Privacy Policy

The short version

We collect information you give us directly, and some basic data about how you found us and how you use our pages. We use it to run our service and send you the reports you signed up for. We don’t sell it. We don’t share it with advertisers. You can ask us to delete it anytime.

What we collect and why

When you submit a lead form

We collect your name, email address, and phone number. We also log which channel brought you to the page — for example, Instagram, Google, or a referral link. This is the core of what InBuilt Flow does: capturing that information so the business owner can follow up with you, and so they know which marketing channels are actually working.

When you visit a page we manage

We collect anonymized data about your visit — which pages you viewed, how long you stayed, and where you came from. We also track where on the page people click, using a heatmap tool. This data is aggregated and used to help our clients improve their pages. It is not tied to your name or contact information.

If you book an appointment or use an intake flow (Tier 2 clients)

We may collect additional information relevant to your appointment — such as the type of service you’re booking, your preferred time, or answers to intake questions. This goes directly to the business you’re booking with. We also sync a summary of this information to that business’s records.

If you connect a Google Calendar

When you connect your Google Calendar to our scheduling system (inbuiltflow.com), we access your calendar data using Google’s OAuth 2.0 authorization. We read your calendar availability to prevent double-bookings and write calendar events when appointments are confirmed.

We do not share your Google Calendar data with any third parties. We do not use it for advertising or profiling. Calendar access tokens are retained for the duration of your subscription and deleted within 90 days of cancellation. You can revoke access at any time through your Google Account permissions page at myaccount.google.com/permissions.

If you interact with an AI phone assistant (Tier 3 clients)

Some of our clients use an AI-powered phone system. If you call one of these numbers, the call may be recorded and transcribed in order to respond to your inquiry. California law requires that all parties consent to call recording. You will be informed at the start of the call that it is being recorded. If you prefer not to be recorded, you can end the call and reach out another way.

How we store it

Your data is stored securely in our database infrastructure (Supabase). We use encrypted connections and access controls. Contact data is isolated per client — meaning the information you submit to one business is not accessible to other businesses we work with.

Who sees it

The business whose page you submitted your information through. Us, as the platform operator. No one else.

We do not sell your data. We do not share it with advertising platforms. We do not use it to build profiles for targeting. Mobile information will not be shared with third parties/affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. Text message contents and SMS opt-in data are treated as sensitive personal information under California law (CPRA) and are handled accordingly.

How long we keep it

We retain lead and contact data for as long as the client retainer is active, plus 90 days after it ends. You can request deletion at any time (see below) and we’ll remove it within 7 business days.

Your rights

If you’re in California, you have rights under the CCPA — including the right to know what data we have about you, the right to request deletion, and the right to opt out of any sale of your data (we don’t sell it, but the right exists).

If you’re in the EU or France, you have rights under the GDPR — including access, correction, deletion, and the right to object to how we process your data.

To exercise any of these rights, email us at privacy@inbuiltflow.com and we’ll respond within 30 days.

Cookies

Our analytics tool (Umami) does not use cookies and does not collect personally identifiable information. We do not run any advertising cookies or tracking pixels.

Changes to this policy

If we make significant changes, we’ll update the date at the top and note what changed. We won’t retroactively apply new terms to data you’ve already submitted.

Contact

Flow & Edge Capital LLC
inbuiltflow.com
privacy@inbuiltflow.com