Privacy Policy

Last modified: July 15, 2026

Introduction

Autoflow ("Company," "we," "us," or "our") is committed to safeguarding your privacy. This Privacy Policy outlines how we collect, use, protect, and disclose your personal information ("Personal Data") when you access our platform at https://autoflowfleet.com, https://getautoflow.io, or use any of our associated services (collectively, the "Services"). This Privacy Policy applies only to information collected through our Services and not to information collected elsewhere.

Please read this Privacy Policy carefully to understand our practices regarding your Personal Data.

Data Controller

The data controller for your Personal Data is Autoflow. You may contact us regarding this Privacy Policy at: Email: contact@getautoflow.io

Types of Personal Data We Collect

We may collect the following categories of Personal Data directly from you or automatically when you use our Services:

1. Data You Provide

• Contact Information: Email address, phone number (optional)
• Account Information: Username, password, and digital wallet address (if applicable)
• Communication Data: Contents of messages sent to us
• Integration Data: When connecting external accounts (such as Google Calendar), we collect permissions and metadata necessary for the integration

2. Data Collected Automatically

• Technical Data: IP address, browser type, device information, operating system, and configuration
• Usage Data: Date/time of visits, pages viewed, features used, interactions
• Location Data: Approximate geographic location derived from IP address

We use cookies and tracking technologies as described in our Cookie Policy.

3. Renter and Verification Data (processed on behalf of fleet operators)

When a fleet operator uses Autoflow to manage bookings or verify renters, we process personal data about that operator's customers ("Renters") on the operator's behalf, which may include:

• Booking Data: name, contact details, rental dates, vehicle, pricing, and notes entered by the operator
• Identity Verification Data: government-ID images, ID data (name, date of birth, document number, expiration), and selfie images, processed by our identity-verification provider (Stripe Identity); and derived verification outcomes (pass/fail, match confidence)
• Biometric Data: facial geometry derived from ID and selfie images is processed by the verification provider for matching purposes, with the provider's own consent flow presented to the Renter; Autoflow receives verification outcomes, not raw biometric templates
• Screening Results: background- and records-check outcomes supplied by screening partners (e.g., Checkr), where the operator has requested them and obtained required consents
• Insurance Data: policy carrier, coverage details, and effective/expiration dates, supplied by the Renter or retrieved from insurance-data providers (e.g., Axle) with the Renter's consent
• Contract and Signature Data: executed rental agreements, signature events, timestamps, and IP addresses

For this data, the fleet operator is the data controller (or "business" under the CCPA) and Autoflow acts as a processor/service provider under our Data Processing Addendum. Renters seeking to exercise privacy rights over booking or verification data should contact the operator they rented from; we support operators in fulfilling such requests.

We use Stripe for identity verification, payments, and other business services. Stripe collects identifying information about you and the devices that connect to its services, which includes the use of cookies. You can learn more at stripe.com/privacy.

Google User Data & Calendar Integration

Autoflow integrates with Google services to provide calendar synchronization. When you connect your Google account, we access only the minimum data required for this functionality.

1. Google User Data Usage

We access Google Calendar data solely for the following:

• Syncing your Autoflow bookings with Google Calendar
• Displaying availability inside Autoflow
• Creating Autoflow-generated events
• Ensuring accurate scheduling across devices

We only access:

• Calendar IDs
• Event start/end times
• Autoflow-generated event content
• Calendar metadata required for sync

We do not:

• Access or store unrelated calendar events
• Use Google data for advertising or analytics
• Sell or share Google user data

Our use complies with the Google API Services User Data Policy and Limited Use Requirements.

2. Google User Data Sharing

Autoflow does not share Google Calendar data with third parties except:

• Trusted service providers supporting core functionality (e.g., hosting)
• Legal authorities when required by law
• To protect platform integrity or prevent fraud

Google user data is never disclosed for marketing, advertising, or analytics.

3. Data Storage & Protection (Google Data)

We store Google integration data using industry-standard security:

• Encrypted storage
• Encrypted transmission (HTTPS/TLS)
• OAuth token encryption
• Strict access controls
• Regular internal audits

We store only:

• OAuth tokens
• Calendar identifiers
• Autoflow-generated event metadata

We do not store the full content of your Google Calendar.

4. Data Retention & Deletion (Google Data)

We retain Google integration data only while your Google account remains connected.

When you disconnect Google Calendar:

• All OAuth tokens are deleted
• All calendar sync metadata is removed
• Autoflow immediately loses access to your Google user data

If you request deletion of your Autoflow account, all Google-related data will be deleted within 30 days, unless legal obligations require retention.

