Privacy Policy

Welcome to xFlow ("we," "our," or "us"). We build custom AI solutions, including AI support, sales, and lead generation agents, trained specifically on your company's data and content. We are committed to protecting the privacy of our clients, website visitors, and users who interact with our AI agents and services.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at https://xflow.ai, use our platform, or contract our services for building and training custom AI solutions.

We may collect several types of information from and about users of our website and services, depending on how you interact with us:

• Personal & Contact Information: Name, professional title, business email address, phone number, and mailing address.
• Business Information: Company name, website URL, industry sector, business size, and current workflows or CRM tools you utilize.
• Uploaded Files & Training Content: Knowledge base documents, manuals, internal policies, training datasets, and other reference materials you provide to us to customize and train your AI agents.
• Chatbot Conversations & History: Log files, transcripts, and metadata generated when you or your users interact with our website chat widgets, prototype agents, or deployed production agents.
• Website Usage Data: Technical logs, device and browser information, IP addresses, geographical location data, pages visited, and timestamps.
• Cookies & Tracking Identifiers: Data collected via cookies, pixel tags, and web beacons about your browsing behavior and actions.

We process your information for legitimate business purposes, including but not limited to:

• Lead Qualification & Discovery: Reviewing company details to evaluate whether an AI agent build is viable and scoping custom projects.
• Building & Training AI Solutions: Customizing, training, testing, and calibrating your AI agents using your uploaded files and business manuals.
• Providing Customer Support: Addressing inquiries, responding to contact forms, troubleshooting technical issues, and managing support tickets.
• Service Improvement & Quality Control: Analyzing conversation logs and transcripts to refine AI accuracy, reduce response hallucinations, and improve our proprietary platform algorithms.
• Communications & Updates: Sending newsletter communications, industry updates, product feature announcements, and marketing materials (subject to your opt-out rights).
• Security Monitoring & Fraud Prevention: Monitoring system logs, verifying administrator authentication, and protecting against unauthorized access or breaches.
• Legal Compliance: Adhering to legal duties, court orders, or regulations as required by governing authorities.

We do not sell your personal or business data. We may share information with trusted third-party service providers that perform essential operations for us.

Specifically, we may utilize the following services and platforms to run our agency operations and build your custom AI agents:

• Cloud Infrastructure & Hosting: Amazon Web Services (AWS), Vercel, and Cloudflare.
• Databases & Storage: Supabase and MongoDB.
• AI & Large Language Models: OpenAI APIs, Google Gemini APIs, and Anthropic APIs.
• Communications & Email: Twilio, WhatsApp Business API, and Resend.
• Analytics & Optimization: Google Analytics, Google Tag Manager, and Meta Pixel.
• Payments & Billing: Stripe.

We ensure these third parties maintain strict data confidentiality and utilize data solely to carry out their contracted operations.

We retain your personal and business data only for as long as necessary to fulfill the purposes detailed in this policy, satisfy contractual obligations, or comply with legal requirements.

Training materials and knowledge base uploads are retained for the duration of our engagement to facilitate ongoing support and model tuning. If a contract is terminated, we will delete or return your data in accordance with our agreements.

We implement rigorous technical and organizational security measures to protect your data from loss, misuse, alteration, or unauthorized access, including:

• Encryption: Encrypting all data in transit using SSL/TLS protocols and at rest within our database instances.
• Access Controls: Limiting database and codebase access to authorized personnel via secure identity management solutions.
• Multi-Factor Authentication (MFA): Enforcing MFA across all administrative and development accounts.
• Backup Policies: Performing automated daily backups stored in secure, segregated cloud environments.

As we operate globally and utilize cloud hosting providers with servers located worldwide, your information may be transferred to and processed in countries outside of your own.

We ensure all cross-border transfers comply with applicable privacy regulations (such as GDPR) using Standard Contractual Clauses (SCCs) or other recognized legal frameworks.

Depending on your location, you may have specific rights regarding your personal data:

• Access: The right to request copies of the personal data we hold about you.
• Correction: The right to request that we correct inaccurate or incomplete information.
• Deletion: The right to request the erasure of your personal data under certain conditions.
• Data Portability: The right to request that we transfer your collected data to another organization or directly to you.
• Consent Withdrawal: The right to withdraw consent for processing activities where consent was the primary legal basis.

To exercise any of these rights, please contact our team at xflowautomation.service@gmail.com.

We use cookies to analyze web traffic, remember preferences, and offer a more personalized browsing experience. You can manage or disable cookies using your web browser controls. For more detailed information, please review our Cookie Policy.

Our services and custom AI builds are intended strictly for business enterprises and individuals over the age of 18. We do not knowingly collect personal information from children under 13. If we become aware of such collection, we will delete the data immediately.

Our website may contain links to outside services or resources. We are not responsible for the privacy practices, content, or security of third-party platforms. We advise reading their respective terms and privacy policies.

We may update this Privacy Policy from time to time. When changes are made, we will revise the "Last Updated" date at the top of the policy page. We encourage you to review this page periodically to stay informed about how we protect your data.