Privacy Policy
Overview
OctoFlow is built by salespeople, for salespeople. The Service consists of the OctoFlow Chrome extension and the companion web app at app.octoflowus.com; both use the same account and the same database, and this policy covers both. We collect the minimum data needed to run the Service and never sell your personal information. This policy explains what we collect, why, who else handles it on our behalf, and how you can control it. If you have questions after reading this, email support@octoflowus.com.
Minimum Age
OctoFlow is intended for use by adults engaged in professional sales activity. You must be 18 years or older to create an account or use the Service. We do not knowingly collect personal information from anyone under 18. If you become aware that a minor has created an account, contact support@octoflowus.com and we will delete the account and associated data.
What We Collect
We collect only what is needed to operate the Service. The table below enumerates every category of data OctoFlow processes. We do not collect: your CRM passwords, the contents of emails or messages outside of what you explicitly log inside OctoFlow, or your browsing history. The extension reads a web page in exactly one case: the optional LinkedIn profile scan described in the Optional Integrations section, which runs only when you click Scan on a profile you are viewing and only if you granted the permission.
How We Use It
We use your data to: provide and improve the Service, send transactional emails (verification, password reset, support replies), respond to support requests, and aggregate anonymized usage patterns to understand how the product is used. We do not use your data to train machine-learning models or for advertising.
Service Providers (Sub-Processors)
We use the following service providers to deliver the Service. Each is a contractually-bound data processor and only handles data necessary for their function:
Public Profile
OctoFlow includes a social feature called the Arena: a weekly leaderboard and chat channel visible to all signed-in users. When you use OctoFlow, the following information is visible to other authenticated users: your Arena display name (you choose this, it does not have to be your real name), your weekly counts of logged activities and XP, your level, and any chat messages you send in the Arena. Your email address, prospects, notes, and pipeline data are never visible to other users.
Optional Integrations & Site Access
OctoFlow ships with no standing access to any website and never reads pages in the background. Three optional integrations exist, all off by default and all activated only by you. Salesforce sync. You may connect your own Salesforce user by signing in to Salesforce and allowing OctoFlow. The grant covers API access and a refresh token only, the token is stored server side in your own private account record where no client can read it, and it is used only by OctoFlow's server functions. At your request, account and contact names sync from Salesforce into your maps, activity you log posts to the matching Salesforce contact as a Task or Event owned by you, and if you leave the create option on, accounts and contacts you add in OctoFlow are also created in Salesforce. Separate toggles turn the push and the create off, and Disconnect revokes the grant at Salesforce. HubSpot sync: you may connect your own HubSpot portal by creating a HubSpot Private App key limited to five scopes (contacts read and write, companies read and write, owners read) and pasting it into OctoFlow. The owners read scope is used for one thing only: marking activity you log as assigned to you inside your own HubSpot reports. The key is stored in your own private cloud record, readable only by your signed-in account, and is used only by OctoFlow's server functions; it is never shown to other users or web pages. At your request, company and contact names sync from your HubSpot into your maps, and activity you log posts to the matching HubSpot contact timelines; if you leave the create option on, accounts and contacts you add in OctoFlow are also created in your HubSpot. Separate toggles turn the push and the create off, and you can disconnect and delete the key at any time. LinkedIn profile scan: a Scan button in the Add Contact form can fill in a contact's name, role, and profile link from the LinkedIn profile you have open. The first click asks for a Chrome permission scoped to linkedin.com only; the scan then reads that one page, once, at the moment you click, and only information visible on your screen. There is no automation of any kind: OctoFlow never visits pages by itself, never sends connection requests or messages, and caps scans at ten per day. You can revoke the LinkedIn permission at any time from Chrome's extensions page. Email integration: you may connect the Gmail or Outlook account you already use, through the standard Google or Microsoft sign in window. It is off by default and OctoFlow touches no mail of any kind until you connect it. For Google, OctoFlow requests exactly three scopes: gmail.metadata (message headers only; Google's own servers enforce this scope and refuse to return message bodies or attachments under it), gmail.send (used only to send email you composed in OctoFlow, whether you click Send yourself or schedule an OctoMail campaign; the email goes out from your own address through Google's API, with no relay in between), and your basic email address (to show which account is connected). For Microsoft, the equivalent Graph scopes are Mail.Read, Mail.Send, User.Read, and offline_access. The integration reads headers of recent sent and received mail to log touches with contacts you already track and to detect replies that pause your outreach sequences; it stores the subject line of matched emails on that contact's timeline in your own account record, along with the full text of emails you compose and send inside OctoFlow and, for Outlook connections, the full text of emails you send from your own mailbox to contacts you track (Gmail's metadata scope does not permit reading message bodies, so bodies of mail sent outside OctoFlow are never read from Gmail). When you connect from the extension, a sign in token is stored in your browser's local extension storage. When you connect from the web app, or turn on cloud sending for OctoMail, a refresh token is stored server side in your own private account record, readable only by OctoFlow's server functions and never by any browser session, so the extension can obtain short lived access tokens and scheduled campaigns can send while your browser is closed. Disconnecting, or turning cloud sending off, deletes it. Emails you send through OctoFlow (OctoMail campaigns, sequence steps, and emails composed on a contact card) include a one pixel open notification image that reports to OctoFlow when the message is opened, so you can see opens on your own outreach; this applies only to mail you send, and OctoFlow never adds anything to mail you receive or reads receipts on it. Links in emails you send through OctoFlow are rewritten to pass through OctoFlow's own address first: when the reader clicks, OctoFlow records the time and which link, then sends them straight to the original destination. Nothing about the reader's device or identity is kept beyond that click record. A small companion script runs on mail.google.com only, showing a connection badge in the Gmail compose window; it reads nothing from the page and transmits nothing. You can disconnect in Settings at any time (which deletes the tokens), and you can additionally revoke OctoFlow's access from your Google Account permissions page or your Microsoft account consent page. OctoFlow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Historical note: as of version 1.5.7 (July 2026) the earlier URL-pattern CRM page detection and its permissions were removed entirely; no CRM page contents or credentials were ever read or transmitted.
