Privacy Policy

1) Scope and role of this notice

This Privacy Policy explains how Feply collects, uses, stores, discloses, and protects personal data in connection with our website, application, account services, billing flows, connected-platform APIs, Feply AI features, appointment scheduling, and any browser tooling we may offer for platforms without equivalent public APIs (collectively, the "Services").

We determine how we use account, billing, website, support, and security data to run Feply. For lead, customer conversation, appointment, and team data that a business manages through a workspace, we generally process that information on the business's behalf. The business is responsible for its own notices to leads, customers, and team members, and for the settings it chooses. These roles may differ under applicable law and the circumstances of a particular use.

2) Information we collect

We collect information in the following categories:

• Account and profile data: name, email, authentication identifiers, workspace settings, and configuration preferences.
• Billing and transaction data: subscription plan, billing status, payment metadata, invoices, and subscription events processed by Stripe. Stripe's handling of payment data is described in its Privacy Policy.
• Workflow and automation data: lead identifiers, lead-derived fields, AI prompts and outputs, drafts, automation settings, approval decisions, message delivery records, and booking actions.
• Connected-platform data: when you authorize a platform such as Thumbtack, account and business identifiers, access credentials, leads, project details, customer contact information, messages, attachments, reviews, review images, and job-status information made available through that platform.
• Scheduling and team data: service and booking catalogs, business hours, time zone, appointment dates and locations, customer contact details and notes, team member names, roles, availability, assigned workspaces, service expertise, and routing preferences.
• Google Calendar data: if connected, OAuth credentials and granted scopes, calendar names and IDs, selected calendars, free/busy intervals, and limited event fields needed to distinguish other events from Feply bookings and prevent conflicts.
• Communications data: support requests, product feedback, booking emails and delivery status, and other messages sent to us.
• Usage, technical, and security data: log data, approximate geolocation from IP, device/browser metadata, and events used to maintain reliability, detect abuse, and troubleshoot issues.

3) Sources of information

We collect information from:

• You, when you create an account, subscribe, connect tools, or contact support.
• Your use of the Services, including connected-platform events and operational telemetry.
• Third-party providers you direct us to use (for example, identity/auth and payment providers).
• Connected lead and messaging platforms, including Thumbtack, when you authorize Feply to access the platform on your behalf.
• Google Calendar, if a workspace member authorizes the connection, and customers who use a Feply appointment management link.
• Security and anti-fraud sources where necessary to protect our Services and users.

4) How we use information

• Provide and operate the Services and requested features.
• Authenticate users and manage account access.
• Process subscriptions, billing events, and account administration.
• Generate, store, and manage drafts, AI follow-ups, reviews, and authorized sends.
• Check availability, create and manage appointments, route work to qualified team members, and send booking and scheduling notifications.
• Improve reliability, performance, and product safety.
• Investigate misuse, fraud, policy violations, and security incidents.
• Comply with legal obligations and enforce our legal terms and rights.

Lead and customer information

A connected business may receive a lead's name, contact details, requested service, location, messages, photos, and scheduling choices from Thumbtack or directly through a Feply booking flow. We use that information for the business's lead conversation and requested work: showing the request to authorized workspace members, preparing or sending configured replies, deciding when human review is needed, checking availability, assigning a qualified team member, managing an appointment, and sending related booking emails. We keep the conversation and booking records needed to operate, troubleshoot, secure, and audit those actions.

We do not use a lead or booking record to add someone to Feply's marketing lists, use contact details supplied for that request for Feply promotions, send unrelated offers, or make that data available to another business for marketing. Feply's campaign and marketing AI tools do not use connected-platform lead conversations or contact lists as a marketing audience. The business may have its own separate relationship and communications with a customer; its practices outside Feply are its responsibility.

Lead information is available to the connected business and its permitted team members according to workspace access. We pass only the relevant context to the service providers needed for an enabled feature, such as AI processing, email delivery, calendar sync, and route estimates, as described below. A booking-email opt-out changes email delivery only; it does not remove the lead, cancel an appointment, or stop the business's enabled Feply AI conversation and booking workflows. A lead can contact the business or Feply support about a privacy request.

5) reCAPTCHA Enterprise

We use reCAPTCHA Enterprise on selected public forms and account-access flows to help detect spam, automated misuse, credential abuse, fraud, and other malicious activity. This processing supports the security and reliability of the Services and is part of how we verify that requests come from legitimate users.

In connection with those protections, request, browser, device, and interaction data may be evaluated before we accept a submission or allow a security-sensitive action to proceed. We use that information only for security, abuse prevention, and service protection purposes described in this policy.

