Karmaflow.ai Privacy Policy

Last Updated: November 4, 2026

Karmaflow Inc. (“Karmaflow.ai”, “we”, “us”, “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website karmaflow.ai (the “Site”), and when you use our services (the “Services”).

Please read this Privacy Policy carefully. By using our Site or Services, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

We collect information in a few different ways:

a) Information You Provide to Us:

• Contact Information: When you fill out a contact form, request a demo, or communicate with us, you may provide us with your name, email address, phone number, company name, and job title.
• Account Information: When our customers register for our Services, we collect usernames, email addresses, and passwords.
• Billing Information: To process payments for our Services, we may collect billing details, which are processed by our third-party payment processors.

b) Information We Collect Automatically:

• Log and Usage Data: We automatically collect information when you visit our Site or use our Services, including your IP address, browser type, operating system, referring URLs, pages and screens viewed, features used, actions taken, and timestamps.
• Cookies and Similar Technologies: We use cookies and similar technologies to operate and administer our Site and Services, to remember your preferences, and to measure usage. A cookie is a piece of information sent to your browser from a website. This includes Google Analytics, which we deploy through Google Tag Manager and which sets cookies across karmaflow.ai and its subdomains so that a visit to our Site and a session in our web application can be understood as one journey. You can control the use of cookies at the individual browser level, and you may opt out of Google Analytics using Google's opt-out browser add-on.
• Product Usage and Analytics Data: When you sign in to and use our web application, we collect analytics about how the Services are used — including sign-in events, the pages and screens you view, and the features you interact with — together with pseudonymous identifiers for your user account and your workspace. We use this to understand how the Services are used, to measure the effectiveness of our marketing, and to improve the product. These identifiers are internal and opaque: we do not send your name, email address, or telephone number to our analytics providers, and we do not use this data for advertising.

c) Customer Data Processed within our Services:

Our customers and their end-users may submit data or content to our Services for processing, including the content of voice calls, chats, SMS messages, and emails (“Customer Data”). Our processing of Customer Data is governed by our Terms of Service and our Data Processing Addendum (DPA) with our customers. Karmaflow.ai is a Processor of this Customer Data, and our customer is the Controller. Information about how the Services are used — such as when a user signs in and which features they open, described in Section 1(b) — is not Customer Data: it describes interaction with the Services rather than the content submitted to them, and we act as a Controller for it. This Privacy Policy does not apply to Customer Data, with two exceptions: Section 8 (Google User Data) applies to information received from Google APIs, and Section 9 (AI Assistant Connectors) applies to Customer Data accessed through a connector, regardless of how either is classified elsewhere in this policy.

2. How We Use Your Information

We use the information we collect for various purposes:

• To Provide and Maintain our Site and Services: To operate our Site, create and manage customer accounts, and provide our Services.
• To Communicate with You: To respond to your inquiries, send you administrative information, and provide customer support.
• For Marketing and Advertising: To send you promotional communications about our products and services. You may opt-out of receiving marketing communications at any time.
• To Improve our Site and Services: To understand how our users interact with our Site and Services, to monitor performance, to measure the effectiveness of our marketing and of the channels that bring people to us, and to develop new features.
• For Security and Compliance: To prevent fraud, enforce our terms, and comply with legal obligations.

3. How We Share Your Information

We do not sell your personal information. We may share your information in the following situations:

• With Service Providers (Sub-processors): We share information with third-party vendors and service providers who help us operate our business, such as cloud hosting providers, communication providers, analytics tools, and AI model providers. A list of our sub-processors is available on our website.
• For Legal Reasons: We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or a government agency).
• In Business Transfers: We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

4. Data Retention

We will retain your personal information only for as long as is necessary for the purposes set out in this Privacy Policy, or as required to comply with our legal obligations, resolve disputes, and enforce our agreements.

5. Your Data Protection Rights

Depending on your location, you may have the following rights regarding your personal information:

• The right to access, update, or delete the information we have on you.
• The right of rectification.
• The right to object to our processing of your personal information.
• The right of restriction.
• The right to data portability.
• The right to withdraw consent.

To exercise any of these rights, please contact us at privacy@karmaflow.ai.

6. International Data Transfers

Your information, including personal data, may be transferred to—and maintained on—computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ. Our practices for international transfers are governed by our Data Processing Addendum (DPA).

7. Information for Residents of Canada and California

Canada (PIPEDA): We comply with Canada's Personal Information Protection and Electronic Documents Act. If you are a resident of Canada, you have the right to access the personal information we hold about you and to request that we correct any inaccuracies.

California (CCPA/CPRA): If you are a California resident, you have specific rights regarding your personal information. We act as a "Service Provider" for the Customer Data we process on behalf of our customers. For information we collect on our own behalf, we provide you with the rights to know, delete, and opt-out of the sale or sharing of your personal information (note: we do not sell or share your personal information).

