Privacy Policy

1. Introduction & Overview

Welcome to Buildflow (“Buildflow”, “we”, “us”, or “our”). Buildflow provides an AI-powered sales enablement platform, slide presentation generator, and browser extension designed to help sales teams, founders, and professionals research prospects, synthesize relevant company insights, and automatically generate personalized outreach messages and presentation decks.

This Privacy Policy describes our practices concerning the collection, usage, disclosure, and protection of information obtained through:

• Our web application and marketing website hosted at buildflowhq.com (and associated subdomains);
• The Buildflow Chrome Extension distributed via the Chrome Web Store;
• Our backend APIs, application programming interfaces, AI generation workflows, and associated support channels.

By accessing or using our services, you acknowledge that you have read, understood, and agree to the practices outlined in this Privacy Policy. If you do not agree with any portion of this policy, please discontinue use of our services immediately.

2. Scope of this Policy

This policy applies to all registered users, prospective customers, website visitors, and users of the Buildflow Chrome Extension.

Distinction: Data Controller vs. Data Processor — When you create an account, purchase subscriptions, or visit our marketing properties, Buildflow acts as a Data Controller. When you use Buildflow to process prospect information (such as LinkedIn profile data or prospect leads entered into our presentation and outreach generators), you act as the Data Controller and Buildflow acts as a Data Processor handling such information strictly on your instructions and in accordance with our terms.

3. Information We Collect

We collect information to provide, personalize, and improve our services. The categories of information we collect include:

A. Account & Profile Information

When you register for Buildflow, authenticate, or modify your profile, we collect:

• Full Name and business email address;
• Authentication credentials (passwords are cryptographically salted and hashed using industry-standard protocols; we never store plain-text passwords);
• Company profile information, industry sector, target ICP (ideal customer profile), and product catalog items entered during onboarding;
• Billing contact details and transaction reference IDs (processed directly through certified payment gateways; we do not store full payment card numbers).

B. Prospect & Sales Intelligence Data (Enrichment Data)

When you choose to utilize our sales enrichment features or activate the Buildflow Chrome Extension on supported web pages:

• Publicly visible prospect profile data (such as prospect name, title, headline, company name, website, and public LinkedIn profile URL);
• Company overview details, publicly available value propositions, or company summaries scraped upon your explicit request (via manual trigger or user-enabled Auto-Scrape settings) to generate targeted pitches;
• Outreach status, notes, tags, and campaign lists you manually configure or organize inside your Buildflow dashboard.

C. User Prompts & Generated Content

When you interact with our AI slide generator, pitch drafter, and template tools:

• Input prompts, customized presentation outlines, slide copy, product descriptions, and uploaded logos or assets;
• AI-generated outputs, including slide layouts, presentation slide decks (PDF/PPTX formats), and generated message drafts;
• User feedback and rating signals on generated pitches to improve custom tailoring within your tenant.

D. Technical, Device & Telemetry Information

When accessing our web platform or extension, our systems automatically log technical metadata:

• IP address, browser type and version, language preference, operating system, and screen resolution;
• Usage and interaction metrics (pages viewed, feature interactions, and workflow adoption) to evaluate product performance;
• Technical diagnostics and system logs (including error reports and application health indicators) used to troubleshoot issues and maintain platform stability.

4. Chrome Extension Disclosures

The Buildflow Chrome Extension complies with the Google Chrome Web Store Developer Program Policies, including the Limited Use and Single Purpose requirements.

A. Single Purpose

The single purpose of the Buildflow Chrome Extension is to streamline sales prospecting by allowing users to capture publicly available prospect contact and company context from professional networking pages (such as LinkedIn), and synchronize this context with their Buildflow dashboard to generate personalized sales decks and messages.

