Privacy Policy

This Privacy Policy explains how MarginFlow ("MarginFlow," "we," "us," or "our") collects, uses, discloses, and safeguards information when you use our website and application (together, the "Service"). By using the Service, you agree to the collection and use of information in accordance with this policy.

1. Who we are

MarginFlow is a scope-creep detection tool for agencies. It reads a signed Statement of Work / contract and a connected Gmail inbox to flag incoming client requests that fall outside the agreed scope, so an agency can decide whether to bill for the extra work. If you have questions about this policy, contact us at hello@marginflow.in.

2. Information we collect

2.1 Information you provide directly

• Account information: name, work email, and agency name when you sign up (processed by our authentication provider, Clerk).
• Client and contract data: client names, contact emails, and the contract/Statement of Work files you upload, plus the terms our AI extracts from them (deliverables, exclusions, hourly rates).
• Billing information: when you subscribe to a paid plan, payment is processed by PayPal. We do not receive or store your full card or bank details — PayPal shares only your subscription status and plan with us.

2.2 Information from Google (Gmail)

If you choose to connect your Gmail account, we request access via Google OAuth to a single, narrow scope: gmail.readonly (read-only access to your inbox), plus your basic Google account email address for identification. Specifically:

• We read incoming email threads to and from addresses that match your saved clients' contact emails, so our AI can classify whether a message describes work outside the connected contract's scope.
• We store the minimum needed to show you the alert: the relevant message excerpt, sender, subject, and timestamp — not your entire mailbox.
• We do not read, store, or analyze email unrelated to your saved clients.

What we never do with Gmail data: MarginFlow cannot and does not send email on your behalf, does not use your Gmail content to train AI models, does not sell it, and does not share it for advertising. Any AI processing of email content is solely to classify whether a message is in- or out-of-scope and to draft an optional change-order email for your own review — nothing is ever sent automatically.

MarginFlow's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

2.3 Information collected automatically

We collect standard usage data (pages viewed, actions taken, browser and device type) via product analytics tooling, and error data via our error-monitoring tooling, to keep the Service reliable and to understand how it's used.

3. How we use your information

• To provide, operate, and maintain the Service
• To detect scope-creep by matching incoming client emails against your contract terms
• To process subscription payments and manage your plan
• To send account, billing, and scope-alert notifications (e.g. new alert emails) via our transactional email provider
• To respond to support requests
• To detect, prevent, and address technical issues or abuse

4. How we share information

We do not sell your personal information or your Gmail data. We share information only with the service providers who help us run MarginFlow, each acting under their own privacy and security commitments:

• Clerk — authentication and account management
• Database/hosting infrastructure — stores your agency, client, contract, and alert data
• AI providers used for contract extraction and email classification — receive only the specific contract text or email excerpt needed to process that request, not your full mailbox
• PayPal — subscription billing
• Resend — delivery of transactional notification emails
• Object storage — stores uploaded contract files

We may also disclose information if required by law, or to protect the rights, property, or safety of MarginFlow, our users, or others.

5. Data retention

We retain account, client, contract, and alert data for as long as your account is active. Gmail data used to generate an alert is retained only as long as needed to display that alert and its history in your dashboard. If you disconnect Gmail, we stop syncing new email immediately; previously generated alerts remain until you delete them or close your account.

6. Your choices and rights

• Disconnect Gmailat any time from Settings → Integrations. This revokes our ongoing access; you can also revoke MarginFlow's access directly at myaccount.google.com/permissions.
• Access, correct, or delete your account data by contacting hello@marginflow.in.
• Cancel your subscription at any time from Settings → Billing.

7. Data security

Gmail refresh tokens are encrypted at rest. Access to client data is scoped per agency, and we apply reasonable administrative, technical, and physical safeguards designed to protect your information. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Children's privacy

The Service is intended for business use by agency professionals and is not directed at, or knowingly used to collect information from, anyone under 16.

9. Changes to this policy

We may update this Privacy Policy from time to time. We'll post the revised version here with an updated "Last updated" date, and for material changes we'll provide additional notice (such as an email).

10. Contact us

Questions about this policy or your data? Email us at hello@marginflow.in.