Privacy Policy

1. Information We Collect

We collect the following categories of information:

• Account Information: Name, email address, business name, and phone number provided during registration.
• Payment Information: Payment details processed securely through Stripe. We do not store credit card numbers on our servers.
• Google Account Data: When you connect your Google Calendar, we access your Google account email address, calendar free/busy information, and calendar events solely to provide appointment scheduling features. See Section 4 for details.
• Business Configuration Data: Bot configurations, business hours, service descriptions, and workflow settings you create within the platform.
• Communication Data: Messages processed through your bots, including inbound and outbound text messages.
• Usage Data: Log data, device information, and analytics collected automatically when you interact with the Service.
• Consultation Recordings: Audio of in-person consultations you choose to record in the mobile app. See Section 9.

2. How We Use Your Information

• Provide, maintain, and improve the Service
• Process payments and manage your subscription
• Schedule appointments and check calendar availability on your behalf
• Send transactional communications (booking confirmations, account alerts)
• Respond to support requests
• Comply with legal obligations

3. Data Storage and Security

Your data is stored in secured databases hosted by Supabase (PostgreSQL). Sensitive credentials, including Google OAuth tokens, are encrypted at rest using AES-256-GCM encryption. We use HTTPS/TLS for all data in transit.

While we implement industry-standard security measures, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

4. Google User Data

Our use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.

What we access:

• Your Google account email address (to identify the connected account)
• Calendar free/busy data (to calculate available appointment slots)
• Calendar events (to create, read, and cancel bookings on your behalf)

How we use Google data:

• Google Calendar data is used exclusively to provide appointment scheduling functionality within the Service
• We do not use Google data for advertising or marketing purposes
• We do not sell, rent, or share Google user data with third parties
• We do not use Google data to build user profiles unrelated to the Service

Data retention and deletion:

• Google OAuth refresh tokens are stored encrypted (AES-256-GCM) and are deleted immediately when you disconnect your Google Calendar from the Service
• Booking records created via the Service are retained for your records but the Google Calendar connection can be revoked at any time
• You may also revoke access at any time via your Google Account permissions page

Limited Use Disclosure:

Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Third-Party Services

We use the following third-party services to operate the platform:

• Supabase: database hosting and authentication
• Stripe: payment processing
• Telnyx: SMS messaging
• OpenAI: AI-powered bot responses and consultation feedback
• Anthropic: AI-powered bot responses
• AssemblyAI: transcription of consultation recordings and ad videos
• Google Calendar API: appointment scheduling
• Meta Marketing API: ad creation (when enabled by user)
• Vercel: application hosting

Each third-party service processes data in accordance with their own privacy policies. We only share the minimum data necessary for each service to function.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide the Service. If you close your account, we will delete or anonymize your data within 90 days, except where retention is required by law or for legitimate business purposes (e.g., resolving disputes, enforcing agreements).

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Withdraw consent for data processing
• Export your data in a portable format
• Disconnect third-party integrations (Google, Meta) at any time

To exercise any of these rights, contact us at the email below.

8. SMS and Text Message Communications

When you submit your phone number through one of our lead forms, advertisements, landing pages, or other opt-in methods, you consent to receive text messages from Esthetic Edge LLC d/b/a Permanent Profits. These messages may include the content you requested, follow-up about your inquiry, appointment confirmations and reminders, customer support responses, and promotional offers.

• Message frequency may vary depending on your interactions with us.
• Message and data rates may apply depending on your mobile carrier and plan.
• You can opt out at any time by replying STOP to any message. After sending STOP you will receive a confirmation and will no longer receive messages unless you opt in again.
• For assistance, reply HELP to any message or contact us at the email below.
• Consent to receive text messages is not required as a condition of submitting any form or of purchasing any product or service.

We do not share your mobile information:

We do not sell your personal information. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with subcontractors in support services, such as customer service and message delivery, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

We maintain records of consent and opt-out activity in order to honor your choices and to meet our compliance obligations.

9. Mobile Application

The Flowly iOS and Android applications collect and process the same categories of data described above, with the following mobile-specific practices:

Device permissions we request:

• Camera: only used when you record a video for an ad creative. Video is uploaded to your own ad account; we do not retain a copy on our servers.
• Photo Library: only used when you upload an image for an ad or your business website. Uploaded media is stored in your tenant-scoped Supabase Storage bucket.
• Microphone: used when you record a video for an ad creative, and when you record a consultation (see Consultation recordings below).
• Notifications: used exclusively to alert you when a new SMS lead arrives. We collect your Expo push token and associate it with your account for this purpose. No promotional or marketing notifications are sent.

