Privacy Policy

1. Information We Collect

Account Information. When you create an account, we collect your name, email address, password (stored in hashed form), brokerage or company name, business type, and subscription plan selection.

Client Data. Account Users may store information about their clients and prospects in the Services, including names, contact information, property addresses, loan-related details, notes, documents, and communication logs. This data belongs to the Account User’s organization and is processed by us solely to provide the Services.

Documents Uploaded by Clients. When an Account User requests documents from a client, the client may upload files through a secure, expiring link. These files are stored in private, access-controlled storage and are accessible only to the requesting Account User’s organization.

Billing Information. Payments are processed by our payment processor. We do not store full payment card numbers. We retain subscription status, plan, and billing history.

Usage and Technical Information. We collect standard technical information such as log data, device and browser type, and error diagnostics (via our error monitoring provider, with personally identifiable information scrubbed).

2. Sensitive Information We Deliberately Do Not Store

Social Security Numbers are never stored. If an imported file (such as an industry-standard loan data file) contains a Social Security Number, it is stripped during import and never written to our systems. Raw import files are parsed against a strict allowlist of fields and are not retained.

We do not read email inboxes. Email integrations are send-and-log only (see Section 4).

3. How We Use Information

We use information to: provide, maintain, and improve the Services; authenticate users and secure accounts; process subscriptions and payments; send service-related communications; provide customer support; and comply with legal obligations. We do not sell personal information. We do not use Client Data for advertising.

4. Third-Party Integrations

The Services allow Account Users to connect third-party accounts. All connections are optional and authorized by the Account User via OAuth or similar mechanisms:

• Google (Calendar and Gmail). If connected, we access Google Calendar to provide two-way calendar synchronization, and Gmail solely to send emails the Account User composes and to log those sent emails. We do not read, retrieve, or analyze inbox contents. Marino Flow’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. See Section 5 for full details on how Google user data is handled, shared, and protected.
• Microsoft (Outlook Calendar and Mail). Same pattern as Google: two-way calendar sync and send-only email. We do not read inbox contents.
• Telecommunications provider. If connected, we synchronize the Account User’s business text-message conversations and enable calling and texting from within the Services. Disconnecting the integration deletes the synchronized messages from our systems.
• Property data providers. Property search and reporting features retrieve publicly available and licensed property information from third-party data providers. Search results may be cached temporarily to improve performance.
• Payment processing. Payments are handled by our payment processor. That provider’s handling of your payment information is governed by its own privacy policy.

Disconnecting an integration revokes our access and deletes associated synchronized data from our systems, as described in the product.

5. Google User Data

This section provides the specific disclosures required by Google regarding how we handle data obtained through Google API services.

What we access. When you connect your Google account, we access two things and only two things: (1) Google Calendar, to provide two-way calendar synchronization between Google Calendar and AgentFlow CRM; and (2) Gmail, solely to send emails you compose within the Services through your Gmail account. We never read, access, retrieve, or store the contents of your Gmail inbox, your received emails, or any message you did not compose and send through our Services.

How it is used. Google user data is used solely to provide the calendar synchronization and email sending features described above within AgentFlow CRM. It is not used for any other purpose.

Sharing, transfer, and disclosure. We share or disclose Google user data only in the following limited circumstances:

• Service providers. We may share Google user data with service providers acting on our behalf solely to operate and maintain the platform, including cloud hosting, database infrastructure, and error monitoring providers. These providers are bound by confidentiality obligations and are not permitted to use the data for any other purpose.
• Legal requirements. We may disclose Google user data if required by applicable law, regulation, court order, or other valid legal process.
• Business transfers. If Marino Flow is involved in a merger, acquisition, or sale of assets, Google user data may be transferred as part of that transaction. We will provide notice before your data becomes subject to a materially different privacy policy.

We do not sell Google user data. We do not share Google user data with advertisers or data brokers. We do not use Google user data for advertising of any kind.

AI and machine learning. Google user data is not used to develop, improve, or train generalized artificial intelligence or machine learning models.

Limited Use. Marino Flow’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Retention and deletion. When you disconnect your Google account, we immediately revoke our access and delete all calendar events imported from Google from our systems. Records of emails you composed and sent through the Services via Gmail remain in your AgentFlow CRM account as your business communication records, consistent with our general data retention practices in Section 7.

6. Data Isolation and Security

Client Data is isolated per organization: each organization’s data is segregated using database-level access controls (row-level security), and users can only access data belonging to their organization. Documents are stored in private storage buckets with short-lived, signed access URLs. Data is encrypted in transit. Access to production systems is restricted.

No method of transmission or storage is 100% secure; we cannot guarantee absolute security, but we work to protect your information using industry-standard practices.

7. Data Retention and Deletion

Account Users control their Client Data and may delete leads, documents, and other records at any time; deleted leads are recoverable from Trash for 30 days and then permanently purged. When an organization’s account is terminated, we delete or de-identify its data within a commercially reasonable period, except where retention is required by law. Expired or revoked client upload links cease to function immediately.

8. Your Rights

Depending on your location, you may have rights to access, correct, delete, or export your personal information. Account Users can exercise most of these directly in the product. Clients of our Account Users should direct requests to the brokerage or professional they work with, as that business controls their data; we will assist our Account Users in fulfilling such requests. You may also contact us directly at privacy@marinoflow.com.

9. Children

The Services are business tools intended for adults and are not directed to children under 18. We do not knowingly collect information from children.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via the Services or email. Continued use after changes take effect constitutes acceptance.

11. Contact

Marino Flow LLC · privacy@marinoflow.com · marinoflow.com