Privacy Policy

Last updated July 22, 2026

OppFlow.ai ("OppFlow", "we", "us") builds an AI sales workspace for revenue teams. This policy explains what we collect, how we use it, and the choices you have. It applies to our website, apps, and services (together, the "Service"). We built OppFlow for professionals, and we treat your customer and pipeline data as yours.

1. Information we collect

Information you provide

• Account details — name, work email, company, role, and billing information.
• Content you create — notes, voice notes, tasks, and deal records you enter into OppFlow.
• Support communications and anything you send to our team.

Information from connected services

• CRM data (Salesforce, HubSpot) you choose to sync — accounts, contacts, and opportunities.
• Email & calendar metadata and content, when you connect a mailbox, to match activity to deals.
• Conversation data from Zoom and Gong integrations, where enabled.
• Product-usage signals from tools you connect, used to compute renewal health scores.

Information collected automatically

• Device, browser, and log data; approximate location from IP; and product analytics about how you use the Service.

2. How we use information

• Provide, maintain, and improve the Service and its AI features.
• Power Marvin and Sales Plays — drafting content, surfacing risk, and suggesting next steps for your review.
• Compute renewal intelligence and reporting from usage and CRM signals.
• Authenticate users, prevent abuse, and keep the Service secure.
• Communicate with you about updates, security, and billing.

3. AI and your data

Marvin uses your connected data to generate drafts and recommendations that you approve before anything is sent. We do not use your customer content to train foundation models, and we do not sell your data. Where we use third-party model providers, they process data under contract solely to serve your requests and are prohibited from training on it.

4. Google user data

If you connect a Google account, OppFlow requests only the permissions it needs, and uses each one for a single stated purpose:

• gmail.readonly — to read email threads exchanged with the contacts on your deals, so that activity appears on the right deal timeline. We do not index your whole mailbox.
• gmail.send — to send a message only at the moment you press send on a draft you have reviewed. OppFlow never sends email on its own.
• calendar.readonly — to match past and upcoming meetings to the right deal.
• userinfo.email, userinfo.profile — to identify your account and show your name and avatar.

OppFlow's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to train foundation models, we do not sell it, and we do not transfer it to third parties except as needed to provide the Service to you, for security purposes, or to comply with applicable law.

You can review and revoke OppFlow's access to your Google account at any time from your Google account permissions page. To have data already synced from Google deleted, email privacy@oppflow.ai.

5. How we share information

• Service providers — hosting, analytics, and model providers acting on our instructions.
• Integrations you enable — data flows to and from the CRMs and tools you connect, at your direction.
• Legal & safety — when required by law or to protect rights, safety, and the integrity of the Service.
• Business transfers — in connection with a merger, acquisition, or asset sale, subject to this policy.

6. Data retention

We retain your information for as long as your account is active and as needed to provide the Service. You can delete content in-product, and we delete or de-identify account data within 90 days of account closure, except where retention is required for legal, tax, or security reasons.

7. Security

We protect data with encryption in transit and at rest, least-privilege access controls, and continuous monitoring. No method of transmission or storage is perfectly secure, but we work to meet industry standards including SOC 2.

8. Your rights & choices

• Access, correct, export, or delete your personal data, subject to applicable law.
• Disconnect any integration at any time from Settings.
• Opt out of marketing email via the unsubscribe link; service messages will still be sent.
• Depending on your region (e.g. GDPR, CCPA), you may have additional rights — contact us to exercise them.

9. International transfers

We may process data in the United States and other countries. Where required, we use appropriate safeguards such as Standard Contractual Clauses for cross-border transfers.

10. Children

The Service is intended for business use and is not directed to individuals under 16. We do not knowingly collect data from children.

11. Changes to this policy

We may update this policy from time to time. Material changes will be posted here with a revised "Last updated" date, and where appropriate we will notify you in-product.

12. Contact us

Questions about privacy? Email privacy@oppflow.ai or write to OppFlow.ai, Data Protection, San Francisco, CA.