Consultation recordings:

When you record a consultation in the app, the audio is uploaded to our private storage. AssemblyAI transcribes it and OpenAI writes feedback on the consultation for you, and that feedback is the only thing recordings are used for. We delete the audio 30 days after it is recorded and never store the full transcript ourselves. AssemblyAI deletes the audio it receives within two days and its transcript about 30 days after transcription. The written feedback, which can quote a few short lines from the consultation, stays with the lead in your account. Before your first recording you agree that getting consent from everyone you record, as the law where you work requires, is your responsibility.

Data stored on your device:

• Your portal access token and short-lived Supabase authentication JWT are stored in the operating system's secure credential store (iOS Keychain / Android Keystore) via Expo SecureStore.
• You can remove both by signing out of the app or uninstalling it.

Crash and diagnostic data:

When crash reporting is enabled, the app may send anonymized crash stack traces and performance metrics to Sentry (sentry.io) to help us diagnose and fix bugs. This data is not linked to your identity or message content. You can disable diagnostics at the operating system level via iOS Settings → Privacy & Security → Analytics & Improvements, or Android Settings → Google → Usage & diagnostics.

Location and tracking:

The mobile apps do not collect precise or coarse location data. We do not use the iOS IDFA or any advertising identifier, and we do not track you across other apps or websites.

10. Our Websites, Cookies and Meta Ads

Our websites, www.permanentprofits.co and offer.permanentprofits.co, use the Meta Pixel and the Meta Conversions API. These are tools from Meta Platforms, Inc. that help us measure our Facebook and Instagram ads and show them to people likely to be interested.

• Cookies: The pixel and our servers store two cookies in your browser: _fbp, which identifies your browser, and _fbc, which records the Facebook or Instagram ad you clicked to reach us, if you did. They last up to 90 days. Meta may also use its own cookies and similar technologies to collect information from our websites and elsewhere on the internet, and use it to measure ads and choose which ads to show you.
• What we send to Meta: the pages you visit and when (on the application page, also which answers you open), your IP address, your browser type and those cookie values. When you start an application, we also send the name, email address and phone number you enter, and an ID for your application. We hash these (turn them into a code) on our servers before sending them. As your application moves along, for example when you book a call, we send Meta an update with your coded email address, phone number and ID. We do not send your answers to the application questions.
• Your choices: You can block or delete cookies in your browser settings, or block the pixel with a tracking blocker. You can control the ads you see on Facebook and Instagram in your Meta ad preferences, and opt out of interest-based ads from many companies at aboutads.info/choices.

11. Free Artist Tools and the PMU Artist Tools Plugin

We offer free tools for permanent makeup artists at www.permanentprofits.co/tools (a client reply helper, consent, health and aftercare forms, and a price calculator), and the same tools as the PMU Artist Tools plugin for ChatGPT and other AI assistants, at www.permanentprofits.co/mcp. Neither needs an account.

• On our website: what you type into the tools is worked out in your browser and is not sent to us. Your studio name, signature and touch-up settings are saved in your own browser only, so the tools remember them next time. Our page analytics record which parts of the page you open and tap, never what you type, and the Meta Pixel described in Section 10 runs on these pages too.
• In the plugin: when an assistant uses one of the tools, it sends us the details the tool needs, such as the service, the number of days since a procedure, a studio name or monthly costs. We use them only to work out the answer and send it back, and we do not store them. We never receive your conversation, your account details with the assistant, or anything about your clients beyond what the assistant passes to the tool.
• What we keep from the plugin:one record each time the plugin connects or a tool is used, holding the tool's name, the time, and the name of the app that called it (its user agent). We use these records to see which tools are used, and keep them for 180 days. To stop abuse, we also count requests per IP address, stored only as a one-way code and deleted within 24 hours. Our hosting provider keeps standard request logs, such as IP address and time, for a short period for security and reliability.
• Sharing: we do not sell this information, use it for advertising, or share it with anyone except the service providers that host our website and database.
• Health information:do not enter a client's name, contact details or health information into the tools. They do not ask for it and do not need it.

12. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised effective date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:

Esthetic Edge LLC d/b/a Permanent Profits
7901 4th St N, Ste 300, St Petersburg, FL 33702
Email: isabelle@permanentprofits.co