Privacy Policy

Last Updated: November 18, 2025

Version: 1.1

1. Introduction

PROXYGIST LLC, doing business as PropFlow ("PropFlow," "we," "us," or "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered property response service (the "Service").

This Privacy Policy applies to all users of PropFlow, including property managers, landlords, and prospective tenants who interact with our SMS and voice services. By using the Service, you consent to the data practices described in this policy.

We are based in Missouri, United States, and operate under U.S. privacy laws including applicable state laws, GDPR (for EU users), and CCPA/CPRA (for California users). If you are located outside the United States, please be aware that information we collect will be transferred to and processed in the United States.

2. Information We Collect

We collect information that you provide directly, information generated through your use of the Service, and information from third-party sources.

2.1 Information You Provide

  • Account Information: Name, email address, phone number, business name, and payment information when you create an account or subscribe to the Service.
  • Google Sign-In (Optional): If you choose to sign in with Google, we receive your Google profile information including name, email address, and profile picture. We use this information solely for account creation and authentication. We do not access your Google Drive, Gmail, Calendar, or any other Google services beyond basic profile information needed for sign-in. Google's use of information received from Google APIs adheres to Google API Services User Data Policy, including the Limited Use requirements.
  • Property Information: Property addresses, descriptions, rental prices, amenities, availability status, tour scheduling links, and other details you input about your rental properties.
  • Communications: Messages, feedback, and other communications you send to us through email, support requests, or other channels.

2.1.1 Google API Limited Use Disclosure

PropFlow's use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • We only request the minimum permissions necessary (profile, email)
  • We use Google user data solely for providing authentication services
  • We do not transfer Google user data to third parties (except as necessary to provide the Service or comply with law)
  • We do not use Google user data for serving advertisements
  • We do not allow humans to read Google user data unless: (a) we have your explicit consent, (b) it's necessary for security purposes, or (c) required by law

For more information, see Google API Services User Data Policy at developers.google.com/terms/api-services-user-data-policy.

2.2 SMS Communications via PropFlow Platform

Property Inquiry SMS Communications

When you call a property managed through PropFlow and receive an SMS response, or when prospects interact with your properties via SMS:

  • We collect: Phone numbers of callers/message senders and the content of SMS conversations between prospects and your properties
  • We use it for: Providing property information, answering questions about rentals, qualifying leads, and scheduling property tours
  • We do NOT: Share, sell, or transfer mobile phone numbers to third parties for marketing purposes
  • Message frequency: Varies by inquiry, typically 1-10 messages per property inquiry
  • Standard rates apply: Message and data rates may apply to recipients based on their mobile carrier plan
  • Opt-out: Reply STOP to any message at any time to stop receiving SMS messages
  • Help: Reply HELP for assistance or contact support@propflow.dev

Our SMS services are transactional in nature, responding to inbound property inquiries and facilitating tour scheduling. We do not send promotional or marketing messages through this system.

Property Manager Consent Obligations: PropFlow sends SMS messages on behalf of property managers who use our Service. We rely on property managers to obtain all necessary consents from prospects before using our Service to communicate with them. Property managers are required to comply with all applicable laws, including the Telephone Consumer Protection Act (TCPA), and to obtain proper consent before prospects receive SMS messages through PropFlow. If you are a prospect and believe you are receiving messages in error or without proper consent, please reply STOP to opt out immediately and contact us at support@propflow.dev.

2.3 PropFlow Marketing & Product Inquiry SMS

When you text PropFlow to inquire about our services:

  • We collect: Your phone number and message content
  • We use it for: Answering your product questions, scheduling demos, providing trial information, and account notifications
  • We do NOT: Share, sell, or transfer your phone number to third parties
  • Message frequency: Varies based on your inquiries, typically 1-5 messages
  • Standard rates apply: Message and data rates may apply
  • Opt-out: Reply STOP to any message at any time
  • Help: Reply HELP or contact support@propflow.dev

2.4 Automatically Collected Information

  • Call Data: Phone numbers, call timestamps, call duration, call status (missed/answered), and call recordings (if applicable based on your settings).
  • Conversation Data: SMS message content, timestamps, phone numbers, lead qualification information (name, budget, timeline, bedroom preferences) extracted from conversations.
  • Usage Data: Information about how you interact with the Service, including pages visited, features used, time spent, clicks, and navigation patterns.
  • Device Information: IP address, browser type, operating system, device identifiers, and mobile network information.
  • Location Data: General geographic location inferred from IP address (not precise GPS location).
  • Analytics Data: When you consent to analytics cookies, PostHog collects usage data including page views, feature interactions, session recordings (if enabled), button clicks, form submissions, and user flows to help us understand and improve the Service.

