Privacy Policy

1. Who we are

SequenceFlow ("we", "us", "our") operates SequenceFlow Commerce Support at support.sequenceflow.io — an AI-powered customer support workspace that reads incoming customer emails, uses connected commerce context, generates AI draft replies, and lets your team approve and send them.

For questions about this policy, contact us at hallo@sequenceflow.io.

2. Data we collect

2.1 Account information

When you sign in via Google OAuth we receive your name, email address, and profile picture from Google. We store your email address and name to identify your account.

2.2 Email data

To provide the core service, incoming customer emails are imported into Support through your configured inbound setup, such as forwarding or IMAP mailbox access.

Your source mailbox remains untouched: Support reads and stores a service copy of incoming messages. It does not delete, move, archive, or otherwise remove the original customer email from Gmail, Hostinger, or another connected email provider.

What email data we receive: subject line, sender address, email body text, email thread headers (Message-ID, References), and customer-sent attachments when present.

What we do NOT do: We do not sell, rent, transfer, or share your email data with any third party for advertising, analytics, or any purpose beyond providing the Support service.

Sending replies with your Google account: When you choose "Sign in with Google" for your support mailbox, Support asks only for permission to send email on your behalf (gmail.send) and for your email address. It cannot read, search, change, or delete the email in your Gmail account; incoming email reaches Support through forwarding that you set up yourself. Support uses this access only to send the replies you approve (or that you allowed to be sent automatically) and the test emails you request. The access token is stored encrypted, and you can disconnect at any time in Support or in your Google Account settings, which revokes it immediately.

Support's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use this data for advertising, do not sell it, do not let people read it except for security, legal compliance, or with your consent, and do not use it to train AI models.

2.3 Commerce integration data

When an organisation connects bol.com or another supported commerce provider, Support retrieves only the order, item, offer, stock, shipment, tracking, and return fields needed to answer a support case. We do not retain full provider API responses or unnecessary customer details. Customer email addresses used for order matching are converted into a tenant-specific pseudonymous key.

The bol.com integration uses merchant-created client credentials and is read-only in its current version. Support stores provider credentials and webhook secrets encrypted. Previously configured WooCommerce connections remain operationally paused unless explicitly re-enabled in a later product version.

2.4 Shopify app

When a merchant installs the SequenceFlow Support app from Shopify, Support requests read-only access to orders (read_orders) and the customer email field. It uses this only to show the matching order next to a customer question and to prepare a reply for human review. Support cannot change, cancel, or refund orders.

Shopify access tokens are stored encrypted, expire automatically, and are revoked when the app is uninstalled. Order data is fetched from Shopify when needed and kept as a cache next to the support case; it is deleted together with the case, at the latest 90 days after the case is closed. Support processes Shopify's mandatory privacy requests: customer data requests are answered to the store, customer redaction requests delete that customer's Shopify order data (and, for a workspace created for the store, the related support conversations), and shop redaction requests delete the store's data 48 hours after uninstall.

2.5 AI processing

Email content (subject and body text) is sent to OpenAI's API to generate a suggested reply. OpenAI processes this under their API data usage policy. Data submitted via the API is not used to train OpenAI models.

For customer pain-point analysis, source text is stripped of reply history, signatures, personal data, and order references before processing. Support stores only quote-free aggregate findings, not the sampled source messages.

Ask Support receives aggregate support, analytics, knowledge, answer-style, and commerce context for read-only operational questions. It does not receive raw customer messages in its operational snapshot and cannot change orders, returns, shipments, stock, email, or configuration.

2.6 Usage and attribution data

We log service metadata such as the number of emails processed, response latency, routing decisions, and outcomes for reliability, billing limits, and product improvement. These event logs do not contain email subjects, bodies, or draft replies.

On our public website we record first-party campaign parameters, advertising click identifiers, landing-page visits, and button clicks so we can measure which campaigns lead to sign-ups. We do not build cross-site profiles or send this information to advertising platforms through pixels.

2.6 Billing data

Payments are processed by Stripe. We do not store credit card numbers. Stripe shares with us only your subscription status and customer ID.

3. How we use your data

• To receive incoming customer emails forwarded to your unique Support address and generate AI draft replies
• To create and send email replies on your behalf when you approve them
• To display email threads, drafts, and analytics in the Support dashboard
• To match support cases to current commerce orders and execute an order action only after an authorised administrator approves it
• To operate the service, process payments, and send transactional notifications
• To diagnose errors and improve service reliability

We use your data only for these stated purposes. Email data is never used for advertising or shared with third parties for their own use.

