Legal
Privacy Policy
This notice follows the same structure as the FloFrame privacy policy. It is written for this website and for the product. FloFrame's company site at floframe.ai publishes its own notice, because that site uses analytics and advertising tags this website does not.
1. Who we are and what this policy covers
FloFrame, LLC ("FloFrame," "we," "us") is a software company at 5900 Balcones Drive, Suite 100, Austin, Texas 78731, United States. This policy explains how we handle personal information in two settings:
- The website at uploadofflineconversions.com, including its learning center and free browser tools (the "Site").
- The product, The Upload Offline Conversions App ("TUOCA" or the "Product"), available at app.uploadofflineconversions.com. Other FloFrame products are covered by the FloFrame privacy policy unless a product publishes its own notice.
"Personal information" means information that identifies, relates to, or could reasonably be linked with a particular person. This policy does not cover the practices of the third-party platforms the Product connects to (for example Google Ads or CallRail). Each is governed by its own privacy policy.
2. In brief
- We do not sell personal information, and we never have.
- This Site does not load advertising tags or analytics cookies. The free tools run in your browser and do not send what you type to us.
- The Product moves our customers' conversion data from their lead-tracking systems to advertising platforms. In that role we act on the customer's instructions as a service provider or processor. We use that data only to provide the service.
- Data we receive from Google, Meta, Microsoft, or TikTok through their APIs is used only to provide the feature the customer connected it for. It is not used for our own advertising, not sold, and not combined with other data for any other purpose.
- Questions and requests: info@floframe.ai.
3. What we collect
3.1 When you visit the Site
Server logs. Hosting for the Site logs requests, including IP address, user agent, and requested URL, for security and operations.
Free tools. Tools such as the E.164 formatter, SHA-256 hasher, and CSV validator run entirely in your browser. The values you type are not transmitted to FloFrame and are not stored by us.
Email. If you email us, we collect your email address, the contents of the message, and any details you choose to include.
What we do not collect on the Site. The Site does not set analytics cookies, does not record session replays, and does not load Google, Meta, Microsoft, or TikTok advertising tags. If that changes, we will update this policy and Your Privacy Choices before the tags load, and we will honor the Global Privacy Control signal.
3.2 When you use the Product
Account information. Name, email address, company name, and a password or, if you sign in with Google, the name, email address, and profile picture Google provides. Team roles and invitations sent to colleagues (name and email of the invitee).
Billing information. Paid subscriptions are processed by Stripe. Stripe collects your payment card details directly. We receive your subscription status, plan, billing email, and the last four digits and brand of your card. We do not store full card numbers.
Connection credentials. To connect the Product to your systems you provide API keys (for example for CallTrackingMetrics or CallRail) or authorize us through OAuth (for example for Google Ads, Microsoft Advertising, Meta, TikTok, ServiceTitan, or Jobber). We store the resulting keys and tokens encrypted at rest and use them only to make the requests you have configured. You can revoke a connection at any time inside the Product or from the third-party platform.
Usage and support information. Actions taken in the Product, execution logs for the automations you configure, error reports, device and browser information, and anything you send to us when you ask for help.
Product telemetry. The Product may use product analytics to understand how features are used. That tooling is separate from this Site.
3.3 Customer Data the Product processes on your behalf
TUOCA carries conversion records from a customer's lead-tracking and job-management systems to the advertising platforms the customer advertises on. The records it handles ("Customer Data") typically describe the customer's own leads and clients: phone numbers, names, email addresses, postal addresses, call times and durations, call recordings' metadata (not the recordings themselves), job or invoice values, and advertising click identifiers. Customer Data also includes anything a customer uploads by file or sends to a webhook endpoint.
For Customer Data, our customer is the controller or business and FloFrame is the processor or service provider. We process Customer Data only to provide the Product as the customer has configured it, to secure and maintain the service, and as required by law. We do not use Customer Data to build profiles, for our own marketing, or to benefit anyone other than the customer. Individuals whose information appears in Customer Data should direct requests to the business they dealt with. We help our customers respond.
Before conversion records reach an advertising platform, personal fields such as email address, phone number, name, and address are normalized and hashed with SHA-256 according to that platform's specification (Google's Enhanced Conversions, Meta's Conversions API, and Microsoft's and TikTok's equivalents). Raw values are not sent to advertising platforms.
4. How we use personal information
- To provide the Site and the Product: publish the Site, create and secure accounts, run the automations you configure, upload conversions to the platforms you connect, send notifications about your account and connection health, and respond when you contact us.
- To bill for paid subscriptions through Stripe and keep the records that tax and accounting law require.
- To understand and improve the Product, using product analytics and aggregate usage data.
- To communicate. We may email people who have contacted us or hold an account about FloFrame products. Every marketing email includes an unsubscribe link.
- To protect the Site, the Product, our customers, and others: detect abuse and fraud, enforce our terms, and defend legal claims.
- To comply with law and respond to lawful requests.
Where the GDPR or a similar law applies, our legal bases are performance of a contract (providing the Site and the Product), our legitimate interests (security, product analytics, marketing to business contacts, defending claims), consent where we ask for it, and compliance with legal obligations. Detail is in the EU and UK addendum.
5. Data from advertising and business platforms
The Product receives data from third-party platforms through their APIs after a customer authorizes the connection. This section states the limits we hold ourselves to for that data.
