Privacy Policy
Last updated: September 24, 2026
1. Data Controller
customrflow
BURD digital solutions and consulting LLC
1309 Coffeen Avenue STE 1200
Sheridan, Wyoming 82801, USA
Email: info@customrflow.com
Website: https://customrflow.com
2. Overview of Processed Data
In the course of using our platform, we process various categories of personal data:
Account Data
- Name, email address
- Password (hashed)
- Company information
- Location data
CRM Data
- Contact details (name, email, phone)
- Addresses
- Custom fields
- Communication history
Appointment Booking Data
- Appointment details and times
- Staff assignments
- Calendar synchronization data
- Booking form entries
Marketing & Analytics Data
- UTM parameters and campaign data
- Lead sources and attributions
- Email marketing interactions
- Conversion tracking data
Integration Data
- Meta (Facebook/Instagram) page data
- Google Calendar tokens
- Stripe payment data
- Third-party API connections
Form & Website Data
- Form submissions
- Website visitor data
- Uploaded files and media
- Chat and conversation data
3. Legal Basis
The processing of personal data is carried out on the following legal bases under Art. 6 GDPR:
- Art. 6(1)(a) GDPR (Consent): When you have given us your explicit consent for processing, e.g. for marketing emails or the use of certain integrations.
- Art. 6(1)(b) GDPR (Contractual Performance): When processing is necessary for the performance of our terms of use, e.g. for providing CRM, scheduling, or POS features.
- Art. 6(1)(c) GDPR (Legal Obligation): When we are legally obligated to process data, e.g. for tax retention requirements.
- Art. 6(1)(f) GDPR (Legitimate Interest): When processing is necessary for our legitimate interests, e.g. for security measures or improving our services.
4. Google Integrations
Customrflow only connects to the Google services you enable yourself. Every connection is optional and can be revoked individually. The table below lists every OAuth scope we request, in full.
| OAuth scope | What it is used for | Data processed |
|---|---|---|
calendar.events | Write appointments into the calendar you selected and read changes back | Title, time period, description, attendees, change notifications |
calendar.calendarlist.readonly | List your calendars when connecting | Calendar name, ID and colour |
calendar.events.freebusy | Availability for booking pages | Busy time ranges, no event contents |
userinfo.email | Associate the connection with your Google account | Email address of the connected account |
adwords | List ad accounts, read costs and conversion actions, and on your instruction write audience lists and offline conversions | Account, campaign and ad data, costs, click IDs, hashed email addresses and phone numbers |
datamanager | Report conversions to your own conversion action | Click ID, timestamp, value, hashed email address or phone number, consent state |
spreadsheets | Append rows to a Google Sheet you selected | The column values you configure in the automation step |
drive.file | Select exactly the spreadsheet you click in the Google Picker | ID and name of the selected file |
business.manage | Read and reply to reviews of your Google Business Profile | Reviews, replies, location data |
How we use the data
We use Google user data solely to provide the features you have enabled in Customrflow and that are visible there. We do not sell this data, do not pass it to third parties for advertising purposes, and do not use it to train AI models. Humans read it only when you explicitly ask us to, when it serves security purposes, or when we are legally required to.
AI processing and Limited Use
Google user data is not used to train or improve AI models, nor passed to third parties for that purpose. Content from Google Sheets never reaches an AI service — that path only writes. Appointment data may be sent to an AI provider on your explicit action, for example the AI agenda for an appointment; for this we use API tiers only, which do not use submitted data for model training. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.
Narrower permissions wherever they suffice
For availability we use calendar.events.freebusy instead of full calendar access. To select a spreadsheet we use the Google Picker with drive.file, which gives us access to the single file you clicked — not to the rest of your Drive.
Token storage
OAuth access and refresh tokens are stored encrypted with AES-256-GCM in our database and automatically renewed. When a connection is revoked, all tokens and synchronization data are deleted.
Revocation
You can disconnect any Google connection at any time in the settings of the respective integration. You can additionally revoke access in your Google account.
5. Third-Party Integrations
Our platform can be connected with the following third-party providers:
| Provider | Purpose | Data Types |
|---|---|---|
| Meta (Facebook/Instagram) | Lead forms, ad campaigns, page management | Lead data, campaign metrics, page insights |
| TikTok | Lead generation, campaign analysis | Lead data, campaign metrics |
| Stripe | Payment processing | Transaction data, payment status |
The Google services are not listed in this table but in section 4, where every single OAuth scope is listed with its purpose and the data processed.
6. Email Notifications
We send emails for the following purposes:
- Appointment confirmations and reminders
- POS receipts and invoices
- Account notifications (password reset, invitations)
- Marketing emails (only with explicit consent)
- System and security notifications
7. Data Security
We implement comprehensive technical and organizational measures:
- Encryption: Passwords are hashed with bcrypt; sensitive tokens are stored encrypted.
- Transport: All data transfers are conducted via TLS/SSL (HTTPS).
- Authentication: JWT-based authentication with secure token lifetimes.
- CSRF Protection: Protection against cross-site request forgery attacks.
- Access Control: Role-based access control with location isolation.
- Audit: Logging of security-relevant actions.
- Token Management: OAuth tokens are stored encrypted and automatically refreshed as needed.
8. Cookies and Tracking
Our platform uses technically necessary cookies for authentication and session management. These cookies are essential for the operation of the platform and cannot be disabled.
Additional tracking cookies (e.g. for analytics or marketing) are only set with your explicit consent. You can adjust your cookie settings at any time in your account settings.
9. Data Retention
We store your data only as long as necessary for the respective purposes:
- Account Data: Until deletion of your account.
- CRM & Business Data: In accordance with statutory retention periods (up to 10 years for tax-relevant data).
- Marketing Data: Until withdrawal of consent.
- Log Data: Maximum 90 days for security logs.
- Integration Tokens: Until disconnection of the integration.
10. Your Rights
As a data subject, you have the following rights under the GDPR:
Right of Access
Art. 15 GDPR — You may request information about your stored data.
Right to Rectification
Art. 16 GDPR — You may request correction of inaccurate data.
Right to Erasure
Art. 17 GDPR — You may request deletion of your data.
Right to Restriction
Art. 18 GDPR — You may request restriction of processing.
Right to Data Portability
Art. 20 GDPR — You may receive your data in a common format.
Right to Object
Art. 21 GDPR — You may object to the processing of your data.
To exercise your rights, contact us at: info@customrflow.com
11. Data Processing Agreements
Where we process data on behalf of our users (e.g. CRM contact data, customer appointments), we act as a data processor in accordance with Art. 28 GDPR. We enter into appropriate data processing agreements (DPAs) with our business customers that ensure data security and GDPR compliance.
12. International Data Transfers
Our company is headquartered in the USA (Wyoming). Servers and infrastructure may be located in various jurisdictions. When transferring personal data from the EEA, we ensure an adequate level of data protection through appropriate safeguards (e.g. Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR).
13. Changes
We reserve the right to update this privacy policy as needed to adapt to changes in legislation or our services. The current version is always available on this page. For material changes, we will notify you via email or through the platform.
Additional legal information: Terms of Use · Meta Privacy Policy