Privacy Policy

1. What ON.FLOW CRM Does

ON.FLOW CRM is a private business workspace for managing clients, leads, sales opportunities, proposals, contracts, production tasks, financial records, meetings and operational history.

2. Information We Collect

• Account information, such as name, email address, role and access permissions.
• CRM records entered by users, such as clients, companies, opportunities, proposals, contracts, tasks and finance records.
• Technical information needed to operate and secure the service, such as authentication tokens, timestamps and audit logs.
• Google Account information only when a user chooses to connect a Google Account.

3. Google User Data Accessed by ON.FLOW CRM

Google integrations are optional. ON.FLOW CRM only accesses Google user data after the user clicks to connect a Google Account and approves the requested OAuth scopes on Google's consent screen.

• Google account profile and email address, used to show which account is connected.
• Google Calendar permission, used to create, update and manage meetings requested by the user from the CRM.
• Gmail read-only access, used to synchronize email metadata and snippets related to CRM contacts when the user requests synchronization.
• Google Drive and Google Sheets scopes, used to support file and spreadsheet workflows when enabled by the user or administrator.

For Gmail, ON.FLOW CRM stores message metadata such as sender, recipients, CC, subject, date, direction, message identifiers and snippets. ON.FLOW CRM does not use Gmail data for advertising.

4. How We Use Google User Data

• To connect a user account to the correct Google Account.
• To create meetings in Google Calendar and send calendar invitations to selected attendees.
• To display communication history related to CRM contacts, opportunities or client records.
• To support Drive or Sheets workflows selected by the user or administrator.
• To troubleshoot, secure and maintain the integration.

5. Sharing and Disclosure

ON.FLOW CRM does not sell Google user data or CRM data. Google user data is not transferred to third parties except when necessary to provide the requested functionality, maintain secure infrastructure, comply with law, or process data through service providers acting on our behalf.

6. Data Protection

• Google OAuth tokens are stored encrypted on the server.
• Role-based permissions restrict access inside the CRM.
• Audit logs and access controls are used to support accountability.
• API access is protected by authentication, scopes and rate limiting where applicable.

7. Retention and Deletion

Google integration data is retained while the user keeps the integration connected or while it is needed to provide CRM history and operational context. Users may disconnect their Google Account inside ON.FLOW CRM. When disconnected, stored OAuth tokens are deleted or invalidated.

Users may also revoke ON.FLOW CRM access at any time from their Google Account security settings. Calendar events created in Google Calendar remain subject to the user's Google Calendar controls.

8. User Choices

• Users can choose whether to connect a Google Account.
• Users can disconnect Google integrations from the account settings page.
• Users can request correction or deletion of data, subject to operational and legal requirements.

9. Limited Use Disclosure

ON.FLOW CRM's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

10. Contact

For privacy questions or requests, contact the ON.FLOW Studio administrator using the contact email configured in the Google OAuth consent screen.