Privacy Policy.

Upflo AI ("Upflo AI," "we," "us," "our") provides lead-conversion automation for local service businesses — marketing websites, CRM setup on GoHighLevel, missed-call recovery, SMS and email follow-up, review funnels, and paid advertising management.

This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have. It applies to upfloai.com and to the services we provide directly to clients.

When you submit a form on a client-branded funnel we build and operate for a client (for example, a quote form on a plumber's site we built), that client is the primary data controller for that submission. Please review that funnel's own privacy notice for how the client handles your information.

Questions about this policy? Email hello@upfloai.com with subject line "Privacy Request."

Information you provide

When you fill out a contact form, request a demo, book a call, reply to an outreach message, or sign up as a client, we collect information you give us directly. This typically includes name, business name, role or job title, email address, phone number, business address and service area, marketing preferences, and — for paid clients — payment details (handled by our payment processor; we do not store full card numbers).

Communications with us — including email, text message, phone calls, support tickets, and survey responses — are also information you provide.

Information collected automatically

When you visit upfloai.com, we and our hosting and analytics providers receive standard log and device information: IP address, browser type and version, operating system, device type, screen resolution, language preference, time zone, referring URL, pages viewed, links clicked, time spent on each page, and approximate geographic region derived from your IP address (not precise GPS location). This information is collected via server logs, cookies, and similar technologies described in Section 07.

Information from public sources and third parties

For cold business-to-business outreach to local service-business owners, we may collect business contact information from publicly listed sources such as Google Business Profile, state contractor licensing registries, chamber-of-commerce directories, and other public business directories. We do not source consumer contact information from public records for outreach.

We may also receive information from advertising and analytics partners (for example, Meta and Google), from referrers (clients or partners who introduce you to us), and from our service providers.

We use the information we collect to:

• Respond to inquiries, demo requests, and support questions.
• Deliver the services you or your business agreed to receive, including building and operating funnels, websites, CRM workflows, and campaigns.
• Send SMS messages in accordance with your consent or applicable business-to-business outreach rules — see Section 04.
• Send email communications related to your account, billing, and the services — see Section 05.
• Process billing and send service-related notices (e.g., receipts, account changes, downtime notifications).
• Measure, optimize, and report on advertising and marketing campaign performance.
• Improve our services, including reviewing message performance, lead-conversion outcomes, and product usage in aggregate.
• Detect, prevent, and respond to fraud, abuse, security incidents, or violations of our Terms of Service.
• Comply with legal obligations and respond to lawful requests from regulators or law enforcement.
• For any other purpose where you have specifically consented at the time of collection.

When you provide your phone number to Upflo AI — through our website, contact form, demo request, or in response to outreach — you consent to receive automated SMS text messages from Upflo AI for purposes including:

• Responding to your inquiry
• Sending demo information and scheduling links
• Following up on conversations you initiated
• Sending account, billing, or service-related notifications

Message and data rates may apply. Message frequency varies and depends on your engagement with our services.

You may opt out at any time by replying STOP to any message from us. You may request help by replying HELP. Opting out is processed immediately and permanently for marketing-category messages.

We do not sell or share mobile phone numbers or SMS opt-in data with third parties or affiliates for marketing, promotional, or lead generation purposes. Your phone number may be processed by our SMS provider (Telnyx) and CRM provider (GoHighLevel) solely for the purpose of delivering messages to you.

Consent to receive text messages is not a condition of purchasing any goods or services from us. Carriers are not liable for delayed or undelivered messages.

Upflo AI maintains A2P 10DLC brand and campaign registration with The Campaign Registry (TCR) to comply with mobile carrier requirements for business messaging.

For SMS-related questions, contact hello@upfloai.com.

If you provide an email address, we may send you emails related to your account, billing, service updates, support requests, and — where you have opted in — marketing communications about new features, services, case studies, and offers.

Every marketing email contains a clear unsubscribe link allowing you to opt out of future marketing emails. Opt-out requests are honored within ten (10) business days as required by the CAN-SPAM Act. Transactional emails (billing receipts, security alerts, service notifications) are required to deliver the services and cannot be opted out of while you remain a client.

We do not sell personal information. We share it only with the recipients described below.

Service providers (subprocessors)

We rely on a small set of trusted vendors ("subprocessors") to operate Upflo AI. Each receives only the information necessary to perform its function and is contractually obligated to handle it in line with this policy.

Clients (when you submit to a client-branded funnel)

Information submitted through a client-branded marketing funnel we operate on a client's behalf is shared with that client so they can follow up with you regarding the services you requested. That client becomes the primary data controller and their privacy policy governs how they handle your information from that point.