4. Data protection mechanisms

We take the following technical and organisational measures to protect account and customer-support data:

• Encryption in transit: Data is transmitted over encrypted connections such as HTTPS/TLS, IMAPS, and SMTP with TLS where supported by your mail provider.
• Encryption at rest: Data is stored in Supabase (hosted on AWS), which encrypts data at rest using AES-256.
• Credential security: Mailbox and SMTP credentials are handled by server-side processes and are not returned to browser clients after configuration.
• Commerce credential security: Commerce API secrets and webhook secrets are encrypted with authenticated AES-256-GCM encryption, handled server-side, excluded from application logs, and never returned to the browser.
• Tenant isolation: Each customer's data is isolated by tenant ID. Row-Level Security (RLS) policies in our database prevent any cross-tenant data access. Only authenticated users belonging to your organisation can access your data.
• Minimal Google access: Google OAuth is used for account authentication. Support does not request Google Drive, Calendar, or Gmail mailbox access through Google OAuth.
• Limited retention: Email content and customer-sent attachments are stored only to enable the reply workflow. Support's stored copy of handled and archived tickets is automatically removed after 90 days. This never removes the original message from your email provider.
• Restricted access: Production access is limited to authorised personnel who need it for security, incident response, or support, and to the automated systems that operate the service.

5. Data retention

• Email content / tickets: Open, review, and scheduled drafts are retained while they need action. Support's imported copy of handled and archived tickets and customer-sent attachments is automatically deleted after 90 days. Locally marked spam is deleted after 30 days. You can keep a ticket longer or permanently delete it earlier from Archive or Spam. The original provider email remains untouched.
• Spam and AI usage metadata: Pseudonymous spam feedback, model usage, waivers, and refund events are retained for up to 24 months to improve filtering, prevent billing abuse, and keep usage calculations auditable. These records do not retain the full email body.
• Pseudonymous case memory: Before a handled ticket expires, Support may preserve a quote-free structured summary linked to a tenant-specific customer key. Case memories, decision and outcome metadata, and sanitised commerce audit events are retained for no more than 24 months.
• Aggregate pain-point analyses: Quote-free aggregate findings and their sample counts are retained for no more than 24 months.
• Commerce data: Normalised order context is retained while the integration and related cases require it. Disconnecting the store removes encrypted credentials and synchronised order data, then stops sync and actions. Quote-free pseudonymous case memory and decision, outcome, and sanitised audit metadata may remain for up to 24 months; account deletion removes the tenant's remaining commerce data.
• Ignored senders: An organisation administrator may store an exact sender email address to prevent future mail from creating inbox tickets or AI drafts. These addresses remain until an administrator removes them in Settings or the account is deleted.
• Mailbox credentials: Retained while the relevant IMAP or SMTP integration is active and removed when that integration is disconnected.
• Account data: Retained while your account is active. Verified deletion requests are completed within 30 days, except where legal obligations require limited records to be kept longer.
• Usage logs: Retained for 90 days for debugging purposes, then automatically deleted.

6. Third-party processors

We share data with the following sub-processors to operate the service:

We do not allow these processors to use customer-support data for their own advertising or unrelated purposes.

7. Google sign-in

Google OAuth is used to authenticate your account. We receive the basic profile information described in section 2.1 and use it only to create, secure, and display your Support account. We do not use Google account data for advertising or credit decisions.

8. Your rights

• Access: Request a copy of the personal data we hold about you.
• Deletion: Request deletion of your account and all associated data by emailing hallo@sequenceflow.io.
• Withdraw integrations: Disconnect IMAP, SMTP, or commerce access in Settings → Integrations and remove any forwarding rule at your mail provider to stop new processing. Commerce disconnect removes stored credentials and registered webhooks where the provider permits it.
• Data portability: Request an export of your data in a machine-readable format.
• Correction: Request correction of inaccurate personal data.

To exercise any of these rights, email hallo@sequenceflow.io. We will respond within 30 days.

9. Cookies

We use essential authentication cookies and a first-party attribution cookie that remembers the campaign and landing page associated with a visit for up to 30 days. This cookie supports our own sign-up measurement; it is not used for cross-site tracking or advertising profiles.

10. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email or by displaying a notice in the app. Continued use of the service after changes constitutes acceptance of the updated policy.

11. Contact

For privacy questions or to exercise your rights: