Privacy Policy

Last updated: February 26, 2026
Effective date: February 26, 2026

1. Scope

This Privacy Policy describes how QFlow.ai, Inc. (“QFlow”, “we”, “us”, or “our”) collects, uses, and shares information when you:

• visit our public websites and pages (including https://qflow.ai and subdomains);
• create an account or use our platform, applications, and services (the “Service”);
• interact with us in connection with sales, support, or marketing (including chat and email).

If you are using the Service on behalf of an organization (for example, your employer), your organization may control the Customer Data you provide to the Service. In those cases, we may process Customer Data as a “processor” or “service provider” for your organization. Where applicable, our Data Processing Addendum (“DPA”) governs our processing of personal data in Customer Data.

2. Information We Collect

2.1 Information you provide

We may collect information you provide directly to us, such as:

• account and profile information (name, email, company, role, and similar identifiers);
• content you submit in the Service (for example, comments, recipes, prompts, files, and messages);
• support and communications (for example, emails, chat messages, and meeting scheduling details);
• billing and transaction information (we do not store full payment card numbers).

2.2 Information collected automatically

When you visit our websites or use the Service, we automatically collect certain information, which may include:

• device and log data (IP address, browser type, operating system, timestamps, and diagnostic data);
• usage data (pages viewed, features used, clicks, and similar activity data);
• cookies and similar technologies (for example, cookies, local storage, and browser storage used for preferences and security).

2.3 Information from integrations and third-party sources

The Service allows you to connect third-party services and business systems (for example, CRMs, data warehouses, accounting platforms, marketing tools, and communication platforms). When you connect an integration, we may receive and process data from those sources as Customer Data at your direction.

2.4 Sensitive information

Unless we explicitly agree in writing, please do not submit sensitive personal information (for example, Social Security numbers, payment card numbers, government-issued IDs, health information, or precise geolocation) to the Service. If Customer Data contains sensitive personal information, Customer is responsible for ensuring it has the right to provide that data to QFlow and that any required notices and consents have been obtained.

3. Cookies, Local Storage, and Similar Technologies

We use cookies and similar technologies to operate our websites and Service, remember preferences, help with authentication and security, and understand usage. These technologies may include:

• Cookies: small text files stored on your device.
• Local storage / browser storage: used to remember preferences and UI settings.
• Tag management: in some environments we use Google Tag Manager to manage scripts and tags.

On certain public pages, we display a cookie consent banner and store your choice in a cookie (for example, qflow_cookie_consent). You can also control cookies through your browser settings. Blocking some cookies may affect site functionality.

Some browser settings offer “Do Not Track” signals or similar mechanisms. At this time, we do not respond to “Do Not Track” signals. You can use the cookie consent banner (where available) and browser controls to manage cookies and similar technologies. You can also contact us at privacy@qflow.ai to exercise applicable opt-out rights.

4. How We Use Information

We use information for purposes such as:

• providing, operating, maintaining, and supporting the Service;
• authenticating users and preventing fraud or abuse;
• personalizing and improving the Service and user experience;
• communicating with you about the Service, updates, and support;
• billing, account administration, and contract performance;
• security, compliance, auditing, and dispute resolution;
• marketing and promotional communications (you can opt out at any time).

4.1 Legal bases (EEA/UK)

If you are located in the European Economic Area (“EEA”), the United Kingdom, or another jurisdiction that requires a legal basis for processing, our legal bases may include:

• Contract: to provide the Service and perform our agreement with you or Customer.
• Legitimate interests: to secure, improve, and operate the Service, and to support our business, where those interests are not overridden by your rights.
• Consent: where we ask for consent (for example, certain cookies or marketing communications) and you provide it.
• Legal obligations: to comply with law, regulation, or lawful requests.

5. How We Share Information

We may share information in the following ways:

5.1 Service providers and subprocessors

We use vendors to help us operate the Service and our business. These vendors may process information on our behalf, subject to contractual protections. Examples may include:

• cloud hosting and infrastructure providers (for example, Amazon Web Services);
• authentication, security, and fraud prevention tooling;
• tag management and website measurement (for example, Google Tag Manager);
• analytics, session replay, and logging providers (for example, LogRocket);
• customer support and chat providers (for example, Drift);
• meeting scheduling and conferencing providers (for example, Cal.com and Zoom);
• payments processing providers (for example, Stripe).

