Privacy Policy

1. When this policy applies

This policy covers information we handle for our own business purposes, including website visits, inquiries, customer relationships, billing, support, and security.

We also provide websites, hosting, content, automation, and related services to business customers. When we process personal information on a customer's behalf, that customer determines the purposes of the processing, and our applicable service agreement and data processing terms govern our work. The customer's privacy notice explains its relationship with its visitors, customers, and other individuals. This policy does not authorize us to use customer data for unrelated purposes or reduce protections in a signed agreement.

If your information was collected through one of our customers, contact that business about its use of your information. We assist our customers with privacy requests as required by our agreements and applicable law.

2. Information we collect

The information involved depends on how you interact with us and which services you use.

• Contact and inquiry information: Your name, email address, telephone number, company, role, website, service interests, project details, and communications with us.
• Account and business records: Account identifiers, authentication information, permissions, service selections, agreements, approvals, invoices, billing details, payment status, and transaction references.
• Content and service information: Files, images, text, instructions, and other materials you or your organization provides. Depending on the service, customer-directed information can include leads, inquiries, property listings, reservation or guest details, owner or agent information, and social content.
• Connected-service information: Account or page identifiers, access permissions, authorization tokens, approved content, and activity information made available by services you authorize us to connect.
• Website and technical information: IP address, browser and device characteristics, operating system, approximate location derived from technical information, referral pages, pages viewed, interactions, timestamps, and diagnostic or security information.
• Preferences and request records: Subscription preferences, consent records, privacy requests, and information needed to document and respect your choices.

We receive information directly from you, automatically through website and service activity, from your organization and its authorized users, and from providers or connected platforms involved in your requested services. You may decline optional information, although we may be unable to provide a response or feature that needs it.

Please use the designated payment process for payment credentials. Do not send passwords, full payment-card numbers, or bank login credentials through an inquiry form or ordinary support message.

3. How we use information

We use personal information for the following purposes, as relevant to your interaction with us:

• Responding to inquiries, preparing proposals, and establishing business relationships.
• Providing and administering websites, hosting, managed care, search optimization, content, social publishing, automation, and integrations.
• Managing accounts, permissions, contracts, payments, and business records.
• Providing support, investigating errors, and improving service performance and usability.
• Protecting accounts and systems, detecting misuse, and preventing fraud.
• Understanding website traffic and the effectiveness of our communications.
• Sending requested updates and other communications permitted by law, subject to applicable choices.
• Meeting legal obligations, resolving disputes, and establishing or defending legal claims.

When acting as a processor or service provider for a business customer, we handle customer personal information for authorized service purposes and as permitted by applicable law and our agreement. We do not sell that customer personal information or use it for our own cross-context behavioral advertising. Our applicable data processing terms also restrict unrelated uses and combining customer personal information with other information.

4. When we disclose information

We disclose information as reasonably needed for the purposes described in this policy to:

• Service providers: Companies supporting hosting, storage, authentication, forms, customer relationship management, communications, electronic signatures, payments, analytics, diagnostics, security, support, and AI-assisted service functions. Providers processing information on our behalf are subject to appropriate confidentiality and data-use obligations.
• Your organization and authorized integrations: Account administrators, authorized colleagues, and platforms you instruct us to connect or send information to.
• Professional advisers and appropriate authorities: When reasonably necessary for legal compliance, advice, investigations, fraud prevention, security, or the protection of lawful rights.
• Parties to a business transaction: In connection with a proposed or completed merger, acquisition, financing, restructuring, or transfer of business assets, subject to applicable confidentiality and privacy obligations.
• Other recipients at your direction: For a disclosure you request or separately authorize.

Some providers, including payment processors and social platforms, also handle information for their own purposes under their own privacy notices. Information you direct us to publish can become available to its intended audience and may be copied by others.

Where the applicable customer agreement permits it, we may identify a customer and display public, approved work in our portfolio. This does not authorize disclosure of confidential information or nonpublic personal information. Customers may contact us for information about material providers processing data on their behalf.

5. Cookies, analytics, and similar technologies

We and our providers use cookies and similar technologies in connection with our website and services. These include browser storage, tags, pixels, and identifiers derived from requests. Depending on the feature, they help operate and secure services, remember settings, understand visits and interactions, and measure performance. Some technologies collect information without placing a cookie on your device.

