Privacy Policy

NegiFlow is an independent practice, not a large organisation with a data-processing operation to match. This policy covers two things: this website (negiflow.com), which collects the minimum needed to respond to the people who get in touch, and the NegiFlow app (app.negiflow.com), which clients connect to their Google account so we can run their automations.

Google user data accessed through the app is used only to connect your accounts and run the automations you’ve set up. It is protected with encryption and restricted access, is only sent to an AI model provider to perform a step you’ve set up, is never sold, and is never used for advertising or to train AI models.

When you use the contact form, we collect the information you choose to submit: your name, email address, company (if given) and the message describing what you’re trying to solve. That information is sent so we can read and reply to you.

Beyond the contact form, we don’t build a profile of visitors, and we don’t know who’s browsing unless you choose to tell us via the form. See “Cookies” below for what runs in your browser.

When you connect a Google account to the NegiFlow app, Google asks you to approve the permissions listed below. The app requests only the permissions each connection needs:

• Basic profile information (your name, email address and profile picture). This is requested whenever you connect a Google service, including Gmail, Google Calendar, Google Drive, Google Docs, Google Sheets and YouTube. We use it to identify which Google account is connected to your workspace.
• Google Calendar events, when you connect Google Calendar for the Booking Agent. This lets the app view and manage events on your calendars, so bookings can be checked against your availability and added to your calendar.
• Gmail (read, compose, send and label), when you connect Gmail for the Inbox Agent. The app reads new incoming messages to classify them (for example, a booking request, quote request, support question or invoice) and extract the details your workflow needs. It applies Gmail labels to sort and route messages, creates draft replies, and sends replies from your account. You choose which types of message can be answered automatically. Every other reply stays as a draft until someone on your team approves it. The app never permanently deletes your email.

The app does not currently read your Drive, Docs, Sheets or YouTube content. If we add a feature that needs broader access, we’ll ask for that permission separately, explain it here first, and only use it for that feature.

Google user data is used only to provide the user-facing features of the NegiFlow app that you choose to use: showing which accounts are connected, and running the automations you’ve set up.

We do not:

• sell Google user data, or transfer it for advertising, retargeting or interest-based ads;
• use Google user data to develop, improve or train generalised AI or machine-learning models;
• use Google user data to determine creditworthiness or for lending purposes;
• allow humans to read Google user data, unless you give explicit consent (for example, to investigate a support issue), it’s necessary for security purposes, it’s required to comply with the law, or the data has been aggregated and anonymised for internal operations.

NegiFlow’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Some automation steps use an AI model, for example to understand a booking enquiry, extract its details or draft a reply. For those steps, only the content needed for that step is sent to the AI model provider configured for your workspace:

• Anthropic (default). Content is processed through Anthropic’s Claude API. Under Anthropic’s commercial terms, content sent through its API is not used to train its models.
• Your own provider. If you connect your own AI provider account using your own API key, content for those steps is sent to that provider instead. It is processed under your agreement with them, and you’re responsible for choosing a provider whose terms suit your data.

The AI output is returned to your workflow. NegiFlow does not use it, or the content sent, to train AI models. Where an automation step involves Google user data, that transfer is made only to provide the feature you’ve set up, and in line with the Limited Use requirements above.

We treat Google user data, and the credentials used to access it, as sensitive data. The protections in place are:

• Encryption in transit. All traffic between your browser, the NegiFlow app, Google’s APIs and AI model providers uses HTTPS with TLS encryption.
• Encrypted OAuth tokens. The access and refresh tokens that let the app act on your Google account are encrypted with authenticated symmetric encryption before they are stored, and are never stored in plain text. The encryption key is kept separately from the database.
• Encryption at rest. App data is stored in a managed database that is encrypted at rest.
• Encrypted API keys. If you connect your own AI provider, your API key is encrypted before it is stored and is never shown in full again.
• Restricted access. Access to production systems and data is limited to authorised NegiFlow personnel who need it to operate the service, and administrator accounts are protected with multi-factor authentication.
• Data minimisation. We request only the permissions a connection needs, and we don’t keep copies of your Google content (see below).

We store only what the app needs to keep your accounts connected: your encrypted OAuth tokens, the permissions you granted, and minimal account details such as your Google account email address and connection status. Email and calendar content is processed while an automation runs, and we don’t keep a copy of it afterwards. The labels, drafts and replies the app creates stay in your own Gmail account, where you control them.

When you disconnect a Google account from the NegiFlow app, or ask us to close your account, the stored tokens and associated account details are deleted. You can also revoke NegiFlow’s access at any time from your Google Account permissions page. To request deletion of any data we hold, email hello@negiflow.com.

This site sets one cookie: a preference cookie (negiflow_cookie_consent) that remembers your cookie choice so we don’t ask again on every visit. It doesn’t identify you and isn’t used for tracking.

With your permission, we also use Vercel Analytics to understand which pages are useful. It’s cookie-free and doesn’t collect personal information, and it only runs if you accept optional cookies. You can change your choice at any time.

Cookie preferences

Contact form submissions are used only to respond to your enquiry and to keep track of the conversation that follows. We don’t use it for marketing lists, and we don’t sell, rent or share it with third parties.

We keep enquiry information for as long as it’s relevant to an ongoing or potential working relationship. If you’d like your information deleted at any point, email hello@negiflow.com and we’ll take care of it.

We may use standard infrastructure providers to host this site and the app, store app data and send email (for example, a hosting platform, a managed database or an email delivery service). These providers process data on our behalf under their own security practices; we don’t hand your information to anyone beyond what’s required to run the site and the app and to respond to you.

Google user data is not shared with any third party, except the infrastructure providers that host the app and its database on our behalf, the AI model provider used for your workspace (see “AI processing”), or where required by law.

You can ask what information we hold about you, ask us to correct it, or ask us to delete it, at any time. Reach out to hello@negiflow.com and we’ll respond directly.

If this policy changes in any meaningful way, we’ll update this page and the date at the top of it.

Questions about this policy can go to hello@negiflow.com.