8. Google User Data

Some Karmaflow features let individual users connect their own Google account (Gmail, Google Calendar, Google Drive, Google Sheets, Google Docs, and Google Slides) through Google's OAuth consent flow. This section describes how we handle information received from Google APIs, and it applies notwithstanding Section 1(c).

Karmaflow's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we access, and why. Access is granted per user, per product, and only after an in-app disclosure and Google's own consent screen:

• Gmail — reading, sending, searching, and labeling email, so AI agents can summarize messages you point them at, send email you or your workflows compose, and file or archive messages. We do not delete messages or change account settings.
• Google Calendar — reading, creating, updating, and sharing events, so agents can check availability, book and reschedule meetings, and share a calendar when you ask.
• Google Drive — searching, reading, uploading, and organizing files, so agents can find and read files you ask about, save generated documents, and file CRM attachments into folders your workspace configures.
• Google Sheets, Docs, and Slides — reading and adding to spreadsheets, documents, and presentations at your direction.

How we use it. Google user data is used only to provide these user-facing features, at your or your workspace's direction. We do not use Google user data for advertising. We do not sell it. Humans at Karmaflow do not read it except with your explicit permission, where necessary for security or abuse investigation, to comply with applicable law, or where the data has been aggregated and anonymized for internal operations.

AI models. We do not use Google user data, or data derived from it, to develop, improve, or train generalized or non-personalized artificial intelligence or machine-learning models. Content from connected Google accounts is used only to provide features to the workspace it came from — for example, retrieval that grounds an AI agent's answers in your own documents.

Transfers. We transfer Google user data only to the sub-processors needed to provide these features. In particular, when your workspace uses Drive-based knowledge features, content from Drive files you choose is processed and stored in your workspace's private retrieval index hosted by OpenAI so your agents can answer questions from those documents. We obtain your consent to this transfer in the app before you connect your Google account, and our sub-processors are contractually prohibited from using this content to train their models. Our current sub-processors are listed at karmaflow.ai/sub-processors.

Retention and deletion. Google account credentials are stored encrypted and are deleted when you disconnect. Disconnecting your Google account in Settings immediately revokes our access with Google, and you may choose at the same time — or at any later time — to permanently erase the data Karmaflow derived from your account, including knowledge extracted from your Drive files and its copies in your workspace's retrieval index. Workspace administrators can request the same erasure for their entire workspace. You can also email privacy@karmaflow.ai. You can review or revoke Karmaflow's access at any time in your Google Account security settings (myaccount.google.com/permissions).

9. AI Assistant Connectors

Customers can connect a third-party AI assistant, such as Anthropic's Claude or OpenAI's ChatGPT, to their Karmaflow workspace through our connector (a Model Context Protocol server), and can install our plugin for that assistant. This section describes how we handle Customer Data when they do, and it applies notwithstanding Section 1(c).

Who turns it on. A connection is made only by the customer: a workspace administrator creates a workspace API key, and the connection is approved once on Karmaflow's own authorization page. The person who connected can remove the connector from their assistant at any time, and a workspace administrator can ask us to end every connection to their workspace by writing to privacy@karmaflow.ai.

What the assistant can access. At the request of the person using the assistant, the connector returns workspace records: contacts and leads (including names, email addresses, phone numbers and company), companies, deals and their values, tasks and notes, support tickets and replies, conversation records and summaries, analytics, and knowledge-base articles. Each tool is labelled as reading or changing data. Changes, such as creating a task or replying to a ticket, are made only when the assistant calls a tool that does so, and they are recorded in the workspace like any other change.

Personal data removed before sharing. Each workspace can choose which categories of personal data (for example names, email addresses and phone numbers) are removed from connector results before they reach the assistant.

Where the data goes. We send connector results only to the assistant the customer connected. Once received, that data is handled under the assistant provider's own terms and privacy policy, which we do not control. We do not sell connector data, and we do not use it to train generalized artificial intelligence or machine-learning models.

Records we keep. We keep a log of connector activity (which tool was used, when, and for which workspace) for security, troubleshooting and billing, under Section 4 (Data Retention). Workspace data created or changed through a connector is retained under the customer's own workspace settings.

Our role. For data accessed through a connector, Karmaflow.ai remains a Processor acting on our customer's instructions, under our Terms of Service and Data Processing Addendum (DPA).

10. Children's Privacy

Our Site and Services are not intended for use by anyone under the age of 16. We do not knowingly collect personally identifiable information from children.

11. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last Updated” date.

12. Contact Us

If you have any questions about this Privacy Policy, please contact us:

• By email: privacy@karmaflow.ai
• By mail: Karmaflow Inc., Suite: 800, 150 Elgin St, Ottawa, ON K2P 1L5, Canada