Privacy Policy

Flow CRM ("Flow," "we," "us," or "our") is a customer relationship management platform for the mortgage industry, owned and operated by Erhart Industry Solutions LLC. This Privacy Policy describes how we collect, use, store, and protect information when you use Flow at app.crstflowcrm.com and its related services.

1. Information We Collect

Account information. When you create an account, we collect your name, email address, password (stored in hashed form by our authentication provider), and your role within your organization.

Customer-entered business data. Flow stores the business records your organization creates in the platform, including leads, borrower contact information, loan pipeline records, notes, tasks, campaign records, and related documents.

Communications data. When your organization connects telephony or messaging integrations, Flow processes call and message metadata such as phone numbers, call direction, timestamps, call duration, the number dialed, and message delivery status. Flow does not record or store the audio content of your phone calls.

Usage data. We collect limited technical information necessary to operate and secure the service, such as authentication events and error logs.

2. How We Use Information

• To provide, operate, maintain, and improve the Flow platform;
• To attribute calls and messages to the correct users, leads, and marketing campaigns within your organization;
• To provide reporting and analytics to your organization's administrators;
• To secure the service, prevent abuse, and troubleshoot problems;
• To communicate with you about your account or the service.

We do not sell personal information, and we do not use your organization's business data for advertising.

3. RingCentral Customer Data

Flow offers an optional integration with RingCentral that provides in-app calling, call event tracking, and call analytics. With respect to RingCentral customer data:

• Flow accesses RingCentral data solely to provide integration features that your organization enables — placing and receiving calls in the browser, listing account extensions and phone numbers for configuration, and receiving call event notifications for analytics.
• OAuth access and refresh tokens issued by RingCentral are stored encrypted at rest in our database, are never exposed to the browser beyond the session that requires them, and are used only to make authorized API requests on your organization's behalf.
• Call event data received from RingCentral (such as phone numbers, direction, timestamps, duration, and the number dialed) is stored only within your organization's private records in Flow and is visible only to authorized users of your organization.
• Flow does not sell, share, or disclose RingCentral customer data to third parties, and does not use it for any purpose other than providing the integration features described above.
• Disconnecting the integration stops all data collection from RingCentral. Your organization may request deletion of previously collected call records at any time using the contact below.

4. Third-Party Service Providers

Flow relies on the following service providers to operate the platform. Each processes data only as needed to provide their service to us:

• Google Firebase / Google Cloud — authentication and database hosting;
• Vercel — application hosting and serverless infrastructure;
• RingCentral — telephony (when connected by your organization);
• Twilio — SMS delivery (when enabled by your organization);
• Cloudflare — bot protection on account signup.

5. Data Sharing

We do not sell or rent personal information. We share information only: (a) with the service providers listed above; (b) within your own organization according to the roles and permissions your administrators configure; (c) when required by law, subpoena, or legal process; or (d) in connection with a merger, acquisition, or sale of assets, in which case this policy will continue to apply to previously collected data.

6. Data Security

Data is encrypted in transit (TLS) and at rest. Access to production systems is restricted to authorized personnel. Within the platform, role-based permissions control which users in your organization can view or modify records. No method of transmission or storage is 100% secure, but we work to protect your information using industry-standard practices.

7. Data Retention and Deletion

We retain your organization's data for as long as your organization maintains an active account. Your organization's administrators may delete records within the platform at any time. Upon account termination, or upon request, we will delete your organization's data from our production systems within a commercially reasonable period.

8. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or export your personal information. Because Flow stores data on behalf of your organization, we may direct requests to your organization's administrator where appropriate. To exercise any of these rights, contact us using the details below.

9. Children's Privacy

Flow is a business application and is not directed to anyone under the age of 18. We do not knowingly collect information from minors.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the effective date above. Continued use of the service after changes take effect constitutes acceptance of the revised policy.

11. Contact

Erhart Industry Solutions LLC
Email: davis.alexander.erhart@gmail.com