This policy describes how Flexaura ("we", "us") collects, uses, and shares information when you use our dashboard, our API, or an AI agent built on our platform and embedded on a customer's website.

Account data. When you sign up, our authentication provider (Clerk) collects your name, email address, and organization details.

Conversation content. Messages sent to and from an AI agent, including any documents uploaded to an agent's knowledge base, are stored so the agent can maintain context and so conversation history is available to our customers' support teams.

WhatsApp data.When a business connects its WhatsApp Business number to Flexaura, Meta gives us an access token for that business's WhatsApp account, and we receive the account's ID and the number's ID, display number, name and quality rating. We store the token, and the PIN we set to register the number, encrypted. When someone messages that number, Meta sends us the message with the sender's phone number and WhatsApp profile name. We store the text of the conversation, the phone number and the profile name with the business's conversation history, like any other conversation. We currently handle text messages only; we don't download images, voice notes or other files.

Calendar data.When a member of a business's team connects a calendar so its agents can book meetings, we receive the account's email address and the calendar's timezone. For Google Calendar, Calendly and Cal.com we store a token from the provider, encrypted, that lets us act for that person until they disconnect. If a team member connects Cal.com with an API key instead, we store that key, encrypted. To find open times, we read when the calendar is busy, never what the busy events are, and we don't keep those busy times. For Cal.com and Calendly we also read the account's event types (their names, lengths and booking questions) so the business can choose which ones its agents offer. We create the meetings an agent books, later read back those same meetings to check whether they were moved or cancelled, and read nothing else from the calendar.

Booking details.When a visitor books a meeting through an agent, we store the meeting time, the visitor's name and email address, and their answers to any questions the business asks before booking. These are added to the meeting in the business's calendar, and the calendar provider sends the visitor the invitation. When a Calendly account can't take bookings from apps (Calendly's free plan), the agent instead gives the visitor a Calendly booking link with their name and email filled in; the visitor finishes booking on Calendly, and we don't receive or keep that booking.

Changing a booking.When a business lets its agent look up, move or cancel meetings, a visitor first proves they own the booking's email address: we email a 6-digit code to that address, but only if it has an upcoming meeting with the business, and the visitor types it into the chat. We store only a scrambled (hashed) form of the code, never the code itself. If the visitor gives a reason for cancelling, we store it with the booking and pass it to Cal.com or Calendly, which include it in the cancellation they send. A visitor who is signed in to the business's own site, or who writes to the agent by email from that address, doesn't need a code.

Timezone.Our chat widgets send the visitor's timezone, as their browser reports it, with each message, so an agent can offer times in the visitor's own time. A visitor may also tell the agent their timezone. We store it with the conversation.

Billing data. Payment details are collected and processed directly by Stripe. We do not store your card number ourselves.

Usage and error data. We collect basic operational data (request logs, error reports) to keep the service running and to diagnose problems.

We rely on a small number of specific service providers to operate Flexaura. We don't sell data to anyone, and we don't share it beyond what's needed to run the service:

• Clerk — authentication and account management.
• Stripe — payment processing and billing.
• Amazon Web Services (Amazon SES) — sending and receiving email on behalf of an agent's Email channel, and sending the verification codes visitors use to change a booking.
• OpenAI, Anthropic, Google, or Groq — whichever LLM provider a given agent is configured to use processes that agent's conversation content in order to generate a reply. OpenAI's moderation API additionally screens every message on every agent for policy violations, regardless of which provider that agent otherwise uses. On Pro plans and above, when an agent has a knowledge base, OpenAI also receives customer questions with the agent's reply and short passages from that knowledge base, to check whether the question was answered, so the business can see the questions its agent couldn't answer. This check runs on Flexaura's own OpenAI account, never on a key a customer supplied. When an agent offers meeting times, the open times and the details a visitor gives for a booking are part of that conversation, so the agent's provider processes them too. The provider never receives the calendar's busy times or any other event in the calendar.
• Meta (WhatsApp) — when a business connects its WhatsApp number, Meta delivers its customers' messages to us, and we send the agent's and the business's replies through Meta's WhatsApp Business Platform.
• Google Calendar — when a team member connects a Google calendar, we read when it is busy and create the meetings its agents book. Google sends the meeting invitation, which includes the visitor's name, email address and booking answers, and a Google Meet link when the business turns that on.
• Cal.com — when a team member connects a Cal.com account, we read its open times and book meetings through it. Cal.com sends the confirmation to the visitor and receives the same booking details.
• Calendly — when a team member connects a Calendly account, we read its event types and open times and book, move and cancel meetings through it. Calendly sends the confirmation to the visitor and receives the same booking details, including the visitor's answers to the event type's questions.
• Google Cloud Storage & Cloud KMS — knowledge base documents are stored in Google Cloud Storage; customer-supplied ("bring your own key") LLM API keys and WhatsApp access tokens are encrypted using Google Cloud KMS before storage.
• DigitalOcean — our application and database infrastructure runs on Digital Ocean's servers.
• Sentry — error tracking, configured to never receive personal information (names, emails, IP addresses) alongside error reports.

