Privacy Policy

Who we are

Boaflow (“Boaflow”, “we”, “us”, or “our”) provides an AI-powered lead-discovery platform that helps businesses find, qualify, and reach potential customers. This Privacy Policy applies to our website, applications, and related services (together, the “Service”).

For the personal data we process about our account holders and the people who use the Service, Boaflow acts as a data controller. For business and contact data you discover, import, or process through the Service for your own outreach, you are the controller and Boaflow acts as your processor under your instructions.

Information we collect

We collect the following categories of information so we can operate, secure, and improve the Service:

• Account information — your name, email address, password or authentication credentials, organization name, role, and workspace settings.
• Billing information — your subscription plan, billing contact, and payment status. Card payments are processed by our payment provider (Stripe); we do not store full card numbers on our servers.
• Usage data — searches you run, leads you view or export, features you use, and similar product interactions, used to provide and improve the Service.
• Device and log data — IP address, browser type, device identifiers, timestamps, and diagnostic logs collected automatically when you use the Service.
• Communications — messages you send to support, feedback, and your communication preferences.
• Cookies and similar technologies — used to keep you signed in, remember preferences, and understand aggregate usage. See “Cookies and tracking” below.

How we use your information

We use the information we collect to:

• Provide and operate the Service — running lead-discovery searches, qualifying businesses, and delivering results to your workspace.
• Process payments, manage your subscription and trial, and send service-related communications such as receipts and security notices.
• Maintain, secure, and improve the product, including diagnosing issues, preventing fraud and abuse, and developing new features.
• Provide customer support and respond to your requests.
• Comply with legal obligations and enforce our Terms of Service.
• Send product updates or marketing where permitted; you can opt out of marketing at any time.

Legal bases for processing

Where the GDPR or similar laws apply, we rely on the following legal bases: performance of our contract with you (to provide the Service); our legitimate interests (to secure, improve, and market the Service in a way that respects your rights); your consent (where required, for example certain cookies or marketing); and compliance with legal obligations.

Where we rely on consent, you may withdraw it at any time without affecting processing that already took place.

Data about businesses and leads

The Service surfaces information about businesses and professional contacts from public sources — such as Google Maps, Yelp, and publicly accessible web pages — to support legitimate business-to-business outreach.

When you use the Service to discover, store, or contact leads, you are responsible for ensuring your use complies with applicable laws, including anti-spam, electronic-marketing, and data-protection regulations in the jurisdictions you operate in and target. You must honor opt-out and deletion requests you receive from the people you contact.

Sharing and disclosure

We share information only as described below. We do not sell your personal information.

• Service providers (subprocessors) — vendors that help us run the Service, such as cloud hosting, payment processing (Stripe), analytics, and email delivery, under contracts that require them to protect your data and use it only for the services they provide to us.
• Legal and safety — where we reasonably believe disclosure is required by law, regulation, legal process, or to protect the rights, property, or safety of Boaflow, our users, or the public.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, in which case we will continue to protect your information and notify you of any change in control or applicable policy.
• With your direction — when you choose to share or export data, or connect a third-party integration.

International data transfers

We may process and store information in countries other than where you live. Where we transfer personal data internationally, we use appropriate safeguards — such as standard contractual clauses or transfers to jurisdictions recognized as providing adequate protection — as required by applicable law.

Data retention

We retain personal data for as long as your account is active or as needed to provide the Service, and afterwards only as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

When data is no longer needed, we delete it or anonymize it. You can request deletion of your account data as described under “Your rights.”

Security

We use industry-standard administrative, technical, and organizational safeguards — including encryption in transit, access controls, and least-privilege practices — to protect information in our care.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

Your rights and choices

Depending on where you live, you may have rights to access, correct, export, restrict, or delete your personal data, to object to certain processing, and to withdraw consent. To exercise these rights, contact us using the details below; we may need to verify your identity before responding.

You can also update most account information in your settings, close your account from your organization settings, and opt out of marketing emails using the unsubscribe link. We will not discriminate against you for exercising your privacy rights.

Cookies and tracking

We use strictly necessary cookies to keep you signed in and secure the Service, and — where permitted — analytics cookies to understand aggregate usage. You can control non-essential cookies through your browser settings or any cookie controls we provide. Disabling some cookies may affect how the Service works.

Children’s privacy

The Service is intended for business use by adults and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you through the Service or by email. Your continued use of the Service after an update means you accept the revised policy.

Contact us

Questions about this privacy policy, or want to exercise a right described above? Email sawyer@boaflow.co and we'll respond as soon as we can.