2.5 Information from Third Parties

  • Twilio: SMS delivery status, call completion data, phone number provisioning information.
  • OpenAI: AI-generated response metadata (we do not share your property or conversation data with OpenAI beyond what's necessary for response generation).
  • Payment Processors: Transaction details and payment status from Stripe or other payment providers.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 To Provide and Improve the Service

  • Process and respond to property inquiries via SMS and voice
  • Generate AI-powered responses using property information you provide
  • Qualify leads by extracting information from conversations
  • Facilitate tour scheduling and appointment coordination
  • Manage phone number provisioning and call routing
  • Display analytics, metrics, and conversation history in your dashboard
  • Improve AI response accuracy and Service functionality

3.2 To Communicate with You

  • Send transactional emails about your account and Service usage
  • Provide customer support and respond to your inquiries
  • Send important notices about Service changes, updates, or security
  • Notify you of usage limit warnings or billing issues

3.3 For Billing and Account Management

  • Process subscription payments and manage billing
  • Track usage against plan limits and calculate overage charges
  • Prevent fraud and unauthorized access
  • Maintain accurate account and financial records
  • Comply with legal obligations and respond to legal requests
  • Protect against fraudulent, malicious, or illegal activity
  • Enforce our Terms of Service and protect our rights
  • Ensure the security and integrity of the Service

3.5 Aggregated and De-Identified Information

We may aggregate or de-identify personal data so that it can no longer be used to identify you. We use this anonymized data for:

  • Analyzing Service performance and usage patterns
  • Training and improving AI response quality
  • Conducting research and product development
  • Creating industry benchmarks and statistics
  • Sharing with third parties for analytics purposes

Once data has been properly de-identified or aggregated, it is no longer considered personal data under applicable privacy laws, and we may use it without restriction.

Examples:

  • "Property managers receive an average of 45 calls per month"
  • "Response time averages improved by 23% after AI implementation"
  • "80% of conversations result in qualified leads"

This aggregated data cannot be traced back to individual users or properties.

5. Data Sharing & Third Parties

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. We share information only in the following limited circumstances:

5.1 Service Providers

We share information with third-party vendors who help us provide the Service:

  • Twilio: SMS and voice communication infrastructure, phone number provisioning. Twilio processes call and message data on our behalf. See Twilio's privacy policy at twilio.com/legal/privacy.
  • OpenAI: AI-powered response generation. We send property information and conversation context to OpenAI's API to generate responses. OpenAI does not use this data to train their models. See OpenAI's privacy policy at openai.com/privacy.
  • Supabase: Database hosting and authentication services. See Supabase's privacy policy at supabase.com/privacy.
  • Google: Authentication services for Google Sign-In (optional). We only request basic profile information (name, email, profile picture) for account creation. We do not access or store any other Google account data. See Google's Privacy Policy at policies.google.com/privacy.
  • Vercel: Application hosting and content delivery. See Vercel's privacy policy at vercel.com/legal/privacy-policy.
  • PostHog: Product analytics and user behavior tracking. When you consent to analytics cookies, PostHog processes usage data to help us understand how users interact with the Service. PostHog is GDPR compliant and does not sell user data. See PostHog's privacy policy at posthog.com/privacy.
  • Stripe: Payment processing for subscriptions. See Stripe's privacy policy at stripe.com/privacy.

These service providers are contractually obligated to protect your data and use it only for the purposes we specify.

5.2 Business Transfers

If PropFlow is involved in a merger, acquisition, sale of assets, or bankruptcy, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our website of any change in ownership or use of your personal information.

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, subpoenas, government investigations). We will notify you of such requests unless legally prohibited from doing so.

5.4 Protection of Rights

We may disclose information to protect our rights, property, or safety, or the rights, property, or safety of our users or the public, including in connection with fraud prevention and security investigations.

We may share your information for other purposes with your explicit consent or at your direction.

5.6 Do Not Sell My Personal Information (CCPA)

PropFlow does not sell personal information as defined by the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). We do not share your personal information with third parties for monetary or other valuable consideration.

If you are a California resident and want to ensure you are opted out of any potential future data sharing that could be considered a "sale," you can:

  • Adjust cookie preferences in Settings → Privacy Choices
  • Email us at privacy@propflow.dev with subject "CCPA Opt-Out Request"
  • Use the "Do Not Sell My Personal Information" link in our website footer

We will honor Global Privacy Control (GPC) signals from your browser.

6. Data Retention

We retain your information for as long as necessary to provide the Service and fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

  • Account Data: Retained for the duration of your account plus 90 days after termination for billing and support purposes.
  • Conversation & Call Data: Retained for 24 months to enable analytics and improve Service quality. You may request earlier deletion.
  • Billing Records: Retained for 7 years as required by accounting and tax laws.
  • Support Communications: Retained for 3 years for reference and quality assurance.

After the retention period, we securely delete or anonymize your information. You may request deletion of your data at any time by contacting privacy@propflow.dev, subject to legal retention requirements.

7. Cookies & Analytics

We use cookies and similar tracking technologies to operate and improve the Service. For complete details about the cookies we use, how to manage your preferences, and your consent choices, please see our Cookie Policy.

Types of cookies we use:

  • Essential Cookies: Required for authentication, security, and core Service functionality (Supabase session management, CSRF protection). These cannot be disabled as they are necessary for the Service to function.
  • Analytics Cookies: We use PostHog to understand how users interact with the Service, including page views, feature usage, session recordings (optional), and user flows. This helps us improve the product and user experience. You can opt out of analytics cookies through our cookie banner or browser settings.
  • Preference Cookies: Remember your settings and preferences for a better experience (such as cookie consent choices and dashboard preferences).

