limiting, preventing abuse, and investigating problems.
• To communicate with workspace owners about the Service, including the pilot program.

We do not sell personal information and do not share it for cross-context behavioral advertising.

4. FlowAI and AI processing

FlowAI is an optional assistant inside the dashboard. When a signed-in user sends FlowAI a message, the conversation, the workspace's name, hours and services, and any booking details FlowAI looks up to answer (which can include end-customer names, emails, phone numbers and notes) are sent through Vercel AI Gateway to a third-party AI model provider (currently OpenAI) to generate the reply. FlowAI only acts through FlowOps's own booking tools, and cancellations require the user's confirmation. FlowOps does not store FlowAI chat transcripts beyond the user's browser session, although booking changes FlowAI makes are recorded in the audit log. AI providers process this data under their API terms, which (for OpenAI's API) do not use API data to train their models by default.

5. Service providers we use

We share information only with providers that help us run the Service, and only as needed for that purpose:

• Vercel — hosts the website and app, and provides AI Gateway for FlowAI requests.
• Neon — hosts our Postgres database, where accounts, workspaces and bookings are stored (United States).
• Resend — delivers our emails (verification, password reset, invites and booking notifications).
• Google — Google Calendar, only for workspaces that connect it.
• AI model providers (currently OpenAI, via Vercel AI Gateway) — generate FlowAI replies.
• Twilio — delivers appointment text messages to customers who opted in, and handles STOP/HELP replies.
• Cloudflare — DNS for our domain.

We may also disclose information if required by law, to protect the rights and safety of users or the public, or as part of a merger or sale of the business.

6. Workspaces and end customers

Each business's workspace is kept separate. Booking and end-customer information entered into a workspace belongs to that business, which decides how it is used to serve its own clients. If you booked an appointment with a business that uses FlowOps and want your information changed or removed, please contact that business; you can also contact us and we will pass the request on.

7. Retention and deletion

We keep account, workspace and booking data for as long as the account or workspace is active. A workspace owner can ask us to delete the workspace and its data, or an account, at any time by emailing us; we will delete it from the live database within 30 days, except where we must keep records for legal or security reasons. Rate-limit records are short-lived. Sessions expire automatically.

8. Security

Data is encrypted in transit (HTTPS). Passwords are hashed, invite and reset links are single-use and expire, Google refresh tokens are encrypted at rest, and access to each workspace is limited by role. No system is perfectly secure; please use a strong, unique password.

9. Your choices and rights

You can update your business details in the app, disconnect Google Calendar at any time, and ask us for a copy of, correction to, or deletion of your personal information by emailing brian.flowops@gmail.com. Depending on where you live, you may have additional rights under local law; we will honor them as required.

10. Children

FlowOps is a business tool and is not directed to children under 16. We do not knowingly collect personal information from children.

11. Changes

We may update this policy. We will change the "Last updated" date and, for material changes, notify workspace owners by email or in the app.

12. Contact

Questions or requests: brian.flowops@gmail.com. See also our Terms of Service.