Privacy Policy

From you (the business owner): your account email and password (stored hashed by our authentication provider), your business details from onboarding, your website address, and the content we read from your public website to build your brand profile, imagery, and product catalog.

From your customer list: the contact data you import or sync — typically email addresses, names, and order history. You attest that these contacts gave you permission to email them before importing.

From email activity: delivery, open, click, bounce, complaint, and unsubscribe events for emails sent through the service, used to report performance to you and to protect deliverability.

Your contact list is yours. We never sell it, rent it, share it with other customers, or email it for any purpose other than campaigns and flows you approve. We never sell or share your business data.

We rely on these providers to operate, and each receives only what it needs for its function:

• Supabase (database and authentication) — account, brand, campaign, and contact data.
• Amazon Web Services, Simple Email Service (email delivery) — recipient addresses and the emails you approve.
• Vercel (hosting) — serves the application.
• Anthropic (AI text) — your brand profile, campaign brief, product names, and public website content, to write and art-direct your emails. Never your contact list.
• fal.ai (AI images) — image descriptions only, to generate photography for your emails. Never personal data.
• Stripe (payments) — your billing details. Card numbers never touch our servers.

If you connect a third-party platform (Shopify, Square, Toast, Klaviyo, Mailchimp, Omnisend), we access only the data needed for the features you use, under the authorization you grant, and you can revoke it from that platform at any time.

If you connect Google Search Console on the SEO page, followOS asks Google for read-only access to Search Console (the webmasters.readonly scope) and for your Google account's email address, so we can show which account is connected. We use this access for one purpose: to read your own site's search performance data (the searches that show your site, impressions, clicks, and average position, by page and by date) and show it to you inside followOS, with the keyword analysis and page recommendations built from it. We never post to Google, never change anything in Search Console, and never read any Google data other than Search Console reports for the site you choose.

Your Google access tokens are stored encrypted and used only by our servers to refresh that data. The search data is stored in your workspace and is visible only to your workspace's members. It is not sold, not shared with any other party, not used for advertising, and not used to train AI models; the only third party that sees any of it is Anthropic, which labels the intent of search phrases (never personal data, never your tokens). Disconnecting on the SEO page, or removing followOS from your Google account's connected apps, revokes our access and deletes the stored tokens and synced search data.

followOS's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.