Privacy Policy

Account information. Name, email address, business name, and password (stored as a salted hash, never in plain text) when you sign up.

Connected Google accounts. When you connect Gmail via Google OAuth, we request only permission to send email on your behalf (scope: gmail.send) — we do not read your inbox through Google's API. Instead, you set up a mailbox forwarding rule (in Gmail's own settings) that forwards incoming mail to a private, per-account address we provide; our system receives and processes that forwarded mail in order to generate and send replies. When you separately connect Google Calendar from the Bookings page (scope: calendar), we access your calendar to check availability and create, update, or cancel events. When you separately connect your Google Business Profile from the Reviews page (scope: business.manage), we access customer reviews to generate and post owner responses you approve. These are independent connections — connecting one does not grant access to the others, and each can be disconnected independently at any time.

Forwarded email content. A message forwarded to your account's private address is parsed to extract the sender, subject, and body needed to generate a reply. Bulk/automated mail (newsletters, mailing lists, no-reply senders) is detected and discarded without being processed by our AI. For customer emails processed by the agent, we store the incoming email details, generated replies, and execution status in your activity history solely so you can review, audit, and monitor what was received and how our AI replied. We do not mine, analyze, aggregate, monetize, or perform any secondary background processing on this stored user data. This email history is retained strictly for your plan's retention period (3 days on Free, 30 days on Starter, 90 days on Growth, up to 180 days on Agency), after which it is 100% permanently deleted.

Business profile data. Business details, working hours, tone preferences, and knowledge you provide so our AI agents can respond accurately on your behalf.

Contacts and pipeline data. Contact records, deal/pipeline stages, and customer interaction records that you manage within your account.

Content you connect or generate. Generated and sent email replies, generated newsletters, social media captions and generated graphics (for manual copy and download), review responses, and invoices. We do not connect to or store credentials for third-party social media publishing accounts.

Billing information. Plan, subscription status, and credit usage. Payment card details are collected and processed directly by our payments processor, Dodo Payments — we do not store your full card number on our servers.

Device & Request Metadata. Timestamps, browser/device information, and activity logs (e.g. which agent ran, when, and the outcome) for security, debugging, and the in-app activity dashboard. IP addresses are processed in volatile memory at request time solely for rate-limiting, security validation, and abuse prevention; IP addresses are not stored in our application database.

• To operate the agents you enable — generating and sending email replies, booking or rescheduling calendar events, generating newsletters and social media content for manual export, replying to reviews, and sending invoice reminders.
• To process payments, manage subscriptions, and calculate credit balances.
• To send transactional notifications (e.g. booking reminders, bell notifications, receipts) via our email provider, Brevo.
• To provide customer support and respond to your requests.
• To detect, investigate, and prevent fraud, abuse, and security incidents.
• To improve the Service — for example, understanding which features are used and where errors occur.

To generate replies, newsletters, and content, relevant text (such as an incoming email or your business profile) is sent to our large language model provider, Groq, for processing. This data is used only to generate the response for your account and is not used by us or our providers to train AI models.

Some agents also perform live web research (for example, to suggest timely newsletter topics) using search-capable models. Search queries are derived from your business category and public holidays/trends, not your private inbox content.

We do not sell your personal information. We share data only with the following categories of service providers, each bound by their own confidentiality and security obligations, and only as needed to operate the Service:

• Google — for Gmail, Google Calendar, and Google Business Profile access you explicitly authorize via OAuth.
• Groq — for AI text generation, as described above.
• Brevo — for sending transactional emails (booking reminders, OTP codes, etc.) on our behalf.
• Dodo Payments — for processing subscription payments and credit purchases.
• Cloud hosting and database providers — for storing and running the Service infrastructure.

We may also disclose information if required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets, subject to this Policy.

FastForward's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We only use Google user data to provide or improve user-facing features that are prominent in FastForward's user interface (sending automated email replies, checking calendar availability and creating bookings, and responding to Google reviews).
• Stored message and activity records exist solely for user review and audit logging in your dashboard, and are never subjected to secondary processing, data mining, profiling, or monetization.
• We do not transfer Google user data to third parties, except as necessary to provide these features (e.g. sending context to our LLM provider solely for instantaneous reply generation), or as required for security investigation or legal compliance.
• We do not use or transfer Google user data for serving advertisements, retargeting, personalized marketing, or data broker services.
• Google user data received through Google Workspace APIs or OAuth scopes is never used to train, retrain, or improve generalized AI/ML models.
• Human personnel do not read your Google user data unless you have given explicit affirmative consent for debugging a specific issue, or as required for security investigation or legal compliance.

We retain account and business data for as long as your account is active. Email activity history, incoming message details, and generated replies are stored solely for your dashboard review and auditing, and are retained according to your plan's retention window (3 days on Free, 30 days on Starter, 90 days on Growth, and up to 180 days on Agency). We do not perform any secondary background processing on this stored history. After the retention period expires, old email records and logs are 100% permanently deleted from our servers. Pending confirmation actions (e.g. an unconfirmed booking cancellation or reschedule) expire automatically after 48 hours. When you delete your account, all account records, business profiles, email history, and credentials are permanently purged immediately.

We use industry-standard safeguards to protect your data, including encryption in transit, access controls, and automated security scanning of our own codebase. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security, but we work continuously to protect your information and will notify you as required by law in the event of a data breach affecting your account.

You can access, update, or delete most of your data directly from your account settings. You may disconnect any Google connection (Gmail, Google Calendar, or Google Business Profile) at any time directly from your dashboard, which immediately revokes our access and deletes stored OAuth tokens. You can also revoke access directly through your Google Account Security Settings.

You can permanently delete your FastForward account, business profile, contacts, deal pipeline, and activity logs at any time directly from your Profile Settings > Danger Zone. Alternatively, you may contact us at flowpilot6626@gmail.com to request account deletion, data export, or correction. We will fulfill verified deletion requests promptly within 30 days.

The Service is intended for business use by adults and is not directed to individuals under 18. We do not knowingly collect personal information from children.

Your information may be processed and stored in countries other than your own, including by the service providers listed above. We take reasonable steps to ensure your data is treated securely wherever it is processed.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through an in-app notice before the change takes effect. The "Last updated" date at the top of this page reflects the most recent revision.

Questions about this Privacy Policy or how we handle your data? Email us at flowpilot6626@gmail.com.