B. Permissions Utilized & Explicit Justification

In compliance with the Chrome Web Store Developer Program Policies, Buildflow requests only the minimal set of permissions strictly necessary to deliver its core functionality:

• sidePanel: Required to display the Buildflow side panel interface in your browser alongside supported professional pages without opening separate windows.
• storage (chrome.storage.local): Used to securely persist session authentication tokens (access and refresh tokens), user account identifier (userId), extension preferences (such as Auto-Sync and API configuration), and transient workflow state required to assemble multi-page company insights. Authentication tokens are revoked and cleared upon logout.
• host_permissions (*://*.linkedin.com/*): Allows content scripts to run natively on supported profile and company pages to extract visible sales intelligence details and detect in-app navigation.
• host_permissions (dashboard origin): Allows the extension to read session tokens from your Buildflow web dashboard to maintain single sign-on (SSO) synchronization.

Our Strict Extension Guarantees:

• We do NOT monitor, record, or transmit your overall browsing history, keystrokes, or activities across non-sales web pages.
• We do NOT sell data obtained through the Chrome Extension to data brokers, advertising networks, or third parties.
• We do NOT use or transfer extension data for serving targeted advertisements or credit-worthiness assessments.

5. How We Use Your Information

We process collected information for the following specific purposes:

• Service Delivery & Synthesis: To generate customized outreach messages, match your products to prospect pain points, and render slide decks via our automated PPTX/PDF engines.
• Account & SSO Management: To authenticate your identity, synchronize sessions between your web browser and Chrome extension, and manage subscription entitlements.
• Platform Security & Audit: To monitor against API abuse, authenticate secure requests, prevent fraudulent access, and maintain system health.
• Product Quality & Diagnostics: To detect and fix software bugs, analyze feature adoption patterns via aggregated metrics, and enhance application performance.

6. AI Services & Third-Party Processors

Buildflow leverages advanced Large Language Models (LLMs) and artificial intelligence agents to perform message drafting, presentation layout synthesis, and structured prospect intelligence extraction. To deliver these capabilities, generation requests are routed through enterprise AI infrastructure and executed via commercial foundation model providers. We maintain agreements ensuring these third parties adhere to strict data protection standards.

Enterprise AI Data Safeguards:

• No Foundation Model Training: We utilize commercial API endpoints that ensure your customer data, prospect profile information, and proprietary prompts are never used by our routing partners or downstream model providers to train, retrain, or fine-tune public foundation AI models.
• Ephemeral Inferences: Data transmitted to external AI routing gateways and inference endpoints is processed ephemerally to generate outputs. Intermediary routers and model hosts retain prompt data only for transient operational and abuse-detection windows (typically up to 30 days) under standard commercial API terms, with no permanent storage or model training.
• Encrypted API Transmission: All data exchanged between our application microservices, intermediary gateways, and downstream AI model providers is secured via TLS encryption (TLS 1.2 / TLS 1.3).

7. Information Sharing & Disclosure

We do not sell, rent, or trade your personal information. We only share information with trusted third parties under the following conditions:

1. Trusted Infrastructure & Service Providers: We share data with vetted third-party service providers essential to our operations, including cloud hosting, database management, user authentication, customer analytics, and transactional communications. A current list of our sub-processors is available upon request (or via our Sub-processor Directory). All third-party infrastructure and sub-processors operate under commercial Data Processing Addenda (DPAs) or enterprise privacy terms incorporating standard data protection safeguards.
2. Legal & Regulatory Compliance: We may disclose information if required by applicable law, regulation, subpoena, or enforceable government request, or to protect the vital security, rights, or safety of Buildflow, our users, or the general public.
3. Corporate Transactions: If Buildflow is involved in a merger, acquisition, financing due diligence, or sale of assets, user data may be transferred as part of that transaction under standard confidentiality protections.

