1. Introduction

NomadFlow.ai ("we," "us," "our," or "Company") is committed to protecting your privacy and ensuring you have a positive experience on our platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our subscription-based Software-as-a-Service (SaaS) application (the "Service").

Please read this Privacy Policy carefully. If you do not agree with our policies and practices, please do not use our Service.

2. Scope and Applicability

This Privacy Policy applies to:

• Our website: https://nomadflow.ai
• Our mobile and web application (the "App")
• All related services and features

This policy does not apply to third-party websites, applications, or services that we do not operate or control, even if we link to them.

3. Information We Collect

3.1 Information You Provide Directly

Account Registration & Profile Information:

• Name, email address, and password
• Phone number (optional)
• Profile preferences, work location, travel interests
• Subscription tier and plan selection
• Photo or avatar (optional)

Payment Information:

• Billing address, payment method details (processed securely via Stripe)
• Subscription renewal dates and payment history
• Invoice records and transaction information

Calendar & Integration Data:

• Google Calendar events, meeting titles, times, and attendees (if you authorize Google Calendar integration)
• Your time zone and schedule preferences
• Collaboration invitations and team member information

Content You Create:

• Travel blueprints, itineraries, and planning notes
• Budget entries, expense tracking, and financial preferences
• Messages, comments, and collaboration notes
• Saved templates and personal settings
• Preferences for activity suggestions and travel recommendations

Communication Data:

• Support inquiries, feedback, bug reports, and feature requests
• Emails, messages, and correspondence with our team
• Survey responses and testimonials

3.2 Information Collected Automatically

Usage & Interaction Data:

• Pages visited, features accessed, and actions taken within the App
• Time spent on the App, click patterns, and navigation flows
• Device type, operating system, browser type, and version
• IP address, approximate location (city/country level)
• Session identifiers and unique device identifiers

Analytics Data:

• Google Analytics and similar tracking tools to understand user behavior
• Aggregate usage patterns and feature popularity
• Conversion metrics, user retention, and engagement rates

Cookies & Tracking Technologies:

• Session cookies (required for authentication)
• Preference cookies (to remember your settings)
• Analytics cookies (to measure usage)
• Third-party cookies from Stripe, Google Analytics, and integrated services

Log Data:

• Error logs, system performance metrics, and access logs
• Timestamps of your interactions
• Diagnostic information related to service issues

3.3 Information from Third Parties

From Third-Party Services:

• Stripe: Payment processing and billing verification
• Google Calendar API: Calendar events and scheduling data
• LeadConnector/GoHighLevel: CRM data and automation tracking
• Base44: Workflow execution and backend performance data
• Google Analytics: Aggregated usage insights

From Other Users:

• Information shared with you through collaboration features
• Comments, messages, and mentions involving your account

4. Legal Basis for Data Processing

We process your personal data based on the following legal grounds:

4.1 Consent

You explicitly opt-in to marketing communications, optional analytics, or non-essential cookies

4.2 Performance of Contract

Processing necessary to deliver the Service, manage your subscription, process payments, and provide customer support

4.3 Legitimate Interest

• Understanding user behavior to improve the Service
• Preventing fraud, abuse, and security threats
• Personalizing your experience and recommendations
• Conducting analytics and business intelligence
• Communicating about updates, maintenance, and service announcements

4.4 Legal Obligation

• Complying with tax law, financial regulations, and legal requests
• Maintaining audit trails and records for legal compliance

4.5 Vital Interests

Protecting user safety and preventing harm

5. How We Use Your Information

We use collected information for the following purposes:

Service Delivery:

• Creating and maintaining your account
• Processing payments and managing subscriptions
• Delivering app features (blueprints, AI suggestions, scheduling, collaboration)
• Syncing with Google Calendar and other integrated services
• Personalizing your experience and remembering preferences

Communication:

• Sending transactional emails (account confirmations, password resets, subscription updates)
• Responding to your inquiries and support requests
• Notifying you of service changes, maintenance, or security issues
• Sending promotional content (with your consent)

Analytics & Improvement:

• Analyzing usage patterns to enhance features and user experience
• Understanding which features are most valuable
• Identifying bugs, errors, and performance issues
• Conducting A/B testing to optimize the Service

Personalization:

• Providing AI-powered activity suggestions and travel recommendations
• Customizing templates and blueprints based on your preferences
• Offering content relevant to your interests and travel patterns

Security & Safety:

• Detecting, preventing, and addressing fraud, abuse, and security threats
• Protecting against unauthorized access and data breaches
• Investigating suspicious activity and policy violations
• Ensuring compliance with our Terms of Service

Legal & Compliance:

• Fulfilling legal obligations and responding to lawful requests
• Enforcing our agreements and protecting legal rights
• Maintaining audit trails for regulatory compliance

Marketing & Analytics:

• Creating anonymized, aggregated reports on user demographics and behavior
• Benchmarking against industry standards
• Measuring the effectiveness of marketing campaigns

6. How We Share Your Information

6.1 Service Providers

We share data with third-party vendors who perform services on our behalf:

• Stripe: Payment processing and billing (PCI DSS compliant)
• Google: Calendar integration, analytics, cloud infrastructure
• LeadConnector/GoHighLevel: CRM, email automation, user engagement tracking
• Base44: Backend platform, workflow execution, database hosting
• Email service providers: Transactional and marketing communications

These vendors are contractually bound to use your data only as needed to provide services to us and to maintain strict data confidentiality.

6.2 Collaboration & Sharing

• Information you intentionally share with collaborators or team members within the App
• Public blueprints or content you choose to make visible to other users

6.3 Legal Requirements

We may disclose your information if required by law, court order, government request, or when we believe in good faith that disclosure is necessary to:

• Comply with legal obligations or regulatory requirements
• Enforce our Terms of Service and other agreements
• Protect the safety, rights, and property of our company, users, and the public
• Prevent fraud or other illegal activity

6.4 Business Transfers

If NomadFlow.ai is involved in a merger, acquisition, bankruptcy, dissolution, reorganization, or similar transaction or proceeding, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

6.5 Aggregated & Anonymized Data

We may share aggregated, anonymized data that cannot identify you personally for research, marketing, analytics, and other purposes without restriction.

6.6 No Sale of Personal Data

We do not sell, rent, or lease your personal data to third parties for marketing purposes. California residents have additional rights (see CCPA section).

7. Data Retention

We retain your information for as long as necessary to provide the Service and fulfill the purposes outlined in this Privacy Policy.

Account Information:

• Retained while your account is active and for 12 months after cancellation (for legal, tax, and dispute resolution purposes)
• You may request earlier deletion of your data

Payment Information:

• Retained for the duration of your subscription plus 7 years (required for tax and financial compliance)
• Stripe retains payment data according to their retention policies

Calendar & Integration Data:

• Retained while integrations are active
• Deleted within 30 days after you disconnect the integration

Usage & Analytics Data:

• Aggregated analytics retained indefinitely
• Individual session logs retained for 12 months for security and troubleshooting

Communication Data:

• Support emails and messages retained for 3 years
• Marketing communications deleted upon unsubscribe request

Inactive Accounts:

Accounts inactive for 24 months may be subject to deletion after 30-day notice

You can request deletion of your personal data at any time by contacting us (see Contact Information).

8. Your Privacy Rights & Choices

8.1 Access & Portability

You have the right to request a copy of the personal information we hold about you. We will provide this information in a portable, machine-readable format upon request.

8.2 Rectification

You can correct inaccurate or incomplete information by updating your account profile or contacting us directly.

8.3 Deletion ("Right to Be Forgotten")

You can request deletion of your personal data. We will delete your information within 30 days, except where we are required to retain it for legal, tax, or contractual reasons.

Note: Deletion of your account will remove your blueprints, settings, and personal data from our active systems. Backup copies may persist for up to 90 days.

8.4 Restriction of Processing

You can request that we limit how we use your information while we address your concerns or verify your request.

8.5 Objection

You have the right to object to certain processing activities, including:

• Marketing communications (you can unsubscribe at any time)
• Analytics and tracking (you can opt-out via your account settings)
• Personalized recommendations (you can disable this feature)

8.6 Withdrawal of Consent

If we process your data based on your consent, you can withdraw that consent at any time. This will not affect the lawfulness of processing before withdrawal.

8.7 Exercising Your Rights

To exercise any of these rights, contact us at support@nomadflow.ai with:

• Your full name and email address associated with your account
• Specific description of your request
• Proof of identity (to prevent unauthorized data access)

We will respond within 30 days (or 45 days if your request is complex).

9. GDPR Compliance (European Users)

If you are located in the European Union, European Economic Area, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

Legal Basis: We rely on the legal bases described in Section 4.

Data Controller: NomadFlow.ai is the data controller responsible for your personal data.

Data Processing Agreement: Businesses that use NomadFlow.ai for processing personal data on behalf of their users may request a Data Processing Agreement (DPA) from us.

Your Rights: Beyond those listed above, you have the right to lodge a complaint with your local data protection authority if you believe we have violated your privacy rights.

Data Transfers: If you are in the EU/EEA, your data may be transferred to the United States and processed there. We ensure appropriate safeguards (such as Standard Contractual Clauses) are in place for such transfers. By using NomadFlow.ai, you consent to this transfer.

Contact: For GDPR-related inquiries, contact our Data Protection Officer at privacy@nomadflow.ai.

10. CCPA Compliance (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you the following rights:

10.1 Right to Know

You have the right to request what personal information we collect, use, and share about you.

10.2 Right to Delete

You can request deletion of personal information we have collected from you, with some exceptions (e.g., when needed for legal compliance, fraud prevention, or contract fulfillment).

10.3 Right to Opt-Out

You have the right to opt-out of the "sale" or "sharing" of your personal information. Under CCPA, "sale" includes sharing data for cross-context behavioral advertising. We do not sell your personal data; however, our use of cookies and analytics may constitute "sharing" under CCPA's broad definition.

To Opt-Out: You can disable non-essential cookies and analytics in your account settings or contact us at support@nomadflow.ai.

10.4 Right to Correct

You have the right to correct inaccurate personal information.

10.5 Right to Limit Use

You can request that we limit our use of your personal information to what is necessary to provide the Service.

10.6 Right to Non-Discrimination

We will not discriminate against you for exercising your CCPA rights (e.g., by denying service, charging different prices, or providing different quality of service).

Authorized Agent: You may authorize an agent to submit requests on your behalf. We may require proof of authorization.

How to Submit Requests: Contact us at support@nomadflow.ai or via our webform with:

• Your name and email address
• Type of request (Know, Delete, Opt-Out, Correct, Limit)
• Proof of identity

We will respond within 45 days.

11. Cookies & Tracking Technologies

11.1 Types of Cookies We Use

Essential Cookies:

• Session authentication (required to keep you logged in)
• CSRF protection (prevents security attacks)
• Payment processing (required for Stripe transactions)

Preference Cookies:

• Language and timezone settings
• Theme preferences (dark mode, light mode)
• Account settings and customizations

Analytics Cookies:

• Google Analytics to measure usage and performance
• Conversion tracking to understand user journeys
• Feature usage metrics

Third-Party Cookies:

• Stripe for payment processing
• Google for calendar integration and analytics
• LeadConnector/GoHighLevel for CRM tracking

11.2 Your Cookie Choices

Essential Cookies: Cannot be disabled (required for the Service to function).

Optional Cookies: You can disable non-essential cookies by:

• Adjusting your browser cookie settings
• Using our cookie management tool (available in account settings or on first visit)
• Installing a browser extension to block third-party cookies

Do Not Track: If your browser sends a "Do Not Track" signal, we will honor requests to limit analytics cookies, though some functionality may be affected.

11.3 Third-Party Tracking

Our third-party partners may use cookies to track your activity across websites. You can opt-out of Google Analytics tracking via the Google Analytics Opt-Out Browser Add-On.

12. Security Measures

We implement comprehensive security practices to protect your personal information:

Technical Safeguards:

• HTTPS encryption for all data in transit
• AES-256 encryption for sensitive data at rest
• Secure password hashing (bcrypt or equivalent)
• Regular security audits and penetration testing
• Intrusion detection and prevention systems

Administrative Safeguards:

• Limited access to personal data (principle of least privilege)
• Employee training on data protection and privacy practices
• Confidentiality agreements with all staff and contractors
• Regular security training and awareness programs

Physical Safeguards:

• Secure data centers with access controls
• Backup and disaster recovery procedures
• Data redundancy to prevent loss

However: No security system is impenetrable. While we strive to protect your information, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your login credentials.

13. Data Breach Notification

In the event of a data breach involving your personal information, we will:

• Notify affected individuals without unreasonable delay (within 72 hours where legally required)
• Provide information about the breach, affected data, and steps you should take
• Comply with GDPR, CCPA, and other applicable breach notification laws
• Report the breach to relevant regulatory authorities as required

Contact: In case of a security incident, contact support@nomadflow.ai immediately.

14. International Data Transfers

NomadFlow.ai is based in the United States. Your personal information may be transferred to, processed in, and stored in the United States and other countries where we or our service providers operate.

For International Users:

• The U.S. and other countries may not have data protection laws equivalent to your home country
• By using NomadFlow.ai, you consent to the transfer of your information internationally
• We implement Standard Contractual Clauses and other safeguards to protect transferred data
• For EU/EEA residents, we ensure data transfers comply with GDPR requirements

15. Children's Privacy

NomadFlow.ai is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children under 13 (or the minimum age of digital consent in their jurisdiction).

If we become aware that we have collected information from a child under 13, we will delete it immediately and notify the parent or guardian.

Parents/Guardians: If you believe we have collected information from a minor, contact support@nomadflow.ai.

16. Third-Party Links & Services

NomadFlow.ai may contain links to third-party websites, applications, and services (including Google Calendar, Stripe, and LeadConnector) that we do not operate.

Important: This Privacy Policy does not apply to third-party services. We are not responsible for their privacy practices, data handling, or content. Please review their privacy policies before using their services or sharing your information.

17. Privacy Policy Updates

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by:

• Posting the updated policy on our website with an updated "Last Updated" date
• Sending you an email notification (for significant changes)
• Requesting your consent (where required by law)

Your continued use of NomadFlow.ai after updates constitutes acceptance of the revised Privacy Policy. We encourage you to review this policy regularly to stay informed of how we protect your privacy.

18. Contact Information

For questions, requests, or concerns about this Privacy Policy or our privacy practices, contact us:

19. Additional Resources

• GDPR Information: https://gdpr-info.eu/
• CCPA Information: https://oag.ca.gov/privacy/ccpa
• Stripe Privacy: https://stripe.com/privacy
• Google Privacy: https://policies.google.com/privacy
• Our Terms of Service: View Terms