Most browsers allow you to control cookies through their settings. However, disabling essential cookies will prevent you from using the Service. You can manage your analytics preferences through the cookie banner displayed on your first visit or by adjusting your browser settings.

For more information about cookies, visit allaboutcookies.org. To learn more about PostHog's privacy practices, visit posthog.com/privacy.

California Residents (CCPA/CPRA): While we do not sell personal information as defined by the CCPA, California residents can opt out of the "sharing" of personal information for cross-context behavioral advertising by adjusting cookie preferences in Settings → Privacy Choices or by emailing privacy@propflow.dev with "CCPA Opt-Out" in the subject line.

8. Data Security

We implement appropriate technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction:

  • Encryption of data in transit using SSL/TLS protocols
  • Encryption of sensitive data at rest in our databases
  • Regular security assessments and vulnerability testing
  • Access controls and authentication requirements for staff
  • Secure API integrations with third-party services
  • Monitoring for suspicious activity and potential security breaches

While we strive to protect your personal information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security, but we are committed to maintaining industry-standard security practices.

If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that your account has been compromised), please contact us immediately at privacy@propflow.dev.

9. Your Privacy Rights (GDPR/CCPA/CPRA)

Depending on your location, you may have certain rights regarding your personal information:

9.1 GDPR Rights (European Union Users)

  • Right to Access: Request a copy of the personal information we hold about you.
  • Right to Rectification: Request correction of inaccurate or incomplete information.
  • Right to Erasure: Request deletion of your personal information ("right to be forgotten").
  • Right to Restrict Processing: Request that we limit how we use your information.
  • Right to Data Portability: Request a copy of your data in a machine-readable format.
  • Right to Object: Object to certain types of processing, including direct marketing.
  • Right to Withdraw Consent: Withdraw consent for processing based on consent at any time.
  • Right to Lodge a Complaint: File a complaint with your local data protection authority.

9.2 CCPA/CPRA Rights (California Users)

  • Right to Know: Request disclosure of the personal information we collect, use, disclose, and sell.
  • Right to Delete: Request deletion of personal information we have collected from you.
  • Right to Opt-Out: Opt out of the "sale" or "sharing" of personal information (note: we do not sell personal information).
  • Right to Correct: Request correction of inaccurate personal information.
  • Right to Limit: Limit the use and disclosure of sensitive personal information.
  • Right to Non-Discrimination: Exercise your privacy rights without discriminatory treatment.

9.3 How to Exercise Your Rights

To exercise any of these rights, please contact us at privacy@propflow.dev with the subject line "Privacy Rights Request." We will verify your identity and respond within the timeframes required by applicable law (typically 30-45 days).

You may also update certain account information directly through your PropFlow dashboard settings.

9.4 Right to Lodge a Complaint

If you believe we have not addressed your privacy concerns adequately, you have the right to lodge a complaint with your local data protection authority:

You can also contact us at privacy@propflow.dev to attempt resolution before filing a complaint.

10. Children's Privacy

PropFlow is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe we have collected information from your child, please contact us at privacy@propflow.dev, and we will promptly delete such information.

The Service is designed for property management professionals and businesses, not for general consumer use by minors.

11. International Transfers

PropFlow is based in the United States, and your information is processed and stored in the United States. If you are accessing the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States and other jurisdictions where our service providers operate.

Data Protection Safeguards:

For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on appropriate safeguards for international data transfers:

  • Standard Contractual Clauses (SCCs): European Commission-approved contractual clauses under Article 46 GDPR that allow companies to transfer data outside the EEA with appropriate protections.
  • Service Provider Agreements: Our vendors (Twilio, OpenAI, Supabase, Vercel, PostHog, Stripe) are contractually required to protect your data and comply with applicable data protection laws.
  • Adequacy Decisions: Where available, we rely on European Commission adequacy decisions recognizing that certain countries provide adequate data protection.

By using the Service, you acknowledge and consent to the transfer of your information to the United States and other jurisdictions where data protection laws may differ from those in your country.

If you have questions about international data transfers, contact privacy@propflow.dev.

12. Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you and applicable regulatory authorities in accordance with applicable laws. Notifications will be made without undue delay and, where required by law, within 72 hours of becoming aware of the breach.

We will provide information about:

  • The nature of the breach and types of data affected
  • The likely consequences of the breach
  • The measures we have taken or will take to address the breach
  • Recommendations for protecting your information

If you have questions about our data security practices or suspect a security incident, contact us immediately at privacy@propflow.dev.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will update the "Last Updated" date at the top of this policy.

For material changes that significantly affect your rights or how we use your information, we will provide prominent notice through the Service or by email at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

PROXYGIST LLC (D.B.A. PropFlow)
Email: privacy@propflow.dev
Website: propflow.dev

For SMS/Messaging Questions or Opt-Out:
Reply STOP to any message or email: support@propflow.dev

For General Support:
Email: support@propflow.dev

For Legal Matters:
Email: legal@propflow.dev

We will respond to your inquiry within 5 business days for general questions and within the timeframes required by applicable law for privacy rights requests.