8. Data Security & Storage

We implement robust technical and organizational security measures designed to protect information from unauthorized access, loss, misuse, or alteration:

• Encryption in Transit: All traffic between your browser, extension, and our APIs is encrypted using Transport Layer Security (TLS 1.2 / TLS 1.3).
• Encryption at Rest: Application data, underlying databases, and persistent storage volumes are hosted on managed cloud infrastructure (including Supabase and AWS) utilizing industry-standard encryption at rest (such as AES-256).
• Access Controls: Administrative access to production environments is strictly limited to authorized engineering personnel subject to multi-factor authentication (MFA) and least-privilege credentials.
• Least-Privilege Access: Access to production databases is restricted to authorized engineering personnel using multi-factor authentication (MFA).
• Automated Token Revocation: JWT sessions expire automatically and are revocable upon logout or password modification.

9. Data Retention & Deletion

We retain your personal data and sales intelligence assets only for as long as your account is active or as necessary to fulfill the purposes described in this policy:

• Active Account Data: Lead records, generated presentations, and pitch templates remain stored while your subscription remains in good standing.
• Lead & Content Deletion: You may remove prospect records, notes, and generated presentations through your dashboard, or submit an erasure request to have specific records purged from active databases.
• Account Deletion: You may request account termination and permanent deletion of associated account data by contacting privacy@buildflowhq.com. Following account closure, customer records are removed from active production systems within thirty (30) days, except where retention is required for legal or regulatory compliance.

10. Your Privacy Rights & Choices

Depending on your jurisdiction (such as the European Economic Area, United Kingdom, or California under CCPA/CPRA), you possess specific legal rights regarding your personal information:

• Right to Access: Request confirmation and an exportable copy of all personal data we maintain about you.
• Right to Rectification: Request correction of inaccurate, outdated, or incomplete personal details.
• Right to Erasure (Forget Me): Request that we permanently delete your personal information from our active databases.
• Right to Restrict or Object: Object to specific processing activities, such as direct marketing communications.

To exercise any of these rights, contact Privacy & Data Protection Inquiries at privacy@buildflowhq.com. We will respond within thirty (30) days without undue delay.

11. Cookies & Telemetry

We utilize local storage keys (specifically buildflow-auth-token-session on our web dashboard and buildflow.background.state within the Chrome extension) to store encrypted authentication credentials, account metadata, and local feature preferences. This ensures single sign-on (SSO) session synchronization between the dashboard and browser extension. Session tokens are immediately cleared from local storage upon user logout.

We utilize Mixpanel for telemetry and product analytics to understand feature usage trends. You can adjust your browser settings to decline non-essential cookies; however, disabling essential session storage may prevent proper login and synchronization functions.

12. International Transfers

Buildflow and its infrastructure providers maintain servers and cloud hosting environments across global regions (including the United States, Europe, and Asia-Pacific). If you access our services, your information may be processed in locations where our cloud hosts and sub-processors maintain facilities. Where personal data originating in the European Economic Area (EEA), United Kingdom, or Switzerland is transferred internationally, we rely on standard transfer mechanisms, including European Commission-approved Standard Contractual Clauses (SCCs) provided by our cloud hosting vendors.

13. Children’s Privacy

Buildflow is a commercial business-to-business (B2B) sales enablement software platform and is strictly not intended for use by individuals under the age of 18 (“Children”). We do not knowingly solicit or collect personal information from children. If you believe that a minor has provided us with personal information, please notify us immediately at privacy@buildflowhq.com so we can delete the information promptly.

14. Changes to this Policy

We may revise this Privacy Policy periodically to reflect enhancements to our platform features, new browser extension capabilities, legal requirements, or emerging industry standards. When material modifications occur, we will provide noticeable notice by posting the updated policy on this page with an updated “Last Updated” timestamp, and where appropriate, notifying you via email or dashboard notification prior to the change taking effect.

15. Contact Us

If you have questions, feedback, or concerns regarding this Privacy Policy or our security practices, please contact us:

• Privacy & Data Protection Inquiries: privacy@buildflowhq.com
• Website: https://buildflowhq.com
• Notice: Buildflow Inc. • All communications will be acknowledged within 48 business hours.