Data Sharing
We share personal data only with: (a) the service providers listed in §05 above, who act as our processors under contract; (b) law-enforcement or government authorities when required by a valid legal request; and (c) parties you explicitly direct us to share with (for example, by configuring a Slack webhook in your settings, which sends outbound activity summaries to that Slack workspace, or by connecting HubSpot, which sends the activity you log to your own HubSpot portal). We do not sell, rent, or trade your personal data.
International Data Transfers
OctoFlow's infrastructure runs in the United States. If you access the Service from outside the United States, you understand and consent to the transfer, processing, and storage of your data in the United States. Where required (for example for EU/EEA users), we rely on Standard Contractual Clauses or equivalent transfer mechanisms put in place by our service providers (Google, Resend, Vercel).
Legal Basis for Processing (GDPR)
If you are in the EU/EEA, UK, or Switzerland, our legal bases for processing your data are: (a) performance of the contract you enter into by accepting the Terms of Service when creating an account; (b) our legitimate interests in operating, securing, and improving the Service; (c) compliance with legal obligations; and (d) your consent where required (for example, marketing communications, which we do not currently send).
Your Rights
You have the right to: access a copy of the personal data we hold about you, correct inaccurate information, delete your account and associated data (available in Settings inside the extension or the web app; deletion also removes any stored integration keys), export your activity log, restrict or object to certain processing, and (for EU/UK/Swiss users) lodge a complaint with your local data-protection supervisory authority. To exercise any of these rights, use Settings → Delete My Account in the extension or at app.octoflowus.com, or email support@octoflowus.com. We respond within 30 days.
California Residents (CCPA / CPRA)
California residents have specific rights under the California Consumer Privacy Act and California Privacy Rights Act: the right to know what categories of personal information we collect and the categories of third parties we share it with (see §03 and §05 above), the right to delete personal information (see §11), the right to correct inaccurate information, and the right to non-discrimination for exercising any of these rights. We do not "sell" personal information as defined by the CCPA, and we have not sold or shared personal information for cross-context behavioral advertising in the preceding 12 months.
Children's Privacy
OctoFlow is not directed to children. We do not knowingly collect personal information from children under 13 (or under 16 in EU/EEA jurisdictions). The Service requires users to confirm they are 18 or older at signup. If we learn that a child has provided us with personal information, we will delete it immediately. Parents who believe their child has created an account can request deletion at support@octoflowus.com.
Data Retention
Active account data is retained for the life of your account. When you delete your account, personal data is removed from active systems within 30 days and from backups within 90 days. Anonymized, aggregated usage data may be retained indefinitely. Specific retention windows per data category are listed in the table in §03.
Security & Breach Notification
We use industry-standard security practices: encryption in transit (TLS 1.2+), Firebase-managed encryption at rest, password hashing (scrypt) handled by Firebase Authentication, scoped service-account credentials, per-user access controls in Firestore Security Rules, rate-limiting on public endpoints, and least-privilege IAM. No system is perfectly secure. In the event of a security incident affecting your data, we will notify affected users by email within 72 hours of confirming the incident, in line with GDPR Article 33.
Storage Technology
OctoFlow does not use traditional browser cookies for tracking. The extension stores account state in chrome.storage.local (a Chrome-managed sandboxed key-value store), and Firebase Authentication uses IndexedDB to maintain your session between visits. Neither mechanism is shared with third-party advertisers or analytics platforms. One exception applies on our own website: if you arrive at octoflowus.com from a link in an email sent through OctoFlow, the site stores a short token in your browser for 30 days and reports the pages you view on octoflowus.com to the sender's OctoFlow account, so they can see which pages you read. The token identifies the email, not you, and nothing else about you is collected; clearing your browser storage ends it. Companies that use OctoFlow may install the same tracker on their own websites; page views there are reported to that company's OctoFlow account under the same rules, and that company is responsible for disclosing it to its visitors. The OctoFlow extension never injects tracking code or pixels into pages you visit; the only page scripts it ever runs are the one-time LinkedIn profile read described in §07, triggered by your click and covered by the permission you grant, and the Gmail compose badge described in §07, which displays a connection indicator on mail.google.com and reads nothing from the page. If you press play on the product tour video embedded on octoflowus.com, YouTube's privacy enhanced player loads and Google may store data in your browser under its own policy; nothing from YouTube loads before that click.
Changes to This Policy
We will notify you of material changes to this policy via in-product notice and (for accounts with verified email addresses) via email, at least 14 days before they take effect. Continued use of the Service after that date constitutes acceptance. Older versions of this policy are available on request at support@octoflowus.com. Last updated: September 20, 2026.
Contact
The Service is operated by OctoFlow LLC, Denver, Colorado, United States, which is the data controller for the personal information described in this policy. Questions about this Privacy Policy or data-rights requests should be directed to support@octoflowus.com. We respond to all data-rights requests within 30 days.