Privacy Policy

This Privacy Policy explains how AIGENTIC Flows ("AIGENTIC Flows," "we," "us," or "our") collects, uses, shares, and protects information in connection with our website and our multi-tenant business operating platform — CRM, sales pipeline, and (for insurance agencies) production and recruitment tracking, offered under each customer agency's own branding (the "Service").

AIGENTIC Flows is operated by Christopher Garcia.

This policy is written to align with the Philippines' Data Privacy Act of 2012 (Republic Act No. 10173, "RA 10173") and its Implementing Rules and Regulations. If your organization operates outside the Philippines, additional local requirements may also apply to your use of the Service; please contact us if you need a jurisdiction-specific addendum.

1. Who this policy covers, and two different roles we play

We collect information in two distinct capacities, and RA 10173 treats them differently:

• As a Data Controller — for account and billing-adjacent information about the people who sign up for, administer, or use the Service (Owners, Managers, Advisors, Recruiters, and website visitors who request a trial or contact us). We decide how this information is used.
• As a Data Processor — for the client, contact, and business data that an agency's own team enters into their workspace (for example, a client's name, contact details, or policy information). Your agency is the Data Controller for that information; we process it only on your agency's instructions, to provide the Service.

If you are a client or prospect of one of our customer agencies and have a question about your own data, please contact that agency directly — they control that data, not us.

2. Information we collect

2.1 Account and workspace information

• Name, email address, and password (encrypted) when you create a trial account or are invited to a workspace.
• Agency/workspace details you provide during setup: agency name, industry, time zone, currency, locale, and branding.
• Role and workspace membership information (Owner, Manager, Advisor, or Recruiter).

2.2 Client and business data you or your team enter

• Contact records: names, contact details, notes, tags, and activity history your team enters for your own clients and prospects.
• Business records: companies, deals, and (for insurance workspaces) policy, production, and recruitment records.
• Leads captured through a Facebook Lead Ads form you connect — see §5 below.

2.3 Technical and usage information

• Log data such as IP address, browser type, device information, and timestamps, collected automatically when you use the website or the Service.
• Basic product usage information needed to operate and secure the Service (for example, sign-in activity).

2.4 Cookies

The Service uses cookies that are strictly necessary for sign-in and session security. We do not currently run third-party analytics or advertising tracking on our website or in the Service. If that changes, we will publish a separate Cookie Policy describing exactly what's used and, where required, ask for your consent before it runs. As stated above, AIGENTIC Flows — and the cookies described in this section — is operated by Christopher Garcia.

3. How we use information

• To provide, maintain, and secure the Service, including authenticating sign-ins and enforcing per-agency data isolation.
• To communicate with you about your account, trial, or subscription, including service and security notices.
• To respond to support requests and questions submitted through our website.
• To send product and marketing emails, where you have not opted out — every email includes an unsubscribe mechanism, and we honor opt-outs and bounces automatically.
• To improve and maintain the reliability of the Service.
• To comply with legal obligations and enforce our Terms of Service.

We do not sell personal information, and we do not use client data entered into a customer's workspace for any purpose other than providing the Service to that customer.

4. How we share information

We share information only as needed to operate the Service, with the following categories of service providers acting on our behalf (sub-processors):

• Hosting and infrastructure — our application is hosted on Vercel, with our database, authentication, and file storage provided by Supabase.
• Email delivery — transactional and marketing emails are sent through Resend.
• Facebook / Meta — if you connect a Facebook Lead Ads form, lead data is retrieved from Meta's platform via the connection you authorize; Meta's own privacy practices also apply to that data. See §5.

We do not otherwise share personal information with third parties for their own marketing purposes. We may disclose information if required by law, to protect the rights and safety of AIGENTIC Flows or others, or in connection with a merger, acquisition, or sale of assets, subject to this policy continuing to apply to previously collected information.

5. Facebook Lead Ads integration

If an agency connects a Facebook Page and Lead Ads form to their workspace, leads submitted through that form are delivered to the workspace in real time. This data flow is subject to Meta's own Platform Terms and Data Use Policy in addition to this Privacy Policy. Agencies are responsible for having the appropriate consent to collect and process lead data through their connected Facebook Pages.

6. Data security

Every agency's data is isolated at the database level — tenant isolation is enforced by database-level access policies, not just application logic, so one agency's workspace cannot read or write another's data under normal operation. Data is encrypted in transit, and sensitive credentials (such as connected Facebook access tokens) are encrypted at rest. No system is perfectly secure, and we cannot guarantee absolute security, but we design and operate the Service with tenant isolation as a first-class requirement.

7. Data retention

We retain account and workspace data for as long as your agency's subscription is active, and for a reasonable period afterward to allow reactivation, comply with legal obligations, resolve disputes, and enforce our agreements. An agency may request deletion of their data as described in §8 below.

8. Your rights under RA 10173

If you are located in the Philippines, the Data Privacy Act gives you the following rights regarding your personal information:

• Right to be informed — that your personal information will be, is being, or has been processed.
• Right to access — to obtain a copy of your personal information we hold.
• Right to object — to processing of your information, including for direct marketing.
• Right to correction — to have inaccurate or outdated information corrected.
• Right to erasure or blocking — to have your information removed or blocked from further processing, subject to legal retention requirements.
• Right to data portability — to obtain a copy of your information in an electronic format.
• Right to damages — for any damage sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal information.
• Right to file a complaint — with the National Privacy Commission (NPC) if you believe your rights have been violated.

To exercise any of these rights over account or website information we control, contact us using the details in §12. If your request concerns client data entered into a specific agency's workspace, we will direct you to that agency, since they control that data.

9. International data transfers

Our infrastructure providers may process and store data in locations outside the Philippines. Where this occurs, we require our providers to maintain security and confidentiality protections consistent with this policy and applicable law.

10. Children's privacy

The Service is intended for business use by adults and is not directed at children. We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will update the effective date above when we do, and, where changes are material, provide additional notice.

12. Contact us

Questions about this policy, or requests to exercise your rights under §8, can be sent to: privacy@aigenticflows.com.

Placeholder notice: this document references a placeholder contact email (privacy@aigenticflows.com) and does not yet include a registered legal entity name or business address. Replace these before this policy is treated as final, and have it reviewed by qualified counsel before relying on it, particularly for RA 10173 compliance.