Privacy Policy

1. Introduction

This Privacy Policy is issued by Connect AI Portal L.L.C., a company registered in Dubai, United Arab Emirates ("we", "our", or "us"). We operate the xflow messenger application ("xflow") and the AgentFather personal-agent service ("AgentFather") — together, our "Services". This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Services. By using the Services, you agree to the practices described in this policy.

2. Information We Collect

We may collect the following types of information:

• Account Information: name, email address, and profile details you provide during registration.
• Payment & Subscription Data: subscription status, billing period, and transaction history. All payment processing for xflow subscriptions is handled by Apple through the App Store — we do not collect or store your payment card details, billing address, or other financial information directly.
• Usage Data: information about how you interact with the Services, including features used, session duration, and in-app activity.
• Device Information: device type, operating system, unique device identifiers, and crash data.
• Communications (xflow): messages and conversations from your connected messaging accounts, which xflow continuously processes using AI to provide core functionality — including conversation prioritization, suggested replies, and chat analysis. We store this data to provide conversation history, synchronization, and the AI-powered features described in Section 4.
• Agent Data (AgentFather): credentials and API keys you provide, tasks and instructions you send (text, voice, files, screenshots), and working memory the agent stores to carry out your tasks and act on your behalf.

3. How We Use Your Information

• To provide, maintain, and improve the Services' features, including AI-powered communication tools and your personal agent.
• To personalize your experience and deliver relevant suggestions.
• To communicate with you about updates, security alerts, and support.
• To monitor and analyze usage trends to improve the Services.
• To detect, prevent, and address technical issues or abuse.

4. AI Processing & Data Handling

The Services use artificial intelligence as a core part of what they do. When you connect your messaging accounts, xflow automatically and continuously analyzes your conversations using AI to prioritize contacts, predict the best message to send, and provide chat insights. When you use AgentFather, the tasks and instructions you send — together with your agent's working memory — are processed by AI models so the agent can carry out your tasks and act on your behalf. This processing begins when you sign in and connect an account or activate your agent, and continues as long as your account is active.

Your content is sent to third-party AI providers (as described in Section 4A) for processing. We do not use your personal messages or agent data to train our AI models. AI-processed data is handled in accordance with strict data minimization principles.

4A. Third-Party AI Processing

When you use the Services, we send certain data to third-party AI service providers ("AI Providers") that process data on our behalf.

What data is sent

• xflow: message content from your connected messaging accounts, including text, metadata, and conversation context, plus contact information necessary for conversation prioritization (names, message frequency, recency).
• AgentFather: tasks and instructions you send (text, voice, files, screenshots) and the working memory and context your agent needs to carry them out.
• Technical information: language, app version, device/OS type, timestamps, and routing identifiers.

Who the data is sent to

• Our AI Providers: OpenAI, Anthropic, Google Cloud AI, and xAI — acting as processors under contract with us.
• Cloud hosting and security providers involved in delivering and protecting AI requests.

How we use this data

• To power the Services: in xflow — prioritize your conversations, predict the best message to send, and provide chat insights; in AgentFather — carry out the tasks you give your agent and let it act on your behalf.
• To maintain and improve the Services, prevent abuse, and comply with legal requirements.

We do not sell your personal data.

Your consent and control

Before the Services begin AI processing of your data, we ask for your explicit consent. You may withdraw consent and delete your account at any time. Note that AI processing is integral to the Services' core functionality — disabling it is not possible while using them.

Safeguards / equal protection

AI Providers act as our processors under contractual obligations and appropriate security measures. They may only process personal data to provide services to us, must follow our instructions, and must protect personal data consistent with this Privacy Policy. They must protect personal data with the same or equal level of protection described in this Privacy Policy.

5. Data Sharing & Disclosure

We do not sell your personal information. We may share information with:

• Service Providers: trusted third parties that help us operate the Services (e.g., cloud hosting, analytics, security, and AI processing as described in Section 4A).
• Legal Requirements: when required by law, regulation, or legal process.
• Business Transfers: in connection with a merger, acquisition, or sale of assets.

6. Data Security

We implement industry-standard security measures including encryption in transit (TLS) and at rest to protect your data. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Data Retention

We retain personal information, including communications, agent data, and related content, for as long as your account is active and as needed to provide the Services. If you delete your account, we delete or de-identify your account data and associated content, including conversation history and agent working memory, unless we must retain certain information for legal compliance, security, fraud prevention, or dispute resolution. Backup copies may persist for a limited period before being overwritten.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access, correct, or delete your personal data.
• Object to or restrict certain processing activities.
• Data portability — receive your data in a structured format.
• Withdraw consent at any time where processing is based on consent.

To request deletion, you can delete your account in the app (Go to your account → Delete account) or contact us at info@xflow.org.

9. Children's Privacy

The Services are not intended for users under the age of 13. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 13, we will take steps to delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy within the Services and updating the "Last updated" date above.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us at:
Connect AI Portal L.L.C., Dubai, United Arab Emirates
info@xflow.org