Our website includes Google Analytics and Vercel Web Analytics for traffic measurement. Google Analytics can use browser identifiers and usage events to help us understand visits and interactions. Vercel describes its Web Analytics service as using a request-derived visitor identifier rather than third-party cookies. See Google's explanation of information collected through partner sites (https://policies.google.com/technologies/partner-sites) and Vercel's Web Analytics privacy information (https://vercel.com/docs/analytics/privacy-policy).

Our project inquiry form uses HubSpot to handle the information you submit, including contact details, company, industry, service interests, project summary, preferred timeline, inquiry contact consent, and the submission page. Available features and tracking behavior depend on the relevant service and configuration.

Third-party analytics or embedded services may collect information about activity over time and across different websites or services, depending on their configuration and your interactions. Some disclosures used for advertising can fall within legal definitions of a "sale," "sharing," or "targeted advertising," even without a monetary payment. Your applicable rights concerning these disclosures are described below.

Cookies may last for a session or remain until they expire or are deleted. Their duration depends on the technology, its configuration, and browser settings. Deleting a cookie does not necessarily delete information previously received by us or a provider.

Your tracking choices

• Browser settings: Most browsers let you block or delete cookies and manage site storage. Some features may not work properly if you block technologies they need. Choices may need to be repeated on another browser or device.
• Google Analytics controls: Google provides an Analytics opt-out browser add-on (https://support.google.com/analytics/answer/181881?hl=en) for supported browsers. It limits collection through specified Google Analytics scripts; it does not stop every form of measurement or information sent to the website.
• Available site or platform controls: Where a website, embedded service, or connected platform provides privacy settings, you can use those settings to manage the choices offered there.
• Privacy requests: Contact us using the details below to ask about tracking or exercise applicable privacy rights. Sending an email does not itself disable technologies in your browser.

This policy is a notice, not consent to optional tracking. Where applicable law requires consent or an opt-out mechanism, those requirements apply independently of this policy. Continuing to browse does not, by itself, provide consent where affirmative consent is required.

We do not guarantee a uniform technical response across our website and third-party services to older browser "Do Not Track" settings. Do not assume that enabling that setting stops all collection. Recognized opt-out preference signals, including Global Privacy Control, are distinct from legacy Do Not Track settings; any rights and obligations attached to those signals under applicable law remain in effect.

6. AI and automated service functions

Our services can include AI-assisted drafts, content transformations, images, recommendations, and automated workflows. Information submitted to a particular function may be processed by the providers supporting that function. Avoid including personal or sensitive information that is unnecessary for the task. Customer instructions, approvals, and publishing responsibilities are governed by the applicable service agreement.

We will not use customer confidential information or customer personal data to train generalized AI models for unrelated customers without the customer's prior written consent. This commitment does not represent that every provider has identical retention settings. Processing remains subject to our applicable contractual and legal obligations.

We may use aggregated or deidentified information for security, analysis, and service improvement. Where we maintain information as deidentified, we will not attempt to reidentify it except as permitted by law.

7. How long we retain information

We retain personal information for as long as reasonably necessary for the purposes described in this policy, subject to applicable law and our agreements. Relevant factors include the purpose of collection, the length of our relationship, the nature and sensitivity of the information, legal recordkeeping requirements, security needs, and the time needed to resolve disputes or enforce agreements.

Inquiry and account information may remain relevant while we respond, provide services, or maintain the business relationship. Agreements, invoices, transaction records, and legal correspondence may require longer retention. Limited unsubscribe or preference records may be retained so we can continue honoring your choices.

Customer data return, export, and deletion follow the applicable signed agreement and data processing terms. This policy does not shorten an agreed export window or replace an agreed deletion process. Residual copies may remain in backups until overwritten or removed through the applicable backup cycle, subject to appropriate restrictions and lawful retention requirements. Information no longer needed is deleted or deidentified, subject to lawful exceptions.

8. Security

We use reasonable administrative, technical, and organizational safeguards appropriate to the information and services. No method of transmission or storage is completely secure. This statement does not limit protections or incident-notification obligations required by law or our agreements.

