1. Overview
Click and Flow provides Flo, an AI-native CRM platform that uses multi-agent AI to automate customer relationship management, quote-to-cash workflows, and related sales operations for our business customers ("Customers"). This policy applies to visitors of our website and to end users of the Flo platform whose organizations are our Customers.
Where Flo is deployed by a Customer for their own business purposes, that Customer is generally the data controller for the customer, contact, and deal data processed in Flo, and we act as a data processor on their behalf under a separate data processing agreement. This policy focuses on our own collection and use of information, including information we access via Google APIs to power Flo's features.
2. Information we collect
Information you provide directly
- Contact details submitted through website forms (name, work email, company, phone number, message content)
- Account and profile information when you or your organization sign up to use Flo
- Content you or your organization input into Flo, such as CRM records, quotes, notes, and communications
- Correspondence you send us directly (support requests, sales inquiries)
Information collected automatically
- Usage data such as pages visited, features used, and interaction timestamps
- Device and browser information, IP address, and general location derived from IP
- Cookies and similar technologies (see Section 12)
Information from third-party integrations
When you or your organization connect a third-party account to Flo — including Google Workspace (Gmail, Google Calendar, Google Meet), Salesforce, or other integrations — we receive information from that provider as authorized during the connection process. See Section 3 for Google-specific detail.
3. Google API data (Gmail, Calendar, Google Meet)
Flo offers optional integrations that connect to a user's Google Workspace account via OAuth, so that sales and customer-facing activity already happening in Gmail, Google Calendar, and Google Meet can be reflected in the CRM without manual data entry. We only request access after you explicitly initiate the connection and grant consent through Google's own consent screen, and only to the specific scopes listed below.
| Google service | What we access | Why |
|---|---|---|
| Gmail | Metadata and content of emails you choose to sync (sender, recipient, subject, timestamps, and message body relevant to logged CRM activity) | To automatically log customer email activity against the relevant CRM record, reducing manual data entry |
| Google Calendar | Event details (title, attendees, time, description) for meetings you choose to sync | To associate meetings with CRM records and surface upcoming customer touchpoints |
| Google Meet | Meeting transcript entries (via the Google Meet API's conference records), for meetings the connected user hosts or attends | To generate AI-assisted meeting summaries and next-step suggestions inside the CRM |
We do not request broader Google Drive file access, do not read email or calendar data outside the scopes above, and do not access this data unless a user has actively connected the relevant integration.
4. Google Limited Use disclosure
Click and Flow's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically:
- We use data obtained through Google APIs only to provide or improve the specific Flo features described in Section 3 — we do not use it for any other purpose.
- We do not transfer Google user data to any third party except: (a) as necessary to provide or improve the features described above, subject to those third parties' own obligations to us; (b) to comply with applicable law or a valid legal process; or (c) as part of a merger, acquisition, or sale of assets, with prior notice to affected users.
- We do not sell Google user data, and we do not permit anyone else to sell it.
- We do not use Google user data, or any information derived from it, for serving advertisements — including retargeting, personalized, or interest-based advertising.
- We do not use Google user data to train generalized, non-personalized AI or machine learning models. Where Flo uses AI to summarize or draft based on synced Gmail, Calendar, or Meet content, that processing is performed to serve the individual Customer whose data it is, not to improve models used across other Customers, unless a Customer has separately and explicitly opted in.
- Only employees, contractors, and service providers with a legitimate need — and who are bound by confidentiality obligations — may access this data, and only to the extent necessary to provide the service.
5. AI & LLM data processing
Core Flo features — including Deal Coach, Ask Flo, contract onboarding, and AI-generated outreach — are powered by large language models (LLMs) operated by third-party AI providers. Depending on the feature, relevant content (such as CRM records, call transcripts, contract text, or emails you've synced) may be sent to one or more of the following providers for processing:
| Provider | Used for |
|---|---|
| Anthropic (Claude) | Core agent reasoning, Ask Flo, Deal Coach, drafting and summarization |
| Google (Gemini API) | Select AI features, independent of the Google Workspace integration described in Section 3 |
| OpenAI (ChatGPT / API) | Select AI features and drafting tasks |
These providers act as our subprocessors and are contractually bound to use the data we send them only to return a result to Flo — not to train their own general-purpose models on your data, unless a Customer has separately and explicitly opted in. We select providers that offer enterprise/API-tier terms with these protections, as distinct from their free consumer products.
