Privacy Policy

MagnetIQ Marketing Solutions LLC operates KinetIQ (formerly ClientFlow) from Boerne, Texas, USA. This notice explains how we handle information relating to accounts, platform billing, use of KinetIQ and client portals. For personal information entered by a business into its workspace, that business generally decides why and how to use it, and we process it to provide the service. Contact that business first about its client records, messages and service relationship. When MagnetIQ itself serves you as a client, we also handle information for that relationship.

This notice does not cover independent websites, identity providers or payment services, which have their own privacy notices.

Account information includes name, email, authentication information, user identifier, preferences, signatures and workspace memberships. If you choose Google sign-in, we receive the identity information the provider supplies for authentication, such as name, email and an account identifier, depending on your settings.

Workspace information may include company profiles, logos, contact details, client and deal records, notes, tasks, activity, email templates and delivery records, onboarding steps, invoice line items and subscription information. Client portal information may include ticket requests, replies, images and uploaded files. Other authorized users in the relevant workspace or portal can see information shared with them.

Billing information includes plan, payment status, renewal dates, customer and transaction identifiers, and receipt or invoice information. Stripe collects payment credentials directly through its payment interface. We do not store full card numbers or card security codes.

Technical information may include IP address, browser or device details, session identifiers, timestamps, error and security logs, and support communications. Infrastructure providers may process these details to operate and protect the service.

We use information to authenticate users, provide and administer workspaces and client portals, control access, process subscriptions and invoices, send requested communications and service emails, provide support, troubleshoot, prevent abuse, maintain records and comply with legal obligations. Workspace users control the client records, invoices and automated messages they create. We do not use their uploaded client content as public marketing material without permission.

Public booking pages, intake and estimate forms, and digital business cards collect the details a visitor chooses to submit, such as name, email, phone, answers, uploaded files and requested appointment times. We use these details only to deliver them to the business that owns the page, send related confirmations and reminders, and protect the forms from spam using Cloudflare Turnstile.

Connecting Google Calendar is optional and separate from signing in with Google. KinetIQ requests your permission through Google's consent screen before connecting. Google sign-in provides identity information for authentication; the calendar connection is used for booking availability and calendar synchronization, not access to Gmail messages, Google Drive files or your Google contacts.

The Google Calendar connection requests the scopes https://www.googleapis.com/auth/userinfo.email, https://www.googleapis.com/auth/calendar.calendarlist.readonly and https://www.googleapis.com/auth/calendar.events. These authorize access to your account email, calendar list and calendar events. The events permission allows reading and editing events on calendars you can access; KinetIQ's use is limited to checking selected calendars and managing events created for KinetIQ bookings. The connection requests the email permission, but the current scheduling implementation does not separately retrieve or store your Google account email from that connection.

We retrieve calendar identifiers, names and access roles to let you choose a writable calendar. For availability, we retrieve events within the requested date range on your selected calendar and use event identifiers, start and end dates or times, time zones, cancellation status and free/busy transparency. Google's event responses may also contain details such as titles, descriptions and attendees; KinetIQ does not use those details from existing events to calculate availability or save a copy of those events.

We use calendar information to display your calendar choices, calculate available appointment times, avoid conflicts with existing events, and synchronize bookings that visitors make through KinetIQ. Public booking visitors receive available time slots, not your calendar event list, existing event titles, descriptions or attendees.

When a booking is synchronized, KinetIQ sends Google the appointment title, start and end times, location when provided, and a description that may include the booking client's name, email address and phone number. We store the resulting event identifier so we can update that booking's calendar event after rescheduling or delete it after cancellation. We do not edit or delete unrelated calendar events.

Google receives the booking details needed to create and maintain the event in your selected calendar. People with access to that calendar may see those details according to your Google sharing settings. Authorized KinetIQ workspace users can see booking records according to their workspace permissions; connecting your calendar does not give them a copy of your unrelated calendar events.

Lovable's connector gateway processes calendar authorization, connection credentials and Google Calendar API requests and responses on KinetIQ's behalf. Lovable Cloud and its hosting and database infrastructure process stored connection and synchronization records to operate the feature. We use these service providers to provide, secure and maintain KinetIQ, not to sell Google data or use it for advertising. Our application does not retain a copy of the existing calendar event responses used for availability; this does not represent a promise about every provider's operational logs or backup retention.

Other disclosures of Google user data are limited to your instructions or consent, security needs, applicable legal obligations, or a merger, acquisition or sale of assets with appropriate protections and any consent required by Google's policy. We do not share unrelated Google calendar events with Stripe, advertising networks or the businesses visiting your booking page.

Calendar authorization and API communications use HTTPS. KinetIQ stores its connector credential encrypted using AES-256-GCM with a server-side encryption key. Workspace and user access controls restrict connection and booking records. These measures reduce risk but cannot guarantee absolute security.

While connected, we retain your provider and user identifiers, encrypted connector credential, selected calendar identifier and connection status. Synchronization records retain booking and calendar event identifiers, synchronization status, booking versions and related operational metadata. Existing-event busy times are processed for the availability check rather than stored as a copy of your calendar. Booking records and the information KinetIQ sends into booking events are retained under the general retention rules in this policy.

Disconnecting removes the local connection record and its encrypted credential after the disconnect request succeeds. It does not automatically delete booking records, synchronization history, events already in Google Calendar or every provider backup and operational record. Remaining records are retained only as reasonably needed for service operation, security, disputes and legal recordkeeping, then deleted or anonymized as applicable.