Google. FloFrame's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Through the Google Ads API we read the list of accounts and conversion actions the connected user can access. The offline conversion and enhanced-conversion records the customer has configured are sent to Google so the connected account can record them. Google requires the Data Manager API for a new upload of those records. A developer token that was not already uploading is rejected on the older upload call. Through Google Sign-In we receive basic profile information to create and secure an account. We use Google user data only to provide and improve the user-facing features the customer connected. We do not use it to serve advertising, do not sell it, do not transfer it except as needed to provide the feature, for security, or as required by law, and do not allow humans to read it except with the user's consent, for security purposes, to comply with law, or when it is aggregated for internal operations.
Meta, Microsoft, and TikTok. Data received through the Meta Marketing and Conversions APIs, the Microsoft Advertising API, and the TikTok Events and Marketing APIs is used only to list the connected accounts and conversion events and to send the conversion records the customer has configured. We handle it under those platforms' developer and platform terms, and we do not use it for any other purpose.
Source platforms. Data read from CallTrackingMetrics, CallRail, ServiceTitan, Jobber, and similar sources is Customer Data (section 3.3) and is used only to build the conversion records the customer has configured.
6. When we disclose personal information
We disclose personal information only in these cases:
- Service providers that process it for us under contract and only on our instructions. At present: Google Cloud (hosting and storage), Stripe (billing), email delivery providers, and product-analytics tooling used by the Product. The company site at floframe.ai also uses Cloudflare and PostHog; those are described in FloFrame's own policy.
- Advertising platforms and business systems you connect, at your direction. When a customer configures TUOCA to upload conversions to Google Ads, Microsoft Advertising, Meta, or TikTok, we send those records to that platform.
- Within a customer's account, to the team members the account owner has authorized.
- Legal and safety: to comply with law, a court order, or a lawful government request; to enforce our terms; or to protect the rights, property, or safety of FloFrame, our customers, or others.
- Business transfers: if FloFrame or a product line is acquired, merged, or reorganized, personal information may transfer to the successor, who will remain bound by this policy until it is changed under section 13.
We do not sell personal information and have not done so in the preceding twelve months. We do not knowingly sell or share the personal information of anyone under sixteen. This Site does not share personal information with advertising platforms for cross-context behavioral advertising.
7. Cookies, tags, and your choices
This Site does not use advertising cookies or analytics cookies. A hosting provider may set a strictly necessary cookie to keep the connection secure.
Global Privacy Control. If we later add advertising or measurement tags, a browser sending the Global Privacy Control signal will be treated as opted out of sale, sharing, and targeted advertising, and those tags will not load. We do not respond to other "Do Not Track" signals. See Your Privacy Choices.
Browser controls. You can block or delete cookies in your browser settings. Blocking cookies does not affect the Site's content.
8. How long we keep personal information
We keep personal information for as long as it is needed for the purpose it was collected for, and then delete or de-identify it. In practice:
- Email correspondence is kept while we are in conversation with you and for a reasonable period afterward so we can follow up.
- Account information and Customer Data are kept while the account is active. When an account is deleted, or a reasonable period after a subscription ends without reactivation, we delete the account's data and destroy the encryption key that protected it. Connection credentials are deleted when you remove the connection or when the account is deleted.
- Billing records are kept for the period tax and accounting law requires, generally seven years.
- Product analytics is kept for the retention period configured in that tooling. Logs are kept for a short, rolling period for security and troubleshooting.
We may keep information longer where a legal obligation, a dispute, or the enforcement of our terms requires it.
9. How we protect it
Data is encrypted in transit with TLS and at rest. Every record the Product stores carries the identity of its owner and of the users authorized to read it, and that check is enforced at the storage layer, so one customer's data is not reachable from another's account. Connection credentials are encrypted with keys specific to the account that owns them. Access by FloFrame staff is limited to those who need it for support or operations and is protected by multi-factor authentication. No system is perfectly secure. If we learn of a breach affecting your personal information we will notify you and the relevant authorities as applicable law requires.
10. Your rights
Depending on where you live, you may have the right to know what personal information we hold about you, to receive a copy, to correct it, to delete it, to restrict or object to certain processing, to withdraw consent, to opt out of sale, sharing, or targeted advertising, and not to be discriminated against for exercising these rights. Regional specifics are in the addenda linked at the top of this page.
To exercise a right, email info@floframe.ai or write to the address in section 14. We will need to verify that the request comes from you (or from an agent you have authorized), typically by confirming the email address on file. We respond within the time applicable law allows, usually within forty-five days. If we decline a request we will say why, and you may appeal by replying to our response.
If your information reached us inside a customer's Customer Data (section 3.3), the customer decides how it is used and your request should go to them. Tell us if you are unsure who that is and we will help.
Account holders can update account details and delete connections inside the Product, and can request account deletion from within the Product or by email.
11. Where we process information
FloFrame operates from the United States and our service providers process information in the United States. If you are outside the United States, your information is transferred here. Where the GDPR, UK GDPR, or a similar law applies to a transfer, we rely on the European Commission's Standard Contractual Clauses, the UK Addendum or International Data Transfer Agreement, or another mechanism recognized under that law.
12. Children
The Site and the Product are for businesses and are not directed to children. We do not knowingly collect personal information from anyone under eighteen. If you believe a child has provided information to us, email info@floframe.ai and we will delete it.
13. Changes to this policy
We will post any revision here and update the effective date at the top. If a change materially reduces your rights or expands what we do with information already collected, we will give notice in advance by email to account holders or by a notice on the Site.
14. Contact
FloFrame, LLC
5900 Balcones Drive, Suite 100
Austin, Texas 78731, United States
info@floframe.ai
Product support and privacy requests both go to info@floframe.ai. That is the address that reaches the person responsible for these practices.
If you are in the European Economic Area or the United Kingdom and are not satisfied with our response, you may lodge a complaint with your local supervisory authority. Contacts for other regions are in the addenda.