Privacy Policy

Version 1.3 · Last Updated: July 31, 2026

1. Who This Policy Covers, and Two Different Roles

When a business signs up for FlameGrower and uploads its own customers' or patients' contact information to send review requests, that business is the one deciding why and how that information is used — legally, the "Controller" (or "Business" under California law). FlameGrower processes that information on the business's behalf and instructions — legally, the "Processor" (or "Service Provider"). This policy describes both: how we handle a Client's own account data (where we are the Controller) and how we handle the contact lists a Client uploads (where the Client is the Controller and we process on their behalf, as detailed in the Data Processing Addendum in our Terms of Service).

2. Information We Collect

• Account and business information: your name, email, business name, business mailing address, and login credentials.
• Billing information: handled directly by our payment processor, Stripe; we do not store your full card number.
• Contact lists you upload: names, email addresses, and (once SMS ships) phone numbers of your customers or patients, provided so we can send review requests on your behalf.
• Review and reply data: reviews synced from your connected Google Business Profile, and the AI-drafted and approved replies associated with them.
• Usage data: how you use the dashboard, log data, and device/browser information.
• Cookies and tracking on our own marketing site: The Service's dashboard uses a session cookie to keep you logged in and functioning correctly — that's required for the Service to work. Separately, FlameGrower's own public marketing pages — our homepage, sign-in and sign-up screens, help center, and legal pages including this one (not the Service dashboard itself) — run two tools. Mautic is a tool we host ourselves, on infrastructure we control (self-hosted at outreach.flamegrower.com). It sets a first-party cookie (mtc_id / mtc_sid) and records your IP address, the pages you viewed, the page that referred you there, and your browser and device information; that data is not disclosed to anyone outside FlameGrower. If you later click a tracked link in a FlameGrower marketing email or submit a form on our site (for example, a contact or demo request), Mautic links that browsing history — including visits that happened before we knew who you were — to your name and email as a marketing contact record. Google Analytics is a tool operated by Google that we also run on these same pages. It records similar information — your device, browser, IP address, the pages you viewed, and the page that referred you there — and sends it to Google, a third party, under Google's own terms. Our basis for running both tools is our legitimate interest in understanding and improving our own marketing, or your consent where the law of the place you're accessing this site from requires consent before this kind of tracking runs. We reserve the right to sell or share this marketing-site visitor information — directly or indirectly, and including for cross-context behavioral advertising — both through the tools named above and through other advertising, analytics, or data partners we may engage as our marketing program grows. You have a right to opt out of that, described fully in Section 8: at Your Privacy Choices, or automatically, with nothing for you to do, if your browser or device sends the Global Privacy Control (GPC) signal. You can also control cookies through your browser's settings at any time. None of this — the tools named above, or the sale/share reservation just described — runs on or reaches a Client's white-labelled client portal, the embeddable review widget rendered on a Client's own website, or the public review-request page a Client's customers or patients use to leave a review; that data stays governed by Section 3 and the Data Processing Addendum in our Terms of Service, and is never sold or shared. See Section 8 for the full statement of these rights and how to exercise them.

3. How We Use Information

• To operate the Service: sync your reviews, send review-request emails, generate AI-drafted reply suggestions, build your monthly report, and render your public widget.
• To bill you and manage your subscription.
• To provide customer support.
• To meet legal obligations, like responding to a lawful request or maintaining CAN-SPAM opt-out records.

We do not sell or share the personal information described in this section — the information we collect and use to operate the Service itself, including a Client's uploaded customer or patient contact lists. We do not use a Client's uploaded contact lists to build our own marketing lists, and we do not combine one Client's customer data with another Client's for any purpose. This is a separate promise from, and is not affected by, the sale/share reservation described in Section 2 and Section 8 — that reservation applies only to marketing-site visitor information collected through the tools described in Section 2, where FlameGrower acts as a controller of its own marketing data, never to the Service-operation and Client contact-list data described in this section.

4. Google User Data — Limited Use Disclosure

FlameGrower's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. We access your Google Business Profile data only to display and manage your reviews within the Service. We do not use Google user data for advertising, we do not sell it, and we do not allow anyone to read it except: (a) with your consent, (b) for security purposes, (c) to comply with applicable law, or (d) as part of a merger or acquisition subject to continued application of this policy.

