Phloz Privacy Policy

Phloz Privacy Policy

Effective Date: January 1, 2026 | Last Updated: October 23, 2026

1. Introduction

Welcome to Phloz ("we," "our," or "us"), operated by TBP Labs. Phloz provides intelligent communication, outreach management, and workflow automation services accessible via https://app.phloz.io and associated APIs.

We are committed to maintaining the privacy, security, and integrity of the personal data you entrust to us. This Privacy Policy describes how we collect, use, store, share, and protect your information, with special emphasis on our handling of data received through third-party integrations, including Google APIs.

2. Information We Collect

We collect information to provide, maintain, and enhance our services:

  • Account Information: When you create an account, we collect your name, email address, password hash, organization name, and billing details.
  • Google User Data (via OAuth): When you link your Google or Gmail account to Phloz via Google OAuth (specifically requesting the https://www.googleapis.com/auth/gmail.modify or Google Sign-In scopes), we access:
    • Your Google email address and user profile identifier for authentication and mailbox configuration.
    • OAuth access and refresh tokens to communicate with Google APIs on your behalf.
    • Email headers, message bodies, thread identifiers, recipient lists, and message timestamps strictly for messages sent through Phloz or replies directly related to your campaigns.
    • Message labels and read/unread flags strictly to identify customer replies and update campaign sequence states.
  • Communication & Campaign Data: Email templates, outreach contact lists, campaign scheduling preferences, and recipient interaction metrics (such as delivery status, opens, and link clicks).
  • Log & Diagnostic Data: IP addresses, browser user-agents, timestamps, and error logs collected automatically to ensure system stability, prevent spam abuse, and guarantee platform security.

3. How We Use Your Information

We use the collected information strictly for legitimate operational purposes:

  • To create and manage your Phloz account and authenticate your sessions.
  • To send user-scheduled email sequences through your connected Google mailbox.
  • To detect incoming replies to active outreach campaigns so subsequent automated follow-ups are immediately paused.
  • To monitor mailbox health, bounce rates, and deliverability metrics.
  • To provide technical support, respond to user inquiries, and prevent fraud or security breaches.

4. Google API Services User Data Policy & Limited Use Disclosure

Phloz's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, regarding information received from Google APIs (such as Gmail messages, metadata, and user credentials):

  • User-Facing Features Only: We only access, use, or store Google user data to provide user-facing features that are prominent in Phloz's user interface (sending outreach sequences and detecting thread replies).
  • No Generalized AI/ML Model Training: We never use Google user data (including email content, subject lines, or recipient metadata) to train, retrain, fine-tune, or improve generalized or non-personalized artificial intelligence (AI) or machine learning (ML) models.
  • No Advertising or Marketing: We never use or transfer Google user data to serve advertisements, including retargeted, personalized, or interest-based advertising.
  • No Sale or Third-Party Transfer: We do not sell, rent, or transfer Google user data to any third parties, except as strictly required to deliver the core service, comply with applicable laws, or as part of a corporate merger or acquisition with explicit notice.
  • Strict Human Access Limits: Phloz employees and contractors do not view or read your Google user data unless:
    • You have given explicit, affirmative consent to investigate a specific message for support purposes;
    • It is necessary for security purposes (such as investigating an exploit or bug);
    • It is required to comply with a valid legal obligation or court order; or
    • The data is aggregated and anonymized for internal system performance reporting.

5. Data Sharing and Third-Party Subprocessors

We do not sell, trade, or rent your personal information to third parties. We share data only with trusted infrastructure providers (subprocessors) that adhere to rigorous security standards:

  • Cloud Infrastructure: Amazon Web Services (AWS) for hosting databases, servers, and encrypted storage in ISO 27001 / SOC 2 certified data centers.
  • Legal & Regulatory Authorities: Only when compelled by subpoena, court order, or valid legal process, and to the extent required by law.

6. Security of Your Data

We apply comprehensive technical and administrative security controls to safeguard your data:

  • Encryption in Transit: All data transmitted between your browser, our servers, and Google APIs is encrypted using Transport Layer Security (TLS 1.2 or TLS 1.3) with modern cipher suites.
  • Encryption at Rest: OAuth tokens, credentials, and persistent data are encrypted at rest using industry-standard AES-256 encryption.
  • Access Control: Administrative access is strictly restricted by role-based access control (RBAC), multi-factor authentication (MFA), and audit logging.

7. Data Retention and Deletion

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy or as required by law:

  • Connected Mailboxes: We retain OAuth credentials and sync logs only while your mailbox remains connected. If you disconnect your mailbox in Phloz Settings, the stored credentials and sync tokens are immediately and permanently removed.
  • Revocation via Google: You can revoke Phloz's access to your Google account at any time by visiting Google Account Security Permissions.
  • Data Deletion Requests: You may request complete erasure of your account, email logs, and associated personal information by emailing us at support@phloz.io. We will fulfill verified requests within 30 days.

8. Your Rights & Choices

Depending on your jurisdiction (including GDPR and CCPA), you hold specific rights to access, rectify, port, restrict, or erase your personal data.

9. Contact Us

For questions or data deletion requests, contact our Data Protection Team at:

Phloz / TBP Labs
Email: support@phloz.io / lakshya@tbplabs.tech
Website: https://app.phloz.io