How CloaFlow handles operational data.

CloaFlow plays two different roles, and the difference decides who you should contact about your data.

For visitors to this website and people who contact us, CloaFlow is the controller: we decide what is collected here and why, and this notice applies directly.

For calls, transcripts, requests, and review records inside a customer's workspace, CloaFlow is a processor acting on that customer's instructions. The business that operates the phone line is the controller. If you called a company that uses CloaFlow and want a copy of your data or want it deleted, contact that company; we will support them in responding, and we will pass a request on if you reach us first.

• Contact details you submit, such as name, work email, company, role, phone number, and message.
• Product usage information, such as pages visited, actions taken, browser details, and approximate device information.
• Account and dashboard information for signed-in users, including organization, membership, calls, requests, review items, and audit events.
• Operational call metadata from connected agent systems, such as call timing, status, source references, and review state.
• Where a customer enables them, call audio recordings and transcripts, which can contain whatever a caller chose to say.

CloaFlow customers use automated voice agents to answer business phone lines. A caller on such a line is speaking to software, not a person, and the call may be recorded and transcribed so the request can be reviewed and completed by a human afterwards.

Announcing the agent and obtaining any recording consent the law requires is the responsibility of the business operating the line. Many places, including several US states, require all parties to consent before a call is recorded. Our customer decides whether recording is on, what callers are told, and how long artifacts are kept.

Call audio and transcripts are processed by speech and language model providers listed on the subprocessors page. Agents capture requests for people to review; they are not used to make legal or similarly significant decisions about a caller automatically.

We use information to respond to inquiries, book walkthroughs, provide and secure the product, operate the dashboard, improve reliability, and understand which parts of the product are useful.

Recordings and transcripts are customer-configured. When enabled, they are treated as sensitive operational artifacts and used to support review, traceability, and quality workflows.

Where the GDPR or UK GDPR applies, we rely on these legal bases: performing a contract, for providing the product to a customer and its users; legitimate interests, for securing the service, preventing abuse, and understanding product usage; consent, for optional analytics cookies; and legal obligation, where we must keep records.

We set a small number of cookies that the site cannot work without: a session cookie that keeps you signed in, preference cookies that remember your dashboard theme and the timezone you read times in, and one that records your answer to the cookie banner so we do not ask again. These are always on and carry no advertising identifiers.

Optional product analytics run only after you accept them in the cookie banner, and you can decline or change your mind at any time. We use no advertising cookies, run no ad networks, and do not track you across other websites.

Analytics events record paths and actions rather than page content, and we identify signed-in users by internal id rather than by email.

CloaFlow is designed as a control plane. Connected agents and customer systems can remain separate from the CloaFlow dashboard database.

The dashboard may store operational indexes and source references, while sensitive call details can stay in the connected source system and be fetched only when an authorized user opens the relevant detail view.

We use service providers to host, secure, analyze, and operate CloaFlow. A current list is available on the subprocessors page.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. If that ever changes, this policy will be updated before the change takes effect.

We may disclose information if we are legally required to, or to protect the rights and safety of people using the service.

CloaFlow and its providers operate in several countries, so information may be processed outside the country where it was collected, including in the United States and the European Union.

Where personal data leaves the UK or the European Economic Area, we rely on transfer mechanisms such as the European Commission's Standard Contractual Clauses and the UK Addendum in our agreements with the providers listed on the subprocessors page.

We keep website contact and booking messages for as long as we need them to answer and for our business records, and we delete them on request.

Workspace data is kept for as long as the customer's account is active. After an account closes, we delete or return it within a period agreed with that customer.

Recordings and transcripts follow the retention the customer configures. Because they are the most sensitive artifacts the product touches, we recommend the shortest period that still supports review.

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, receive a portable copy, object to or restrict certain processing, and withdraw consent you previously gave.

If you are in California, you additionally have the right not to be discriminated against for exercising these rights. We do not sell or share personal information, so there is nothing to opt out of.

To exercise any of these, email hello@cloaflow.com. We will verify the request before we act on it, and we answer within the time the applicable law allows. If your data sits inside a customer's workspace, we will direct the request to that customer, who decides the outcome.

If you are in the UK or the EEA and are unhappy with our response, you can complain to your local data protection authority.

We describe our safeguards on the security page. No service can promise perfect security, but we design for least access and a clear audit trail. To report a vulnerability or a suspected incident, email hello@cloaflow.com.

CloaFlow is a business product and is not directed at children. We do not knowingly collect information from anyone under 16, and we delete it if we learn we have.

When this notice changes materially we will update the effective date above and, for customers, give notice through the product or by email.

For privacy, support, or deletion requests, contact hello@cloaflow.com, or use any of the routes on the contact page.