Privacy Policy | GHL Flow Engine

This Privacy Policy explains how GHL Flow Engine ("we", "us", "our") handles personal information when you visit this website, contact us, book a call or use our GoHighLevel, AI, virtual assistant (VA), website and marketing services. We collect only what we need, use it for clear reasons and never sell it.

1. Who we are

GHL Flow Engine is a GoHighLevel agency serving businesses in the United States and the United Kingdom. For personal information collected through this website and our own sales process, we are the data controller. For data inside a client's GoHighLevel account or other systems we work on, we act as a data processor on the client's instructions (see section 5).

2. Information we collect

Information you give us

Contact and enquiry details: name, email, phone number, company, website and the details of your message when you use our contact form, email us or book a call.
Project information: brand assets, content, logins or access you grant us, and requirements you share so we can deliver a service.
Billing details: billing name, address and invoice records. Card and bank details are handled by our payment provider; we do not store full card numbers.
Communications: messages, reports and call notes exchanged on email, Slack, WhatsApp, Microsoft Teams, Google Chat, Zoom or other channels you choose to use with us.

Information collected automatically

Technical data: IP address, browser, device type and pages visited, recorded by our hosting provider for security and performance.
Analytics data: only if you accept analytics cookies, anonymous information about how the site is used.

3. How we use your information

To reply to enquiries, hold discovery calls and send proposals and quotes.
To deliver services: building and managing GoHighLevel accounts, AI agents, snapshots, websites, dashboards and campaigns, and providing VA support.
To send start-of-day and end-of-day reports, project updates and support replies.
To invoice, take payments, process refunds and keep accounting records.
To keep the website and our systems secure and working properly.
To improve our website and services, where you have consented to analytics.
To send occasional updates about our services, only where the law allows or you have agreed. You can opt out at any time.

4. Legal bases (UK & EU)

Under the UK GDPR and EU GDPR we rely on:

Contract: to provide services you request and take steps before entering an agreement.
Legitimate interests: to answer enquiries, run and secure our business and improve our services, balanced against your rights.
Consent: for non-essential cookies and certain marketing. You can withdraw consent at any time.
Legal obligation: to meet tax, accounting and other legal requirements.

5. Client accounts & GoHighLevel data

When we work inside your GoHighLevel account or connected tools, we may access your contacts, conversations, call recordings and other customer data. We process this data only to perform the agreed work, follow your instructions, and keep it confidential. You remain responsible for having a lawful basis and any required consent (for example A2P 10DLC, TCPA or PECR consent) for the contacts and messages in your account.

Our team members and VAs receive only the access needed for their tasks. You can change or remove their user access at any time, and we recommend you do so when a project or VA plan ends.

We do not sell or rent personal information. We share it only with:

Service providers that help us operate, such as website hosting, email, CRM (including GoHighLevel), scheduling, video calling, communication tools and payment processors, under suitable agreements.
Our team members and contractors who need it to deliver your service and are bound by confidentiality.
Authorities or advisers where required by law, or to protect our rights, for example accountants, lawyers or regulators.
A buyer or successor if our business is reorganised or sold, under the same protections.

7. International transfers

Our clients, team and service providers are based in different countries, so your data may be processed outside the UK, EU or US. Where we transfer personal data, we use appropriate safeguards such as the UK International Data Transfer Addendum, EU Standard Contractual Clauses or the UK Extension to the EU–US Data Privacy Framework where available.

8. How long we keep data

Enquiries that do not become clients: up to 24 months.
Client records: for the length of our relationship, then up to 6 years for tax, accounting and legal purposes.
Access to client systems: removed at the end of the project or VA plan; we do not keep copies of your customer data unless agreed.
Analytics data: according to the settings of the analytics tool, typically no more than 14 months.

9. Security

We use reasonable technical and organisational measures to protect personal information, including encrypted connections (HTTPS), access controls, separate user logins for team members, strong passwords and two-factor authentication where available. No method of transmission or storage is 100% secure, but we work to protect your data and will notify you and the relevant authority of a qualifying breach as the law requires.

10. Your privacy rights

Depending on where you live, you may have the right to:

Access the personal information we hold about you.
Correct inaccurate or incomplete information.
Delete your information, where we have no legal reason to keep it.
Restrict or object to certain processing, including direct marketing.
Receive your information in a portable format.
Withdraw consent at any time, without affecting earlier processing.

To make a request, email hello@ghlflowengine.com. We may need to verify your identity and will respond within one month (UK/EU) or the time required by your state law.

11. US state privacy rights

Residents of California and other US states with privacy laws may have the right to know what categories of personal information we collect and why, to request access, correction or deletion, and to opt out of the sale or sharing of personal information or targeted advertising. We do not sell personal information and do not share it for cross-context behavioural advertising without consent. We will not discriminate against you for exercising your rights. You may use an authorised agent to submit a request on your behalf.

12. Marketing, calls & SMS

We only send marketing emails or text messages where you have agreed or where the law allows, and every message includes a way to opt out (for example "unsubscribe" or replying STOP). Mobile numbers and SMS consent collected through our forms are never shared with third parties for their own marketing.

13. Cookies

We use essential cookies to run the site and, only with your consent, analytics and marketing cookies. See our Cookie Policy for details. You can change your choices at any time using "Cookie settings" in the footer.

14. Children

Our website and services are intended for businesses and are not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.

15. Changes to this policy

We may update this policy as our services or the law change. The "Last updated" date at the top shows when it was last revised. Significant changes will be highlighted on this page or sent to active clients.

16. Contact & complaints

For any privacy question or request, email hello@ghlflowengine.com or use our contact page. If you are in the UK and not satisfied with our response, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk. EU residents can contact their local data protection authority.

Please also read our Terms & Conditions and Refund Policy.