Feply determines the purposes for which reCAPTCHA Enterprise is used on our site. Google Cloud processes related reCAPTCHA data on our behalf under applicable Google Cloud terms and the Cloud Data Processing Addendum.

6) Legal bases (where applicable)

Depending on your jurisdiction, we rely on one or more legal bases, including: contract performance, legitimate interests (such as fraud prevention, product security, and service improvement), legal obligation compliance, and consent where required.

7) Optional browser-tool disclosures

Supported Thumbtack workflows use Thumbtack OAuth, webhooks, and the Partner API; they do not require Feply to extract data from an open Thumbtack browser page. We may offer optional browser tooling in the future for other platforms that do not provide equivalent public APIs.

If you opt into such tooling, its permission prompt and product notice will explain the supported pages and browser capabilities it uses. You are responsible for your lawful use of that tooling and the connected services.

8) Thumbtack integration

If you connect a Thumbtack account, Thumbtack authorizes Feply through OAuth and provides the data permitted by the scopes you approve. Depending on the features you enable, this may include your Thumbtack business profile and identifiers, leads and project details, customer names and contact information, locations, scheduling preferences, conversation history, customer-uploaded photos and other attachments, lead status, reviews, review images, and your public responses.

We use this information to display and synchronize Thumbtack activity, notify you of new leads or messages, generate suggested responses, analyze customer-provided photos for relevant project context, support Feply AI Sales Agent conversations and bookings, send messages or review responses you approve or configure Feply to send, prevent duplicate sends, and report job-status updates when enabled. Automated sending is controlled through your Feply settings and can be paused or disabled.

We store Thumbtack access and refresh credentials using encryption and restrict their use to operating the connected integration. Disconnecting Thumbtack stops new API access and synchronization. Information already copied into Feply may remain for account history, security, dispute resolution, legal compliance, or other retention purposes described below until it is deleted or no longer needed. You may also close your Feply account or submit a full deletion request for eligible data.

Thumbtack is an independent service. Your use of Thumbtack and the information Thumbtack processes remain subject to Thumbtack's Terms of Use and Privacy Policy.

9) Feply AI and automated actions

Feply AI can prepare first replies, continue eligible lead conversations through Feply AI Sales Agent, classify scheduling requests, suggest appointments or reschedules, help with team routing, and assist with support search, support chat, marketing suggestions, and other visible AI tools. To provide a feature, we may send relevant prompts, business profile and instructions, service catalog, lead request answers, recent messages, customer-provided photos, appointment details, and support or campaign text to Google's Gemini API. Prompt and response text may also be sent to Google Cloud safety screening. We limit the context to what the particular feature needs; different features use different inputs. We store drafts, suggestions, decisions, and delivery or booking records needed to operate and audit the workflow.

AI content can be inaccurate. Review-first modes leave sending or scheduling decisions with the workspace user. If you enable an eligible auto-send or automatic scheduling mode, Feply may send a follow-up or scheduling suggestion and complete a validated booking action without a separate approval for each step, subject to the configured limits and review rules. Sensitive or uncertain cases can be held for manual review. A customer can also manage an eligible booking through the private link in a booking email. You can change or disable automation settings.

Google processes Gemini API inputs and outputs under its applicable developer API terms, including provider retention and safety practices. See the Gemini API terms. We do not use Google Calendar data or Google Maps route results to train a general-purpose AI model or for advertising.

10) Calendar, routing, and booking links

Google Calendar is optional and each connecting member authorizes access through Google OAuth. Feply requests permission to list that member's calendars, see availability, and create and manage events on a dedicated calendar Feply creates. We store the calendar list and selections, check busy intervals on selected calendars, read limited timing and Feply-identifying fields on the Feply booking calendar, and create, update, or remove Feply booking events there. Feply does not read titles or descriptions from other calendars. Feply booking events sent to Google can include customer name, email, phone, appointment type and time, location, and notes. Google's handling of information in Calendar is described in the Google Privacy Policy.

We encrypt Google OAuth access and refresh tokens at rest. Disconnecting revokes Feply's Google access and deletes the connection record. It does not remove copies of booking events already written to Google or Feply's own booking history. The use of information received from Google Workspace scopes adheres to the Google User Data and Developer Policy, including its Limited Use requirements. We use that data to provide the visible calendar and booking features, not for advertising or to train a general AI model. Access by Feply personnel is limited to the consent, security, and legal circumstances permitted by that policy.

