Privacy Policy

This Privacy Policy explains how Phloz ("Phloz", "we", "us", or "our") collects, uses, shares, and protects information about you when you visit our website or use our product (together, the "Service"). It applies to visitors to phloz.com, people who create an account, and people whose information our customers put into the Service.

1. Who we are

The Service is operated by Phloz, based in Vancouver, British Columbia, Canada. For privacy questions or to exercise your rights, contact privacy@phloz.com.

Controller vs processor. For information about our own visitors and account holders (e.g. your email, usage data), we act as the data controller. For the content our customers load into their workspaces about their own clients and contacts, the customer is the controller and we act as a processor on their behalf, under our Terms of Service and Data Processing Addendum. If your data is in a Phloz workspace operated by an agency you work with, please direct requests to that agency.

2. Information we collect

Account data: your name, email, workspace name, and role. Payment details are collected and processed by Stripe; we do not receive or store full card numbers.

Content data: anything you or your team put into Phloz — clients and contacts, tasks, messages, tracking-map entries, files, and settings.

Usage data: pages and features used, actions taken, approximate location derived from IP, device/browser information, and event logs, collected to operate, secure, and improve the Service.

Communications: emails and support messages you send us, and whether you open our transactional or marketing emails.

3. How we use information, and our legal bases

We use information to:

• provide, maintain, and secure the Service and authenticate you;
• process payments and manage subscriptions;
• send transactional emails (e.g. magic links, notifications) and, with your consent where required, product news;
• analyse and improve the product, and detect and prevent abuse;
• comply with legal obligations.

Where the EU/UK GDPR applies, our legal bases are: performance of a contract (to provide the Service you signed up for), our legitimate interests (to secure, improve, and market the Service in a proportionate way), your consent (for optional analytics cookies and marketing email, withdrawable at any time), and compliance with legal obligations.

4. Cookies and analytics

We use three categories of cookies and similar technologies:

• Strictly necessary — authentication sessions, security, and your consent + theme preferences. These are always on because the Service can't function without them.
• Analytics — Google Analytics 4, Google Tag Manager, and PostHog, used to understand product usage, and Microsoft Clarity, which shows how visitors use phloz.com (clicks, scrolling and page interactions, as heatmaps and session replays). In the European Union and EEA, the United Kingdom, Switzerland and Quebec, and whenever your browser sends a Global Privacy Control signal, these stay off until you accept them in our cookie banner: we implement Google Consent Mode v2 and default that storage to denied. Elsewhere they are on by default; the banner says so, and you can turn them off there at any time. PostHog, in the Phloz app, runs only after you allow it, wherever you are.
• Advertising measurement — Microsoft Advertising (Universal Event Tracking) and Google Ads conversion measurement, which tell us which of our ads brought a visitor to phloz.com and what they did there. These load only on phloz.com, under the same rule as analytics: after you accept where we ask first, and by default elsewhere unless you turn them off. The Phloz app (app.phloz.com) doesn't load them.

You can change or withdraw your choice at any time — as easily as you gave it — using the "Cookie preferences" control in our site footer, or, if you have a Phloz account, under Settings → Privacy & cookies in the app. Your choice is stored in a first-party cookie shared across phloz.com and app.phloz.com, so setting it in either place applies to both. You can also clear or block cookies via your browser settings.

5. How we share information (sub-processors)

We share data only with service providers that help us run the Service, under contracts that require them to protect it and use it only on our instructions:

• Supabase — database, authentication, and file storage
• Vercel — application hosting and delivery
• Cloudflare — DNS and network security
• Stripe — payment processing
• Resend — transactional and inbound email
• Inngest — background job orchestration
• Upstash — rate limiting and abuse prevention
• Google (Analytics 4 & Tag Manager) — website and product analytics
• PostHog — product analytics
• Microsoft (Clarity) — website heatmaps and session replays on phloz.com
• Microsoft (Advertising) and Google (Ads) — ad conversion measurement on phloz.com, under the cookie rules in section 4
• Sentry — error monitoring

We may also disclose information if required by law, to protect our rights or users' safety, or in connection with a merger or acquisition (with notice where required). Our current sub-processor list — with each provider's purpose and location — is kept up to date, and material changes are announced to account holders.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

6. AI and connected clients

Phloz does not send your content to third-party AI providers on its own. Some features let a workspace connect an external AI assistant or other client through our MCP server; any data that client accesses is then governed by that provider's terms and privacy policy, under the workspace's control. AI-drafted message replies are never sent automatically — a person reviews and sends them. A workspace's owners and admins can hide any client from every connected AI assistant, and can pause all changes made through them.

