Privacy Policy
Last updated 5 September 2026
This explains what GetRetainFlow collects when you use RetainFlow, why, and what you can do about it. It is written to be read, not to be survived.
The short version
- We store your account, your team, and the scripts you write.
- We do not store what your customers say on a call. Answers live in the rep’s browser and are gone when the call ends.
- We never see your card details.
- We do not sell anything to anybody, and we do not train models on your content.
What we hold
Your account
- Your email address, your name if you give it, and your role.
- Your company name, and who else is on the account.
- Your password, stored only as a hash we cannot reverse.
What you build
Your call scripts, questions, rules, warnings, checklists and links. This is your business process. We store it so the product works, and for no other reason.
That a call happened
When a rep finishes a call we record who logged it, which call reasons were used, how long it took, and whether the checklist was completed — so a manager can see how the team is doing. The answers themselves are not part of this.The customer’s name, their account number, what they complained about: none of it reaches us. It is assembled in the browser, copied to the clipboard, and discarded.
Ordinary technical records
Our hosting providers keep short-lived logs — IP address, browser, page requested — as any web service does, to keep it running and to spot abuse.
Why we are allowed to hold it
We process this to provide a service you asked for, to meet our legal obligations, and for the narrow legitimate interest of keeping the service secure and working. We do not rely on consent for any of it, because none of it is optional to the service — which also means there is no consent banner to click past.
Who else touches it
- Supabase — the database and sign-in, where your account and scripts live.
- Vercel — hosting.
- Gumroad — subscriptions. They are the merchant of record; they hold your billing details, we do not. Their privacy policy covers what they do with them.
- Resend — sending email such as invitations and password resets.
- Cloudflare — our domain, and forwarding mail sent to our support address.
That is the entire list. We do not use advertising or analytics trackers, and there is nothing here that follows you around the internet.
Where it lives
On our providers’ servers, which may be outside your country. Where data moves across borders we rely on the providers’ own safeguards for those transfers.
How long we keep it
- Your account and scripts: while your account exists.
- After you close your account: deleted within 30 days, except anything we must keep for accounting or legal reasons.
- Records that a call happened: kept while the account exists, so the numbers mean something over time.
- Call answers: never stored, so there is nothing to delete.
What you can ask for
A copy of what we hold about you, a correction, or deletion. You can also object to how we use it, or ask us to stop. Write to support@getretainflow.com and we will answer within 2 working days. Depending on where you live you may also have the right to complain to a data protection regulator.
Keeping it safe
Every customer’s data is separated at the database level, so one account cannot read another’s — enforced by the database itself rather than by the application asking nicely. Traffic is encrypted. Access to production is limited to the people who need it. No system is perfect; if something goes wrong that affects you, we will tell you rather than hope you do not notice.
Children
RetainFlow is a tool for businesses and is not for anybody under 18. We do not knowingly collect their information.
Changes
If we change this in a way that matters, we will email the account before it takes effect. The date at the top always tells you the version you are reading.