We do not use your data to train Flo's own models in a way that exposes it to other Customers. Outputs generated by these AI features (summaries, drafts, coaching suggestions) are provided as assistance to your team and should be reviewed before being relied upon for business or legal decisions.
6. How we use information
- Operate, maintain, and improve the Flo platform and our website
- Provide the specific integration features described in Section 3
- Respond to inquiries, support requests, and communications you send us
- Send product updates, investor/customer communications, or marketing you've opted into, and allow you to opt out at any time
- Monitor, detect, and prevent fraud, abuse, and security incidents
- Comply with legal obligations
- Understand aggregate usage of our website via analytics tools (see Section 12)
7. How we share information
We do not sell your personal information. We share information only in the following circumstances:
- Service providers: infrastructure, hosting, database, and AI model providers we use to operate Flo — including the AI providers named in Section 5 — bound by contractual confidentiality and data-protection obligations
- Within your organization: if you are a Flo end user, information you input is visible to other authorized users within your Customer organization as configured by your administrator
- Legal requirements: where required to comply with law, regulation, legal process, or governmental request
- Business transfers: in connection with a merger, financing, acquisition, or sale of assets, with notice to affected users where required
- With your consent: for any other purpose disclosed to you at the time of collection, with your consent
8. Data storage & security
We use industry-standard technical and organizational measures to protect information, including encryption in transit, access controls, and tenant-level data isolation within Flo's multi-tenant architecture. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
9. Data retention
We retain information for as long as needed to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. Google user data specifically is retained only as long as needed to provide the connected feature, and is deleted upon disconnection of the integration or upon request, except where retention is required by law.
10. Your rights & choices
- Revoke Google access: you can disconnect Flo's access to your Google account at any time via Flo's integration settings, or directly through your Google Account permissions page
- Access & deletion: you may request access to, correction of, or deletion of your personal information by contacting us below
- Marketing opt-out: you can unsubscribe from marketing emails using the link in any such email
- Regional rights: depending on your location, you may have additional rights under laws such as the CCPA/CPRA or GDPR, including the right to know, delete, correct, or restrict processing of your information — see Section 11 for EU/UK-specific detail
11. EU & UK users (GDPR)
Click and Flow, Inc. is based in the United States and today serves primarily U.S. customers, but we work with, and expect to grow our base of, customers and users in the European Union and United Kingdom. Where the GDPR or UK GDPR applies to our processing of your personal data, this section supplements the rest of this policy.
Legal basis for processing
We process personal data on one or more of the following bases: performance of a contract (providing Flo to a Customer you're associated with), legitimate interests (such as securing our platform or improving our services), consent (such as connecting a Google integration, or receiving marketing you've opted into), and compliance with legal obligations.
Your GDPR rights
In addition to the rights listed in Section 10, if the GDPR or UK GDPR applies to you, you have the right to: access your personal data; request rectification or erasure; restrict or object to processing; request data portability; and withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal. You also have the right to lodge a complaint with your local data protection supervisory authority.
International data transfers
Because we're U.S.-based, personal data from EU/UK users is transferred to and processed in the United States. Where required, we rely on appropriate safeguards for such transfers, such as the European Commission's Standard Contractual Clauses (or the UK equivalent), and we work with subprocessors — including the AI providers named in Section 5 — that offer comparable contractual commitments.
If you are in the EU or UK and have questions about our GDPR compliance, contact us using the details in Section 16; we will designate an EU/UK representative as required once our EU/UK customer base warrants it.
12. Cookies & analytics
Our website uses cookies and similar technologies, including Google Analytics (GA4) and Microsoft Clarity, to understand how visitors use our site. These tools may collect information such as pages viewed, session duration, and general location. You can control cookies through your browser settings; disabling them may affect site functionality.
13. Children's privacy
Our website and Flo platform are intended for business use and are not directed to children under 16. We do not knowingly collect personal information from children.
14. International users
Click and Flow, Inc. is based in the United States. If you access our services from outside the U.S., your information may be transferred to, stored, and processed in the U.S. or other countries where our service providers operate. See Section 11 for EU/UK-specific transfer detail.
15. Changes to this policy
We may update this policy from time to time. We will post the updated version on this page with a revised "Last updated" date, and for material changes we will provide additional notice where appropriate.
16. Contact us
Questions about this policy or how we handle your data can be sent to:
Click and Flow, Inc.
Huntington Beach, CA
support@clickandflow.xyz