Keep your credentials confidential and contact us promptly if you suspect unauthorized access. Your organization's account administrator may control access to information associated with its account. Disconnecting an integration does not automatically erase records already collected or content already published.

9. Communications and your preferences

You can unsubscribe from marketing communications using an available message link or by contacting us. A project inquiry does not by itself subscribe you to unrelated marketing. Necessary service, transaction, security, and legal communications may continue while relevant to our relationship.

10. Your privacy rights

Depending on your location, the information involved, and the law applicable to our business, you may have rights to:

• Know whether we process your information and receive information about its sources, uses, and disclosures.
• Access your personal information or obtain a portable copy.
• Correct inaccurate information or request deletion.
• Object to or restrict certain processing, or withdraw consent for processing based on consent.
• Opt out of legally defined sales, sharing, targeted advertising, or certain profiling and automated decisions.
• Limit certain uses or disclosures of sensitive personal information.
• Appeal a decision concerning a privacy request and complain to a relevant regulator.

To submit a request, email hello@trueflowdigital.com or write to the address below. Describe your request and the website or business relationship involved. We may need proportionate information to verify your identity or authority. Please do not send sensitive identity documents unless we request them through an appropriate process. Where permitted by law, an authorized agent may submit a request for you.

We respond within the time required by applicable law and explain applicable limitations, exemptions, or extensions. Where an appeal is available, reply to our decision or email us with the subject "Privacy appeal." We will not unlawfully discriminate or retaliate against you for exercising privacy rights. Opt-out requests do not require creating an account or providing unnecessary identification.

California and other United States residents

The categories described in this policy include identifiers, contact and customer records, commercial information, internet or electronic activity, approximate location, professional information, and supplied content. Certain credentials or communication contents may qualify as sensitive personal information. The relevant sources, purposes, recipients, and retention criteria are described above.

Where applicable law grants these rights, you may request categories and specific pieces of information collected about you and information about disclosures, including any legally defined sale or sharing. You may submit an applicable sale, sharing, targeted-advertising, or sensitive-information request through the contact methods above. California residents may also ask about disclosures for third parties' own direct marketing where California's Shine the Light law applies. Nothing in this policy limits rights or request methods required by applicable law.

European Economic Area and United Kingdom residents

To the extent the relevant data protection laws apply, our legal basis depends on the purpose: consent where required; a contract with you or steps you request before entering one; legal obligations; or legitimate interests that are not overridden by your rights. Our legitimate interests include responding to business inquiries, managing customer relationships, providing and improving services, and protecting people and systems. Managing a relationship with your employer may rely on legitimate interests rather than a contract with you personally.

You may withdraw consent without affecting prior lawful processing and object to direct marketing. You may also exercise applicable access, correction, erasure, restriction, portability, objection, and automated-decision rights. You can complain to your local data protection authority, including the UK Information Commissioner's Office.

11. International processing

Trueflow is based in the United States. Information may be processed in the United States and other countries where relevant providers operate. Privacy laws may differ from those in your location. International processing remains subject to applicable legal requirements, including any required transfer safeguards. You can contact us for information about safeguards applicable to your information. Visiting our website does not waive your privacy rights or, by itself, authorize a transfer that requires a separate legal basis.

12. Children and sensitive information

Our website and business services are not directed to children under 13. We do not knowingly collect their personal information for our own purposes. Contact us if you believe a child has provided information so we can address it appropriately.

Do not submit health records, government identification numbers, biometric identifiers, precise personal location, financial-account credentials, or similarly sensitive or specially regulated information unless we have expressly agreed in writing to an appropriate service and safeguards. This restriction does not reduce any obligation we have concerning information actually received.

13. Changes to this policy

We may update this policy as our services, practices, or legal obligations change. We show the effective date above and provide additional notice or obtain consent for material changes where required by law. A revised policy does not retroactively authorize a materially different use that requires permission.

14. Contact us

Trueflow Digital, LLC

Email: hello@trueflowdigital.com

Mail: PO Box 549, Saugatuck, Michigan 49453, United States

Website: trueflowdigital.com (https://trueflowdigital.com)