Flexaura's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When a team member connects Google Calendar, Flexaura asks for permission to see when their calendar is busy, to create and change the meetings Flexaura books on calendars they own, to read their calendar's timezone, and to see their account's email address. We use this only so the business's agents can offer open times and book meetings, and so the dashboard can show which account is connected.

We don't sell Google user data, use it for advertising, or use it to develop, improve or train AI or machine learning models. We transfer it to others only as needed to provide this booking feature (the agent's AI provider processes the open times it offers, as described in section 3), to comply with law, or with the user's consent. Our staff don't read it unless the user asks us to, for security, or to comply with law.

A team member can disconnect their calendar at any time in Settings → Calendars. Disconnecting revokes Flexaura's access with Google and deletes the token we stored. They can also remove access from their Google Account's security settings.

We use data we receive from Meta only to run the WhatsApp channel for the business that connected its number: to receive its customers' messages, have its agent answer them, let its team reply from the dashboard, and show the connected number in its settings. We reply only to people who messaged the business first, and we don't send marketing or bulk messages.

We don't sell this data, use it for advertising, or use it to develop, improve or train AI or machine learning models. We share it only with the service providers listed in section 3 that are needed to answer a message (the agent's AI provider and OpenAI's moderation), to comply with law, or with the business's instruction. Each business's access token is used only for that business's own number.

A business admin can disconnect a number at any time in Settings → WhatsApp. Disconnecting deletes the token and PIN we stored and stops Flexaura receiving that number's messages. A business can also remove Flexaura's access from its Meta Business settings.

We retain conversation history and account data for as long as your account is active, so agents and support teams retain useful context. You can request deletion of your account and associated data by contacting us (see below).

Calendar connections are kept until the team member disconnects them or the business's account is deleted. Disconnecting Google Calendar or Calendly also revokes Flexaura's access with that provider. Busy times are read when an agent looks for open times and are not stored. A record of each meeting an agent books (time, visitor name and email, booking answers) is kept with the business's conversation history, for as long as the account is active. Meetings created in a calendar stay there until the calendar's owner or the visitor removes them; deleting a Flexaura account doesn't delete them.

Verification codes for changing a booking expire after 10 minutes, and our record of them is deleted after a day.

WhatsApp connections are kept until a business admin disconnects the number or the business's account is deleted. WhatsApp conversations are kept with the business's conversation history, like other conversations. We keep each WhatsApp message ID for 7 days so that a message Meta delivers twice is answered only once.

All traffic to Flexaura is encrypted in transit (TLS). Customer-supplied LLM keys and WhatsApp access tokens are encrypted at rest. Access to production systems is restricted to the operating team.

Depending on where you're located, you may have rights to access, correct, export, or delete the personal data we hold about you. Contact us to make a request.

If you booked a meeting through an agent and want your booking details deleted, contact the business you booked with, or contact us and we'll pass the request on. To cancel the meeting itself, use the invitation you received.

If you messaged a business on WhatsApp and want your messages deleted from Flexaura, contact that business, or contact us and we'll pass the request on.

Flexaura is not directed at children under 16, and we do not knowingly collect personal information from them.

We'll update the date at the top of this page when this policy changes, and post a notice in the dashboard for changes that materially affect how we handle your data.

Questions about this policy: hello@flexaura.ai