Privacy Policy

This policy explains what SpokenHighly — operated by FluxThread Labs Inc., a Delaware corporation — collects, why we collect it, who else processes it, and how to get it removed. It covers our website and application. We are the data controller for account data, and a processor acting on your instructions for the client data you put into the Service.

1. What we collect

• Account data. Your email address, name, and — if you sign in with Google — the basic profile Google returns. Passwords are hashed by our authentication provider; we never see them.
• Agency and client data.Whatever you enter: agency name, brand colors, logos, client business names, addresses, phone numbers, contact emails, and the “facts sheet” and tone notes you write for each client.
• Review data.Publicly available reviews for the business profiles you add — rating, review text, reviewer display name, and date — retrieved from Google and our review-data providers. We do not collect reviewers’ email addresses or contact details.
• Generated content. The AI reply drafts produced for your account, plus whether you edited or posted them.
• Review-request recipients. If you use review-request campaigns, the customer names and email addresses you upload, and any private feedback those customers submit.
• Billing data. Your plan, subscription status, and a Stripe customer identifier. Card numbers go directly to Stripe — they never touch our servers.
• Technical data. Server and error logs (IP address, user agent, timestamps) and cookieless page-performance metrics.

2. Why we use it

• To operate the Service: sync reviews, draft replies, build reports.
• To authenticate you and keep accounts secure.
• To take payment and manage subscriptions.
• To send transactional email — activation links, password resets, billing notices, and report notifications.
• To debug, prevent abuse, enforce rate limits, and comply with law.

Where the GDPR applies, our legal bases are contract (running the Service you signed up for), legitimate interests (security, abuse prevention, improving the product), and legal obligation (tax and accounting records).

3. AI processing

To draft a reply, we send the review text, the star rating, your client’s facts sheet, and your tone settings to Anthropic’s API. Under Anthropic’s commercial terms, that data is not used to train their models. We do not send billing data, passwords, or your customer email lists to any AI provider.

4. Who else processes your data

We use a small set of subprocessors, all US-based, each under contract and each only for the purpose listed:

• Vercel — application hosting, logs, page-performance metrics.
• Supabase — database, authentication, file storage for logos.
• Anthropic — AI reply drafting and report summaries.
• Stripe — payment processing and card storage.
• Resend — transactional and campaign email delivery.
• Google and our review-data providers — retrieval of public review and business data.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We may disclose data if required by law, or transfer it as part of a merger or acquisition — in which case we will tell you before your data becomes subject to a different policy.

5. Cookies

We use essential cookies only: a session cookie that keeps you signed in. We run no advertising trackers, no third-party analytics profiles, and no cross-site tracking pixels. Our performance metrics are aggregated and cookieless. Because we set no non-essential cookies, there is no consent banner to click through.

6. Retention

• Account and client data: kept while your account is active, and for up to 30 days after you close it, then deleted.
• Review and draft history: kept for the life of the client profile so reports and voice-matching stay accurate; deleted with the profile.
• Logs: typically 30 days. Billing records: retained as long as tax law requires, usually seven years.
• Opt-out and suppression records: kept indefinitely — we have to remember an unsubscribe in order to honor it.

7. Security

Data is encrypted in transit (TLS) and at rest by our infrastructure providers. Every table enforces row-level security so one agency cannot read another’s data, administrative credentials are isolated from the application’s normal request path, and webhooks are signature-verified. No system is perfectly secure; if a breach affects your data we will notify you without undue delay.

8. Your rights

You may request access to, correction of, export of, or deletion of your personal data, object to or restrict certain processing, and — where applicable — lodge a complaint with your supervisory authority. California residents have the rights to know, delete, correct, and to opt out of sale or sharing; we do neither, so there is nothing to opt out of. We will not discriminate against you for exercising any right.

Email alex@spokenhighly.com and we will respond within 30 days. Most account data can be deleted immediately from within the app.

If you are an end customer of one of our users and want your data removed, contact the agency or business that holds the relationship — we process that data on their instructions. Write to us and we will pass the request along.

9. If you received an email from us

We contact marketing agencies using business contact details published on their own public websites. Every such email carries a one-click unsubscribe link and our postal address. Unsubscribing removes you permanently — we keep only the fact that you opted out, so we do not contact you again. You can also just reply and ask; that works too.

10. Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect data from children.

11. International users

The Service is operated and hosted in the United States. If you use it from elsewhere, you are transferring your data to the US, where privacy laws differ from those in your country.

12. Changes

We will update this policy as the product changes and will revise the “last updated” date above. For material changes we will notify account holders by email.

13. Contact

FluxThread Labs Inc. (d/b/a SpokenHighly)
665 NE 25th St, Apt 1903, Miami, FL 33137, USA
alex@spokenhighly.com