Privacy Policy | Warpflow

1. Introduction

This Privacy Policy describes how Infinite Solutions Group LLC ("Company", "we", "us") collects, uses, and protects your information when you use the Warpflow platform ("Service").

2. Information We Collect

Account Information

When you create an account or install our app through the GoHighLevel Marketplace, we collect your name, email address, location ID, and company information.

Usage Data

We collect anonymized usage metrics including signal counts, AI signal counts, feature usage, and API call volumes. This data is used for billing, analytics, and service improvement.

Lead Data

When you use Warpflow Signals, inbound lead data (contact name, phone, email, message content) is processed through our pipeline. This data is stored in your tenant's isolated database.

Communications Data

When you use Warpflow Signals communication features (SMS, voice, or email), we collect and process the following additional data:

Phone numbers — End user phone numbers used for message delivery, opt-out tracking, and contact identification. For HIPAA tenants, phone numbers are stored as encrypted blind indexes.
Message content — The content of inbound and outbound text messages, stored in your tenant's isolated database and subject to your configured data retention policy.
Opt-out records — When an end user opts out of messaging (e.g., by replying STOP), we record the opt-out event including timestamp, keyword used, and contact identifier to ensure compliance with the TCPA and CTIA guidelines.
Call metadata — For voice features, we collect call duration, direction (inbound/outbound), timestamps, and disposition. Inbound calls may be recorded with consent; recordings are encrypted at rest with customer-managed keys.
Voicemail transcriptions — Voicemail audio is transcribed using speech-to-text services and processed through the same data policies as text messages.
Carrier delivery data — Delivery receipts, carrier error codes, and routing metadata used for troubleshooting and compliance.

AI Processing

Content sent for AI classification or generation is transmitted to third-party AI providers (Anthropic, OpenAI) according to their respective privacy policies. We do not use your data to train AI models.

3. How We Use Information

Provide, maintain, and improve the Service
Process and route inbound signals per your configuration
Track usage for billing and plan enforcement
Send service-related communications
Detect and prevent abuse or security incidents

4. Data Storage and Security

Your data is stored in Cloudflare D1 databases with tenant-level isolation. Data is encrypted in transit (TLS) and at rest. We use Cloudflare Workers for compute, providing edge-level security and DDoS protection.

5. Data Sharing

We share your data only with:

AI Providers — Anthropic and OpenAI for classification and generation (per your configuration)
Communication Providers — AWS End User Messaging and Amazon Connect for SMS and voice delivery, Twilio for SMS delivery, and GoHighLevel for message sending (per your configuration). Communication providers receive phone numbers and message content necessary for delivery.
Carrier Networks and Registries — The Campaign Registry (TCR) and mobile carriers receive business registration information (legal name, EIN, address) submitted during 10DLC campaign registration. This information is required for SMS deliverability and is governed by TCR's and each carrier's respective privacy policies.
Infrastructure Providers — AWS for compute, storage, and encryption; Cloudflare for hosting and edge security

We do not sell your personal information. We do not share data with third parties for advertising purposes.

6. Data Retention

We retain your data for the duration of your account plus 30 days after deletion. Usage records are retained for 12 months for billing reconciliation. You may request data export or deletion at any time.

Additional retention periods for communication data:

Opt-out records — Maintained for the life of the account plus 30 days to ensure continued compliance with opt-out requests
Call recordings — Subject to the tenant's configured retention policy and automatically deleted after the retention period expires
Carrier delivery data — Retained for up to 90 days for troubleshooting and compliance
10DLC registration data — Business registration information submitted to TCR is retained by TCR according to their data retention policies and cannot be deleted by Warpflow

7. Your Rights

Depending on your jurisdiction, you may have the right to:

Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your data
Export your data in a portable format
Opt out of certain data processing
Opt out of receiving text messages at any time by replying STOP (see our SMS & Communications Terms for details)

8. Cookies and Analytics

The Warpflow website uses essential cookies for authentication and session management. We also use PostHog, a product analytics platform, to understand how visitors use our site.

By default, analytics data is collected in-memory only (no cookies are stored). If you accept cookies via the consent banner, PostHog will store a cookie and localStorage data to recognize return visits and improve your experience. If you decline, no analytics cookies are set and no tracking data is persisted.

You can change your cookie preference at any time by clearing your browser's localStorage for warpflow.ai and revisiting the site.

9. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service.

11. Contact

For privacy-related questions or requests, contact us at support@warpflow.ai.