7. Google user data

An owner or admin of a workspace can connect a Google account to Phloz (Settings → Integrations → Connect Google). With that account's permission, Phloz requests these Google scopes:

• openid and email, to show which Google account is connected
• analytics.readonly, for Google Analytics 4
• tagmanager.readonly, for Google Tag Manager
• adwords, for Google Ads (Google offers no read-only version of it)

What Phloz reads. Only what the features below need:

• Google Analytics: accounts, properties and data streams, and report figures (sessions and key events by channel, and sessions by landing page, for the last 30 days against the 30 before).
• Tag Manager: accounts and containers (their names, public IDs and server addresses).
• Google Ads: the accounts the Google login can reach, with their campaigns, budgets and bidding settings, ad groups, ads, keywords, search terms, negative keywords, locations, assets, recommendations, conversion actions and performance figures.

Phloz never changes anything in Google. Every call it makes to Google Analytics, Tag Manager and Google Ads is a read.

How Phloz uses it. Only to provide features you see in Phloz:

• importing properties, containers and Google Ads accounts onto a client's tracking map
• the Google Analytics and Google Ads cards on a client's page
• importing Search campaigns into a client's plans
• the weekly Google Ads audit
• the daily Google Ads check, its alerts and the alert emails to your team

Phloz does not use Google user data for advertising, does not sell it, and does not use it to develop, improve or train AI or machine-learning models.

How Phloz stores it. The connection's tokens are encrypted (AES-256-GCM). The connected account's email address is stored with the connection. What a feature saves is stored with the client in your workspace's database:

• names and IDs imported onto the tracking map
• campaigns imported into plans
• the 8 most recent weekly Google Ads audits and the 14 most recent daily checks for each client
• each Google Ads alert with its figures, and any task your team makes from one (its text and campaign names)

Google Analytics report figures and the Google Ads card are read when you open them and are not stored. Data is stored in the United States (section 8).

Who it is shared with.

• Your team: members of your workspace see it according to their role and the clients they can open. Google Ads alert emails go to the teammates assigned to the client, or to owners and admins.
• Your clients: they don't see your Google data in the client portal, unless you share a plan imported from Google Ads with them.
• Service providers: it passes through the providers that run the Service, under the terms in section 5: Supabase (storage), Vercel (hosting; its logs can hold an error message from Google), Inngest (the scheduled checks), Resend (alert emails) and Sentry (error reports).
• AI assistants you connect: if your workspace connects an AI assistant through Phloz's MCP server, that assistant can read the stored Google Ads alerts, daily figures, audits and tracking maps when you or your teammates ask it to, under that provider's terms (section 6).
• The law: we disclose data where the law requires it, as section 5 says.

Google user data goes to no one else.

People at Phloz don't read your Google data except:

• with your permission, to help with a support request
• to investigate security or abuse
• where the law requires it

Disconnecting and deletion. Disconnecting Google in Settings asks Google to revoke Phloz's access and deletes the stored tokens. You can also remove Phloz's access from your Google account at myaccount.google.com/permissions. What a feature already saved stays with the client until you delete it, or until you ask us to at privacy@phloz.com (section 10).

Phloz's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. International transfers

Data is stored and processed in the United States by our hosting providers. If you are in the EEA, UK, or Switzerland, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

9. Data retention

We retain account and content data for as long as your workspace is active and for 30 days after cancellation (to allow export), after which it is deleted or anonymised. Analytics data is retained for up to 26 months. We keep some records longer where required for legal, tax, or security purposes.

10. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, port, or restrict the processing of your personal data, and to object to certain processing. You can also withdraw consent at any time (this does not affect prior processing). To exercise any of these, email privacy@phloz.com; we respond within the timeframes required by applicable law and may need to verify your identity.

EEA/UK: you have the right to lodge a complaint with your local data protection supervisory authority.

California (CCPA/CPRA): you have the right to know, delete, and correct your personal information, and to opt out of "sale" or "sharing" — though, as noted above, we do not sell or share personal information. We will not discriminate against you for exercising these rights.

Canada (PIPEDA): you may access and request correction of the personal information we hold about you, and you have the right to complain to the Office of the Privacy Commissioner of Canada.

11. Security

We protect data with row-level security for tenant isolation, encrypted transport (TLS) for all traffic, signed authentication tokens, and least-privilege access controls. No system is perfectly secure, but security is an ongoing program; a SOC 2 audit is on our roadmap. If you believe you've found a vulnerability, see our security.txt.

12. Children

Phloz is a business tool not directed to children under 16, and we do not knowingly collect their personal data.

13. Changes

We may update this Policy from time to time. We'll revise the "Last updated" date above and, for material changes, notify account holders by email or in-app notice.

14. Contact

Questions or requests? Email privacy@phloz.com — Phloz, Vancouver, BC, Canada.