5. User Control & Consent

You may remove Autoflow's access to Google at any time:

• Through Autoflow account settings
• Through Google Account permissions: https://myaccount.google.com/permissions

Connecting Google Calendar is fully optional.

Purposes for Processing Your Personal Data

Disclosure of Personal Data

We may share Personal Data with:

• Service Providers (hosting, analytics, cloud storage, payment processing)
• Business Partners (for integrations or collaborations)
• Legal Regulators (when required by law)
• Professional Advisors (legal, financial, technical)
• Corporate Transaction Parties (mergers, acquisitions, reorganizations)
• Parties You Authorize

We do not sell Personal Data.

Cookies and Tracking Technologies

We use cookies and similar technologies to improve user experience, analyze performance, and running essential platform functions. You may disable cookies in your browser, but this may limit functionality.

Information for Renters

If you were asked to verify your identity or sign a rental agreement through Autoflow, the fleet operator you are renting from is responsible for that request. Verification is optional, but the operator may decline to rent without it. Identity and biometric processing is performed by our verification partners under their own privacy policies, which are presented to you at the time of verification, and you may decline biometric processing there. Verification images and biometric data are retained by the verification partner according to its retention schedule; Autoflow retains verification outcomes for the operator's records. To exercise privacy rights over your data, contact your rental operator, or contact us at contact@getautoflow.io and we will route your request to the right operator.

Your Choices

1. Marketing Communications

You may unsubscribe anytime using the link in our emails or by contacting us.

2. Cookies

Disable cookies through browser settings. Some features may not work correctly without cookies.

Data Retention

We retain Personal Data only as long as needed for:

• Service operation
• Security
• Legal compliance

Retention length depends on data type, sensitivity, and legal requirements.

Verification outcomes are retained while the requesting operator's account remains active, or until the operator deletes them. Raw ID and selfie images are held by the verification provider, not by Autoflow, and are subject to the provider's retention schedule; deletion of verification records in Autoflow triggers redaction of the corresponding data held by the provider.

Security Measures

We implement technical and organizational measures to protect Personal Data from unauthorized access, use, and disclosure. However, no internet transmission is fully secure.

Third-Party Websites

We are not responsible for the privacy practices of third-party sites linked from our Platform.

Children's Data

Our Services are not intended for individuals under 13. We do not knowingly collect data from children. If discovered, we delete such data immediately.

Do Not Track Signals

Our Platform does not respond to "Do Not Track" signals due to the absence of industry standards.

International Data Transfers

If you access our Services from outside the United States, your data may be transferred and processed in the U.S. or other jurisdictions. We use safeguards such as Standard Contractual Clauses when required.

Rights for EEA, Switzerland, and UK Residents

If you are located in the EEA, Switzerland, or the UK, you have the following rights under GDPR and equivalent laws:

1. Right of Access

Request confirmation of whether we process your Personal Data and receive a copy of such data.

2. Right to Rectification

Request correction of inaccurate or incomplete Personal Data.

3. Right to Erasure ("Right to Be Forgotten")

Request deletion of your Personal Data where:

• It is no longer needed
• You withdraw consent (where applicable)
• You object to processing and no overriding legitimate grounds exist
• Processing is unlawful

4. Right to Restrict Processing

Request we limit processing of your Personal Data under certain circumstances.

5. Right to Data Portability

Receive your Personal Data in a structured, machine-readable format and transmit it to another controller.

6. Right to Object

Object to processing based on legitimate interests, including profiling.

7. Right to Withdraw Consent

If processing is based on consent, you may withdraw it at any time.

8. Right to Lodge a Complaint

File a complaint with your local data protection authority.

To exercise your rights, contact: contact@getautoflow.io

Rights for California Residents (CCPA/CPRA)

If you are a California resident, you may:

1. Request to Know

Ask for details about:

• The categories of Personal Data collected
• The sources of that data
• The purposes for collection
• The categories of third parties we share data with

2. Request Deletion

Ask us to delete your Personal Data, subject to legal exemptions.

3. Request Correction

Ask us to correct inaccurate Personal Data.

4. Right to Opt-Out of Sale or Sharing

Autoflow does not sell Personal Data or share it for targeted advertising.

5. Right to Non-Discrimination

We will not deny services or offer different pricing if you exercise your rights.

To exercise these rights, contact: contact@getautoflow.io

Updates to This Privacy Policy

We may update this Privacy Policy periodically. Changes will be posted on this page with an updated "Last Modified" date.

Contact Us

For questions or concerns about this Privacy Policy, contact us at: Email: contact@getautoflow.io