Legal and safety disclosures

We may disclose information to government authorities, courts, law enforcement, or other third parties when we believe in good faith that disclosure is necessary to comply with laws, regulations, legal processes, or government requests; respond to subpoenas or court orders; enforce our Terms of Service or other agreements; protect the rights, property, or safety of Upflo AI, our clients, employees, or the public; or detect, prevent, or address fraud or security issues.

Business transfers

If Upflo AI is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred to the acquiring entity. We will notify you of any change in ownership of your personal information, and any new owner will be bound by the terms of this Privacy Policy.

Aggregated and de-identified information

We may share aggregated, anonymized, or de-identified information that cannot reasonably identify you for any purpose, including research, benchmarking, marketing, and analytics.

This subprocessor list may evolve. Material changes are reflected by an updated "Last updated" date at the top of this page.

Cookies are small text files placed on your device when you visit a website. We also use web beacons, tracking pixels, and local storage. The cookies and trackers used on upfloai.com fall into four categories:

• Strictly necessary: required for the site to function — session maintenance, traffic load balancing, fraud protection. These cannot be opted out of while using the site.
• Functional: remember preferences and settings to provide a personalized experience.
• Analytics: help us understand how visitors use the site — page views, session duration, bounce rate, traffic sources. We use or plan to use Google Analytics for this purpose.
• Advertising: used by advertising partners to deliver and measure ads on other sites, including Meta Pixel (Facebook/Instagram) and Google Ads conversion tracking. See Section 08.

Most browsers accept cookies by default. You can configure your browser to refuse cookies or alert you when cookies are being sent. Disabling cookies may affect site functionality. For more information, visit allaboutcookies.org.

To opt out of targeted advertising cookies from specific providers:

• Meta (Facebook/Instagram): facebook.com/settings?tab=ads
• Google Ads: adssettings.google.com
• Industry opt-out: optout.aboutads.info or networkadvertising.org/choices

For client work, the websites and funnels we build on behalf of our clients may include conversion-tracking pixels configured by the client. Those are subject to the client's own privacy policy, not this one.

We use, or plan to use, Meta Pixel (a JavaScript code snippet) and Meta Conversions API (a server-to-server integration) to measure conversions from our advertisements, optimize ad delivery, and build remarketing audiences. When you visit upfloai.com, Meta Pixel may collect information about pages you view, buttons you click, and forms you submit. This information is sent to Meta and may be associated with your Meta account for advertising purposes.

The Meta Conversions API sends similar information from our own servers directly to Meta, which enables measurement even when cookies are blocked or restricted. Before sending personally identifiable information (such as email addresses or phone numbers) to Meta via the Conversions API, we hash the information using SHA-256.

Meta's handling of this information is governed by its own privacy policy, available at facebook.com/privacy/policy. You can opt out of Meta's use of information for advertising by adjusting your ad preferences in your Facebook or Instagram account settings.

• Active client and business relationships: we retain contact and conversation data for the duration of the relationship and for a reasonable period afterward — typically up to 24 months — to support continuity and respond to billing or service questions.
• Marketing prospects: outreach contact information is retained for up to 24 months from the most recent interaction, unless you request earlier deletion.
• SMS opt-out flags: retained permanently. Carrier and TCR rules require us to honor opt-out requests indefinitely, so we keep just enough information (phone number and opt-out timestamp) to make sure we never message you again.
• Billing and tax records: retained for the period required by applicable law — typically seven (7) years in the United States.
• Analytics and usage data: retained in aggregated or anonymized form for up to twenty-six (26) months (the default Google Analytics retention period).

After the applicable retention period expires, we either delete or anonymize the information. If deletion is not technically feasible (for example, where information is stored in backups), we isolate the information and prevent further processing until deletion is possible.

We implement appropriate technical and organizational measures to protect personal information against unauthorized access, alteration, disclosure, and destruction, including:

• Encryption of data in transit using TLS 1.2 or higher.
• Encryption of sensitive data at rest where supported by our subprocessors.
• Access controls, authentication requirements, and the principle of least privilege for everyone with access to systems.
• Periodic review of subprocessor security practices and our own configurations.
• Secure software practices, including code review and dependency review for any first-party services we build.
• Incident response procedures and breach notification practices consistent with applicable law.

Despite these efforts, no security measure is perfect and no data transmission or storage method is 100% secure. If we discover a breach affecting your personal information, we will notify you and applicable regulatory authorities as required by law.

For users in the United States, we process personal information in reliance on our legitimate business interests (operating and improving our services, communicating with prospects and clients, securing our infrastructure), on your consent where you have given it, and as necessary to perform our contracts with clients and to comply with legal obligations.

