Privacy Policy

1. Introduction

PyraFlow Inc. (“PyraFlow”, “we”, “us”, or “our”) operates the PyraFlow AI platform accessible at pyraflow.ai and app.pyraflow.ai (the “Service”). This Privacy Policy explains what information we collect, how we use it, with whom we share it, and the choices you have.

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of the Service.

2. Information We Collect

2.1 Account Information

When you create an account — whether directly or via a third-party login (Google, Meta) — we collect:

• Name and email address
• Profile picture (if provided by the OAuth provider)
• OAuth tokens and scopes granted by you
• Account preferences and settings

2.2 Usage and Agent Data

As you use the Service we collect information about how you interact with it:

• Agent configurations, instructions, and schedules you create
• Content generated by or sent to your AI agents (messages, summaries, task outputs)
• Feature usage, clicks, and navigation paths
• Log data: IP address, browser type, pages visited, timestamps

2.3 Integrated Platform Data

When you connect third-party accounts (e.g., Google Gmail, Google Calendar, Meta/Instagram), we access only the specific scopes you authorize. This may include emails, calendar events, or social media content necessary to complete the tasks your agents are configured to perform. We do not access data beyond the granted scopes.

2.4 Payment Information

Billing is processed by our payment provider (Stripe). We do not store full credit card numbers or CVV codes. We retain billing records such as your plan, invoice amounts, and transaction IDs.

2.5 Cookies and Tracking

We use cookies and similar technologies for authentication sessions, analytics, and feature performance. You can control cookie preferences through your browser settings; disabling certain cookies may affect Service functionality.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Service
• Authenticate your identity and secure your account
• Execute the tasks and workflows you configure your AI agents to perform
• Send transactional emails (account confirmations, billing receipts, security alerts)
• Send product updates and marketing emails (you may opt out at any time)
• Analyze aggregate usage patterns to improve features
• Comply with legal obligations and enforce our Terms of Service

We do not sell your personal data to third parties. We do not use your data to train AI models without explicit consent.

4. Sharing of Information

We share data only in the following circumstances:

4.1 Service Providers

We engage trusted vendors to help operate the Service. These sub-processors may receive your data solely to perform services on our behalf:

• OpenAI — AI inference for agent reasoning and task execution
• Amazon Web Services (AWS) — cloud hosting, storage, and compute
• Cloudflare — CDN, DDoS protection, and DNS
• Stripe — payment processing
• Google Analytics — anonymous usage analytics

All sub-processors are contractually bound to protect your data.

4.2 Legal Requirements

We may disclose your information if required by law, court order, or governmental authority, or to protect the rights, property, or safety of PyraFlow, our users, or the public.

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website before your data becomes subject to a different privacy policy.

5. Google API Services

PyraFlow’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only request Google account scopes necessary to complete the tasks you configure.
• Data obtained from Google APIs is not used to serve advertisements, is not transferred to third parties for advertising purposes, and is not used to train AI models.
• We only transfer Google user data to sub-processors that are necessary to provide the Service.
• You may revoke Google permissions at any time via your Google Account security settings.

6. Meta (Facebook / Instagram) Permissions

When you connect a Meta account, PyraFlow requests only the permissions required for the specific agent tasks you enable (e.g., reading or publishing content to Instagram). We handle Meta user data in compliance with the Meta Platform Terms and Meta Developer Policies. We do not share, sell, or use Meta data for advertising or model training purposes. You may disconnect your Meta account from the Service at any time in your account settings.

7. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. You may request deletion of your account and associated data at any time (see Section 8). Following deletion, we may retain anonymized aggregate data and records required for legal or compliance purposes for up to 7 years.

8. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate data
• Deletion — request deletion of your personal data (“right to be forgotten”)
• Portability — receive your data in a structured, machine-readable format
• Objection / Restriction — object to or restrict certain processing activities
• Withdraw consent — revoke any previously granted consent at any time

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

9. Security

We implement industry-standard technical and organizational measures to protect your data, including encryption in transit (TLS 1.2+), encryption at rest, access controls, and regular security reviews. No method of transmission over the Internet is 100% secure; we cannot guarantee absolute security, but we take reasonable precautions and will notify you promptly of any breach as required by law.

10. Children’s Privacy

The Service is not directed to children under 13 (or under 16 in the EU). We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will delete it promptly. Contact us at [email protected] if you believe we have inadvertently collected data from a child.

11. International Transfers

PyraFlow is based in the United States. If you access the Service from outside the US, your data may be transferred to and processed in the US and other countries where our sub-processors operate. We use appropriate safeguards (such as Standard Contractual Clauses) where required by applicable law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by a notice on the Service at least 14 days before the change takes effect. The “Last updated” date at the top of this page reflects the latest revision.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, please contact: