Karmaflow.ai Privacy Policy

Last Updated: August 22, 2026

Karmaflow Inc. (“Karmaflow.ai”, “we”, “us”, “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website karmaflow.ai (the “Site”), and when you use our services (the “Services”).

Please read this Privacy Policy carefully. By using our Site or Services, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

We collect information in a few different ways:

a) Information You Provide to Us:

• Contact Information: When you fill out a contact form, request a demo, or communicate with us, you may provide us with your name, email address, phone number, company name, and job title.
• Account Information: When our customers register for our Services, we collect usernames, email addresses, and passwords.
• Billing Information: To process payments for our Services, we may collect billing details, which are processed by our third-party payment processors.

b) Information We Collect Automatically:

• Log and Usage Data: Like most websites, we automatically collect information when you visit our Site, including your IP address, browser type, operating system, referring URLs, pages viewed, and timestamps.
• Cookies and Similar Technologies: We use cookies to operate and administer our Site and to improve your experience. A cookie is a piece of information sent to your browser from a website. You can control the use of cookies at the individual browser level.

c) Customer Data Processed within our Services:

Our customers and their end-users may submit data or content to our Services for processing, including the content of voice calls, chats, SMS messages, and emails (“Customer Data”). Our processing of Customer Data is governed by our Terms of Service and our Data Processing Addendum (DPA) with our customers. Karmaflow.ai is a Processor of this Customer Data, and our customer is the Controller. This Privacy Policy does not apply to Customer Data, with one exception: Section 8 (Google User Data) applies to information received from Google APIs regardless of how it is classified elsewhere in this policy.

2. How We Use Your Information

We use the information we collect for various purposes:

• To Provide and Maintain our Site and Services: To operate our Site, create and manage customer accounts, and provide our Services.
• To Communicate with You: To respond to your inquiries, send you administrative information, and provide customer support.
• For Marketing and Advertising: To send you promotional communications about our products and services. You may opt-out of receiving marketing communications at any time.
• To Improve our Site and Services: To understand how our users interact with our Site and Services, to monitor performance, and to develop new features.
• For Security and Compliance: To prevent fraud, enforce our terms, and comply with legal obligations.

3. How We Share Your Information

We do not sell your personal information. We may share your information in the following situations:

• With Service Providers (Sub-processors): We share information with third-party vendors and service providers who help us operate our business, such as cloud hosting providers, communication providers, analytics tools, and AI model providers. A list of our sub-processors is available on our website.
• For Legal Reasons: We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or a government agency).
• In Business Transfers: We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

4. Data Retention

We will retain your personal information only for as long as is necessary for the purposes set out in this Privacy Policy, or as required to comply with our legal obligations, resolve disputes, and enforce our agreements.

5. Your Data Protection Rights

Depending on your location, you may have the following rights regarding your personal information:

• The right to access, update, or delete the information we have on you.
• The right of rectification.
• The right to object to our processing of your personal information.
• The right of restriction.
• The right to data portability.
• The right to withdraw consent.

To exercise any of these rights, please contact us at privacy@karmaflow.ai.

6. International Data Transfers

Your information, including personal data, may be transferred to—and maintained on—computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ. Our practices for international transfers are governed by our Data Processing Addendum (DPA).

7. Information for Residents of Canada and California

Canada (PIPEDA): We comply with Canada's Personal Information Protection and Electronic Documents Act. If you are a resident of Canada, you have the right to access the personal information we hold about you and to request that we correct any inaccuracies.

California (CCPA/CPRA): If you are a California resident, you have specific rights regarding your personal information. We act as a "Service Provider" for the Customer Data we process on behalf of our customers. For information we collect on our own behalf, we provide you with the rights to know, delete, and opt-out of the sale or sharing of your personal information (note: we do not sell or share your personal information).

8. Google User Data

Some Karmaflow features let individual users connect their own Google account (Gmail, Google Calendar, Google Drive, Google Sheets, Google Docs, and Google Slides) through Google's OAuth consent flow. This section describes how we handle information received from Google APIs, and it applies notwithstanding Section 1(c).

Karmaflow's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we access, and why. Access is granted per user, per product, and only after an in-app disclosure and Google's own consent screen:

• Gmail — reading, sending, searching, and labeling email, so AI agents can summarize messages you point them at, send email you or your workflows compose, and file or archive messages. We do not delete messages or change account settings.
• Google Calendar — reading, creating, updating, and sharing events, so agents can check availability, book and reschedule meetings, and share a calendar when you ask.
• Google Drive — searching, reading, uploading, and organizing files, so agents can find and read files you ask about, save generated documents, and file CRM attachments into folders your workspace configures.
• Google Sheets, Docs, and Slides — reading and adding to spreadsheets, documents, and presentations at your direction.

How we use it. Google user data is used only to provide these user-facing features, at your or your workspace's direction. We do not use Google user data for advertising. We do not sell it. Humans at Karmaflow do not read it except with your explicit permission, where necessary for security or abuse investigation, to comply with applicable law, or where the data has been aggregated and anonymized for internal operations.

AI models. We do not use Google user data, or data derived from it, to develop, improve, or train generalized or non-personalized artificial intelligence or machine-learning models. Content from connected Google accounts is used only to provide features to the workspace it came from — for example, retrieval that grounds an AI agent's answers in your own documents.

Transfers. We transfer Google user data only to the sub-processors needed to provide these features. In particular, when your workspace uses Drive-based knowledge features, content from Drive files you choose is processed and stored in your workspace's private retrieval index hosted by OpenAI so your agents can answer questions from those documents. We obtain your consent to this transfer in the app before you connect your Google account, and our sub-processors are contractually prohibited from using this content to train their models. Our current sub-processors are listed at karmaflow.ai/sub-processors.

Retention and deletion. Google account credentials are stored encrypted and are deleted when you disconnect. Disconnecting your Google account in Settings immediately revokes our access with Google, and you may choose at the same time — or at any later time — to permanently erase the data Karmaflow derived from your account, including knowledge extracted from your Drive files and its copies in your workspace's retrieval index. Workspace administrators can request the same erasure for their entire workspace. You can also email privacy@karmaflow.ai. You can review or revoke Karmaflow's access at any time in your Google Account security settings (myaccount.google.com/permissions).

9. Children's Privacy

Our Site and Services are not intended for use by anyone under the age of 16. We do not knowingly collect personally identifiable information from children.

10. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last Updated” date.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us:

• By email: privacy@karmaflow.ai
• By mail: Karmaflow Inc., Suite: 800, 150 Elgin St, Ottawa, ON K2P 1L5, Canada