When smart scheduling is enabled, Feply may send a customer appointment address and nearby job or business addresses to Google Maps Platform's Routes API to estimate driving time and distance. We use those estimates to assess availability, recommend times, and plan team assignments. Drive estimates may be recorded with scheduling suggestions and decisions; we do not create a trip history from them. The addresses and appointments themselves may remain in Feply's booking records. Feply's use of the Routes API is governed by the Google Maps Platform Terms of Service. Google's processing of data is described in the Google Privacy Policy.

Booking emails may go to the customer, assigned pro, and workspace owner according to notification settings. A customer's appointment email can include a private management link for viewing or changing an eligible booking. Anyone with that link may be able to act on the appointment, so recipients should keep it private.

Customer booking emails also include a link to stop future booking notification emails from that business. We store a limited email preference for that business and check it before sending another customer booking email. This choice does not opt the customer out of lead conversation messages, appointment management, or Feply AI tools used by the business. It does not change the business's own email preferences or required account and security notices to Feply users.

11) When we disclose information

We may disclose information to:

• Service providers that support authentication, hosting, AI processing, Google Calendar and route services, email delivery, billing, infrastructure, analytics, support, and security operations. For example, Twilio SendGrid delivers our emails; its data practices are described in Twilio's Privacy Notice.
• Customers and service pros who receive lead replies, appointment details, booking emails, and calendar event copies or updates as part of a requested workflow.
• Workspace administrators where an account is managed by an organization or team owner.
• Authorities and legal recipients where required by law, legal process, or for rights/safety protection.
• Corporate transaction parties in merger, acquisition, financing, bankruptcy, or asset transfer contexts, subject to applicable law and additional restrictions on Google Workspace user data.

We do not sell personal information for monetary consideration.

12) Data retention

We retain personal data for as long as needed to provide the Services, maintain account history, resolve disputes, enforce agreements, prevent abuse, and satisfy legal, accounting, tax, and compliance obligations. Retention periods vary by data type and purpose. This includes AI drafts and decisions, conversation and booking history, notification and delivery records, and records needed to investigate errors. Data that has been sent to a connected platform or emailed to a recipient may also remain with that platform or recipient under their own practices.

Closing your account from the Dashboard cancels active subscriptions and removes active workspace access, but it does not erase all admin, billing, security, or legal records. To request full deletion of eligible personal data where permitted by law, use our secure full deletion request page.

13) Security

We use administrative, technical, and organizational safeguards designed to protect personal data against unauthorized access, alteration, disclosure, and destruction. These include encrypted OAuth credentials, access controls for workspace and team roles, protected connections to providers, and checks around automated sending, booking, and customer management links. We limit provider access to the functions needed for the Services. No system is completely secure, and we cannot guarantee absolute security.

14) International transfers

We and our providers may process data in countries other than your own. Where required, we use appropriate legal transfer mechanisms and safeguards under applicable law.

15) Your rights and choices

Depending on your location, you may have rights to access, correct, delete, port, restrict, object to processing, or withdraw consent for certain processing. You may also have rights to opt out of certain advertising or "sharing" practices where those laws apply.

To protect account security, we may verify identity before processing requests. You may be able to designate an authorized agent where permitted by law.

Workspace users can adjust AI and booking automation settings, select calendars used for availability, disconnect Google Calendar or Thumbtack, and manage team access. A customer with a booking question or privacy request can contact the business they booked with or use our support form below.

Customers can stop future booking notification emails from a particular business using the preference link in a booking email. The preference affects booking emails only. To change or cancel an appointment, use its separate management link or contact the business.

Full deletion requests require email confirmation and additional account verification, such as a verified phone number or subscription card details.

16) Third-party services and links

Our Services may integrate with or link to third-party services. Their privacy practices are governed by their own policies and terms. We are not responsible for third-party privacy practices outside our control.

This includes Thumbtack and the Google services used for Gemini, Calendar, and route estimates. Their applicable terms and privacy notices are linked in the paragraphs describing each integration above.

17) Children

Our Services are not intended for children. If you believe a child has provided personal data, contact us so we can review and take appropriate action.

18) Policy changes

We may update this Privacy Policy from time to time. The latest version and effective date will be posted on this page. When an update requires account-user review, we send a service notice to registered Feply users regardless of optional notification preferences and ask them to accept the current version before they continue using a workspace. We record the version and acceptance time.

19) Contact

For privacy requests or policy questions, use the support form. For full legal deletion requests, submit a secure request at /privacy/delete-account.

If you are contacting us to exercise legal rights, include enough information for us to identify your account and jurisdiction.