5. AI Reply Drafting

When you use the Service's AI reply feature, the text of the review is sent to an AI language model provider to generate a draft: DeepSeek by default, or Anthropic if you've added your own API key. These providers process that review text under their own data-handling terms in order to return a draft to you. A draft is never posted automatically — it is always shown to you for review and approval first.

6. Who We Share Information With

We share information with the following service providers, only as needed to operate the Service, and under contracts that limit their use of it:

• Amazon Web Services (SES) — to send review-request and account emails.
• Stripe — to process payments.
• Our infrastructure host (Hetzner, via Coolify) — to host the application and store data.
• n8n (self-hosted at flint.flamegrower.com) — to run automated workflows such as recovery sequences and report scheduling.
• Google — to access and display your Business Profile reviews, as described above.
• DeepSeek, and, if you've connected your own key, Anthropic — to draft suggested reply text, as described above.

We disclose information if required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets, subject to the commitments in this policy carrying forward.

This section describes how we handle information collected to operate the Service on a Client's behalf, where we act as a processor. It's separate from FlameGrower's own marketing-site tracking described in Section 2, which involves different data — visitors to FlameGrower's own marketing pages, not a Client's Service data — and a different role, where FlameGrower acts as a controller of its own marketing information, including the recipients of that marketing-site data covered by the sale/share reservation described in Section 2 and Section 8.

7. Data Retention

We keep your information for as long as your account is active. If your account is cancelled or terminated, we delete your data from our active production systems within 30 days, unless we're required to keep it longer by law. One exception: your data may still exist afterward in our system-wide backups. Those backups exist to recover the entire system after a failure, cover every client together, and are not separable or erasable on a per-client basis without compromising their ability to recover the system as a whole. Backup data isn't accessed or used for any purpose other than disaster recovery, and it stays protected by the same security measures described in Section 12 for as long as our backup process retains it.

8. Your Privacy Rights

If you're a resident of Texas, California, or another state with a comprehensive privacy law, you generally have the right to know what personal information we hold about you, correct it, and delete it.

For the marketing-site visitor information described in Section 2 — collected through Mautic and Google Analytics on FlameGrower's own homepage, sign-in and sign-up screens, help center, and legal pages — FlameGrower sells or shares that information, directly or indirectly, including for cross-context behavioral advertising, as described in Section 2. You have the right to opt out of that sale/sharing, and you can exercise it in either of two ways: at Your Privacy Choices, or automatically — if your browser or device sends the Global Privacy Control (GPC) signal, we honor it as a valid opt-out request the moment your browser sends it, with no visit to that page and no other action required. A choice you make on that page overrides a GPC signal, in either direction, for as long as your choice is in effect.

This right, and the reservation it responds to, apply only to the marketing-site visitor information described in Section 2. They do not apply to, and do not change, how we handle information collected to operate the Service itself — your account information, billing information, or a Client's uploaded customer or patient contact lists — which is handled only as described in Section 3 and the Data Processing Addendum in our Terms of Service, and which we do not sell or share.

For any other privacy right — to know, correct, or delete your personal information, or to appeal a decision we've made about a request — contact us at the address in Section 14 and we'll address your request. If you're the customer or patient of one of our Clients (not a FlameGrower account holder yourself), the fastest path is usually to contact that business directly, since they control why your information was collected; we'll assist them in fulfilling your request.

9. Reviewer Data on Widgets

When you embed a review widget, it displays reviewer names and profile photos as they appear publicly on Google, with attribution to Google. That information is provided by the reviewer to Google, is already public, and is displayed here consistent with how Google's platform intends it to be reused.

10. International Users

FlameGrower is based in the United States and markets this Service to U.S. businesses. If you access the Service from the European Economic Area, the United Kingdom, or another jurisdiction with its own transfer requirements, additional terms may apply and will be provided if applicable.

11. Children's Privacy

The Service is intended for businesses, not children. We do not knowingly collect personal information directly from children under 13.

12. Security

We encrypt personal information in transit and at rest, limit access to it based on role, and maintain a process for responding to a security incident. No system is perfectly secure, and we can't guarantee absolute security.

13. Changes to This Policy

We may update this policy. Minor updates take effect once posted, with an updated "Last Updated" date. Material changes to what we collect or how we use it will be announced by email with at least 30 days' notice before taking effect for existing accounts.

14. Contact Us

FlameGrower LLC, 1300 W 19th St #7042, Houston, TX 77008. Email: [email protected].