Privacy Policy

1. Introduction

Headflood Marketing ("Headflood," "we," "us," or "our") operates the Headflood Command Center platform located at headflood.ai (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

We collect information in the following ways:

• Account Information: When you create an account, we collect your name, email address, and authentication credentials.
• OAuth Tokens: When you connect third-party services (Google Analytics, Google Search Console, Google Ads, Google Tag Manager, Google Business Profile, CallRail), we store encrypted OAuth tokens to access your data on those platforms on your behalf.
• Client Data: Marketing data pulled from connected third-party services including analytics metrics, search performance data, keyword rankings, backlink profiles, and advertising campaign data.
• Usage Data: We automatically collect information about how you interact with the Service, including pages viewed, features used, and timestamps.

3. How We Use Your Information

• To provide, operate, and maintain the Service
• To connect to and retrieve data from your authorized third-party accounts
• To generate reports, analytics, and AI-powered insights for your marketing campaigns
• To improve and personalize the Service
• To communicate with you about service updates and support

4. Data Security

We implement industry-standard security measures to protect your data. All OAuth tokens and sensitive credentials are encrypted at rest using AES-256-GCM encryption. Access to the platform is protected by authentication, authorization checks, and rate limiting. Our infrastructure enforces strict multi-tenant data isolation ensuring that each client's data is completely separated.

5. Third-Party Services

Our Service integrates with third-party platforms to provide marketing intelligence. When you connect a third-party account, we access only the data permitted by the scopes you authorize. These integrations may include:

• Google Analytics (GA4)
• Google Search Console
• Google Ads
• Google Tag Manager
• Google Business Profile
• Google Drive
• CallRail
• DataForSEO

Each third-party service has its own privacy policy. We encourage you to review them. You may disconnect any third-party service at any time through the Service interface or by revoking access in the respective platform's account settings.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. When you request account deletion, we will delete your personal information and client data within 30 days, except where retention is required by law.

7. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We may share data only in the following circumstances:

• With your consent or at your direction
• To comply with legal obligations or respond to lawful requests
• To protect the rights, property, or safety of Headflood, our users, or the public
• With service providers who assist in operating the Service, subject to confidentiality agreements

8. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Disconnect any third-party service integration at any time
• Export your data in a portable format

9. Cookies

We use essential cookies for authentication and session management. We do not use third-party tracking cookies or advertising cookies.

10. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page with a revised "Last updated" date.

12. Contact Us

If you have any questions about this Privacy Policy, please contact us at: [email protected]