For users in the European Economic Area, the United Kingdom, or Switzerland — if and when our services reach you — processing occurs under one or more of these GDPR bases:

• Performance of a contract — processing necessary to provide the services you have requested, or to take steps at your request before entering into a contract.
• Legitimate interests — analytics, fraud prevention, direct marketing to existing customers, and service communications, where these interests are not overridden by your rights and freedoms.
• Consent — where you have given specific, informed, and unambiguous consent. You may withdraw consent at any time.
• Legal obligation — where processing is necessary to comply with applicable law.

For specific processing activities and their legal basis, contact hello@upfloai.com.

Upflo AI is based in the United States. If you access the site or use our services from outside the United States, your information will be transferred to, stored in, and processed in the United States, where our core operations and most of our subprocessors are located. By using the site or services, you consent to this transfer.

For users in the European Economic Area, the United Kingdom, or Switzerland, the United States is not currently recognized by the European Commission as providing adequate data protection. Where we transfer personal information from these regions to the United States, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms. Copies of applicable safeguards may be requested by contacting hello@upfloai.com.

Depending on where you are located and the applicable law, you may have some or all of the following rights with respect to your personal information:

• Access — request a copy of the personal information we hold about you.
• Correction — request correction of inaccurate or incomplete information.
• Deletion — request deletion of your personal information, subject to certain exceptions.
• Portability — request your information in a structured, commonly used, machine-readable format.
• Restriction — request that we limit the processing of your information.
• Objection — object to certain types of processing, including direct marketing.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.
• Opt out of marketing — opt out of marketing emails by using the unsubscribe link in any email, and opt out of marketing SMS by replying STOP to any message.

To exercise any of these rights, email hello@upfloai.com with subject line "Privacy Request" describing what you want us to do. We will respond within thirty (30) days, or within the time required by applicable law, whichever is shorter. We may need to verify your identity before fulfilling a request to prevent disclosure to unauthorized parties.

We do not sell personal information, and we do not share it with third parties for cross-context behavioral advertising beyond what is disclosed in Section 06 and Section 08.

California residents have the following rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):

• Right to know — what categories of personal information we collect, the sources, the business or commercial purposes for collection, the categories of third parties with whom we share it, and the specific pieces of personal information we have collected.
• Right to delete — request deletion of personal information we have collected, subject to certain exceptions.
• Right to correct — request correction of inaccurate personal information.
• Right to opt out of sale or sharing — opt out of any sale or sharing of personal information. Upflo AI does not sell personal information for monetary consideration. Some advertising partners' cookies and pixels may constitute "sharing" for cross-context behavioral advertising under CPRA; you can opt out by adjusting your cookie preferences or by contacting hello@upfloai.com.
• Right to limit use of sensitive personal information — Upflo AI does not knowingly collect sensitive personal information for purposes beyond service provision.
• Right to non-discrimination — we will not deny services, charge different prices, or provide a different level or quality of service because you exercised a CCPA/CPRA right.

Categories of personal information collected

In the past twelve (12) months, we have collected the following categories of personal information about California residents:

• Identifiers (name, email address, phone number, IP address, account identifiers).
• Customer records (billing information, last four digits of payment card, where stored by our processor).
• Commercial information (records of services purchased, payment history).
• Internet or network activity (site browsing history, ad interactions).
• Geolocation data (approximate, IP-derived).
• Professional or employment-related information (job title, business name, service area).
• Inferences drawn from the above (preferences, characteristics).
• Communications content (email, text message, phone call records and notes, support tickets).

These categories are collected from the sources described in Section 02 and used for the purposes described in Section 03.

Exercising California rights

Email hello@upfloai.com with subject line "California Privacy Request" describing your request. We will respond within forty-five (45) days of receipt, with an additional forty-five (45) day extension if reasonably necessary. We may need to verify your identity. You may designate an authorized agent to make a request on your behalf by providing written proof of authorization signed by you.

Upflo AI is a business-to-business service and is not directed to individuals under the age of sixteen (16). We do not knowingly collect personal information from anyone under sixteen. If you believe a child has provided personal information to us, please contact hello@upfloai.com and we will delete it as soon as possible.

Our site and marketing materials may contain links to third-party websites, applications, and services that we do not operate or control. This Privacy Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy policy of any third-party site or service you visit.

We may update this policy from time to time as our services and the legal landscape evolve. The "Last updated" date at the top of this page reflects the most recent change. Material changes will be highlighted near the top of the policy when they are made and, for active clients, communicated by email or in-product notice.

Questions, concerns, or requests about this policy or about how we handle your information can be sent to the address below. We aim to respond within seven (7) business days.