5.2 Customer-directed sharing and integrations

The Service may allow you to send data to, or receive data from, Third-Party Services at your direction (for example, to sync data from business systems or to distribute results to communication tools such as Slack or Microsoft Teams). Those Third-Party Services are outside of QFlow’s control and their privacy practices are governed by their own policies.

5.3 Legal, safety, and business transfers

We may disclose information (i) to comply with law or legal process, (ii) to protect rights, safety, and security, or (iii) in connection with a merger, acquisition, financing, reorganization, or sale of assets.

6. Data Retention

We retain information for as long as reasonably necessary for the purposes described in this Policy, including providing the Service, complying with legal obligations, resolving disputes, and enforcing our agreements. Retention periods vary based on the type of information and our relationship with Customer.

For Customer Data processed on behalf of an organization, we retain and delete Customer Data consistent with our agreements with that organization and (where applicable) the DPA.

7. International Transfers

We may process and store information in the United States and other jurisdictions where we or our service providers operate. If you are located outside the United States, you understand that information may be transferred to and processed in the United States and other jurisdictions that may have different data protection laws than your jurisdiction.

8. Security

We use administrative, technical, and physical safeguards designed to protect information. No method of transmission over the Internet or method of electronic storage is 100% secure, so we cannot guarantee absolute security.

9. Your Rights and Choices

9.1 Marketing communications

You can opt out of marketing emails by using the unsubscribe link in those emails or by contacting us at privacy@qflow.ai.

9.2 EEA/UK rights (GDPR)

If you are located in the EEA or the UK, you may have rights under applicable data protection laws, including the right to request:

• access to your personal information;
• correction of inaccurate or incomplete personal information;
• deletion of personal information;
• restriction of processing;
• data portability; and
• to object to processing (including certain direct marketing).

Where we rely on consent, you may withdraw consent at any time. You also have the right to lodge a complaint with your local data protection authority.

9.3 U.S. state privacy rights

Depending on your state of residence, you may have rights to request access to, correction of, deletion of, or a copy of certain personal information, and to opt out of certain processing such as targeted advertising, “sale” or “sharing” (as defined by applicable law), or certain profiling.

To submit a request, contact us at privacy@qflow.ai. We may need to verify your identity before processing your request. If you are an Authorized User of a Customer, we may direct your request to your organization where appropriate.

If we deny your request and you have a right to appeal, you may appeal by replying to our response or by contacting us at privacy@qflow.ai with the subject line “Privacy Request Appeal.”

9.4 California privacy disclosures

This section applies to California residents where the California Consumer Privacy Act (as amended) applies.

Categories of personal information. Depending on how you use our websites and Service, we may collect the following categories of personal information:

• identifiers (for example, name, email address, and account identifiers);
• internet or other electronic network activity information (for example, usage and log data);
• professional or employment-related information (for example, job title and company);
• commercial information (for example, subscription and billing details); and
• inferences (for example, preferences derived from usage).

Purposes. We use personal information for the purposes described in Section 4 (including to provide and secure the Service, communicate with you, and improve our products and websites).

Disclosures. We may disclose personal information to service providers for business purposes (for example, cloud hosting, security, payments, analytics, and support). We may also disclose personal information to third-party services at your direction through integrations (for example, Slack or Microsoft Teams).

Sale / Sharing. We do not sell personal information for money. Like many companies, we may use cookies and similar technologies on our public websites to measure and improve marketing and site performance. Under some laws, that activity may be considered “sharing” for targeted advertising. Where applicable, you can opt out by declining cookies in our consent banner (where available) and/or by contacting us at privacy@qflow.ai.

Sensitive personal information. We do not use or disclose sensitive personal information to infer characteristics about you. If Customer Data contains sensitive personal information, we process it as directed by Customer and subject to our agreements (including the DPA, where applicable).

10. Automated Processing

We may use automated processing to provide and secure the Service (for example, to generate analytics or recommendations and to detect fraud or abuse). We do not use automated decision-making that produces legal or similarly significant effects about individuals without appropriate safeguards.

11. De-Identified Information

We may aggregate and/or de-identify information so that it can no longer reasonably be linked to an individual or device. We may use de-identified information for research, analytics, and improving the Service, and we may share it with third parties as permitted by applicable law.

12. Children

The Service is not intended for children, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the “Last updated” date above.

14. Contact Us

If you have questions about this Privacy Policy or would like to exercise your privacy rights, contact us at privacy@qflow.ai.