You can stop future calendar access by disconnecting Google Calendar in KinetIQ's Bookings settings. You can independently revoke KinetIQ's access through your Google Account permissions at https://myaccount.google.com/permissions. Revoking access may require reconnecting before availability checks or booking synchronization can work again.

To request deletion of retained Google connection or synchronization data, email info@magnetiq-marketing.com with the subject KinetIQ Google Data Deletion. Identify your KinetIQ account and the connection concerned, but do not send passwords or access tokens. We verify your identity and authority, delete eligible records and explain any records that must be retained for legal or security reasons within applicable deadlines. Disconnecting does not remove events already created in your Google Calendar; you can delete those through Google Calendar.

KinetIQ's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements (https://developers.google.com/terms/api-services-user-data-policy). Google user data is used only to provide or improve the user-facing authentication and scheduling features described in this policy.

We do not sell Google user data, use it for advertising or creditworthiness decisions, build unrelated user profiles, or use it to train generalized artificial intelligence or machine learning models. Human access to Google user data is limited to your affirmative permission for specific data, security investigations, legal requirements, or internal operations using aggregated and anonymized data, as permitted by Google's Limited Use requirements. Transfers are limited to those permitted by those requirements, including providers necessary for these user-facing features.

If you connect Microsoft Outlook, KinetIQ similarly accesses your calendar list and selected-calendar availability, and creates, updates or deletes events for KinetIQ bookings. Microsoft authorization includes identity, offline access and calendar read/write permissions. The same scheduling purposes, connector processing, local credential encryption and disconnect limitations apply. You can also revoke access in your Microsoft account settings.

We share information with authorized workspace and portal users as directed by workspace permissions, and with providers needed to deliver the service. These include Lovable Cloud and its hosting, authentication, database and file-storage infrastructure, Stripe for payments, and Lovable's email delivery services. Google participates when you choose Google sign-in, and Google or Microsoft when you connect a calendar. Cloudflare provides spam protection on public forms. Google Fonts receives technical request information when your browser loads our fonts.

We may disclose information to professional advisers, where legally required, to protect rights and safety or investigate abuse, and in a business transfer subject to appropriate confidentiality and applicable law. We do not sell personal information or share it for cross-context behavioral advertising. This service does not currently integrate third-party advertising trackers.

We use necessary session cookies or browser storage to keep you authenticated and remember interface preferences, including the sidebar state. Blocking or clearing these may sign you out or prevent parts of the service from working. We do not currently use optional advertising cookies in KinetIQ. If we introduce optional tracking, we will update this notice and obtain consent or provide choices where required.

We retain information for as long as reasonably necessary to operate your account or workspace, perform our agreements, comply with tax and recordkeeping obligations, resolve disputes and protect the service. The appropriate period varies by record type and legal requirements. Subscription cancellation does not by itself delete account or workspace data.

Contact info@magnetiq-marketing.com to request account closure or deletion. We may verify your identity and authority and coordinate workspace-data requests with the business that controls the records. Some information may be retained for legal, security or legitimate recordkeeping reasons; backup copies may remain until their normal retention cycle ends. We do not promise immediate deletion of every copy.

Depending on your location, applicable law and our role, you may have rights to access, correct, delete or obtain a portable copy of your information, and to opt out of certain processing. Send requests to info@magnetiq-marketing.com with the subject KinetIQ Privacy Request. Do not email passwords, full card details or identity documents unless a secure verification method is specifically arranged.

We will verify requests appropriately, respond within applicable legal deadlines and explain any lawful denial. If the Texas Data Privacy and Security Act applies to your request, we generally respond within 45 days and may extend by another 45 days with notice when permitted. You may appeal a denial by replying with the subject Privacy Appeal. Where that Act applies, we respond to an appeal within 60 days; if denied, you may contact the Texas Attorney General at texasattorneygeneral.gov. We do not discriminate against you for exercising applicable privacy rights.

Texas privacy protections can have exemptions, including for certain small businesses and business-context information. We do not assume an exemption overrides any rights that actually apply to you. Because we do not sell information, engage in targeted advertising or use profiling for legally significant decisions, corresponding opt-outs do not presently change those practices. We honor legally required opt-out preference signals for any processing to which they apply.

Account settings and available CSV exports provide some direct controls, but are not a complete personal-data export or account-deletion tool. Contact us for broader requests. Essential security, billing and account emails may continue while you use the service. For messages sent by another workspace business, contact that sender or use its provided unsubscribe method.

We use authentication, workspace access restrictions and private file storage to help protect information. No internet service or transmission is perfectly secure. Protect your credentials, limit staff access and avoid uploading unnecessary sensitive information. If a security incident requires notification, we will notify affected persons and authorities as required by applicable law. Report suspected security issues to info@magnetiq-marketing.com without accessing other users' records.

KinetIQ is intended for adults conducting business, not children under 18. We do not knowingly collect personal information directly from children under 13. If you believe a child has submitted information, contact us so we can investigate and take appropriate action.

Do not upload regulated medical records, payment-card credentials, government identification numbers or other sensitive information that KinetIQ is not designed to handle. We do not sell sensitive personal information. Where applicable law requires separate consent for sensitive-data processing, general acceptance of these Terms or this notice is not a substitute.

We operate in the United States. Our providers may process information in the United States or other locations where they operate. Applicable safeguards and contractual protections are used where required; we do not promise that every record remains in Texas or in the United States.

We may update this notice to reflect changes in our practices or legal obligations. We will update the effective date and provide notice of material changes as appropriate; consent will be requested where required. Contact MagnetIQ Marketing Solutions LLC, Boerne, Texas, USA, at info@magnetiq-marketing.com for privacy questions or requests.