Privacy Policy

1) Scope and role of this notice

This Privacy Policy explains how Feply collects, uses, stores, discloses, and protects personal data in connection with our website, application, account services, billing flows, and the Feply browser extension for Thumbtack lead workflows (collectively, the "Services").

When we provide Services directly to you, we act as a data controller for the personal data described in this policy. In certain cases where a customer account administers multiple users, we may process data under that customer's instructions, and that customer is responsible for its own privacy disclosures to its team and end users.

2) Information we collect

We collect information in the following categories:

• Account and profile data: name, email, authentication identifiers, workspace settings, and configuration preferences.
• Billing and transaction data: subscription plan, billing status, payment metadata, invoices, and subscription events processed by payment partners.
• Extension and automation data: lead identifiers, lead-derived fields you process, draft metadata, automation status logs, and settings needed to execute first-reply workflows.
• Connected-platform data: when you authorize a platform such as Thumbtack, account and business identifiers, access credentials, leads, project details, customer contact information, messages, attachments, reviews, review images, and job-status information made available through that platform.
• Communications data: support requests, product feedback, and other messages sent to us.
• Usage, technical, and security data: log data, approximate geolocation from IP, device/browser metadata, and events used to maintain reliability, detect abuse, and troubleshoot issues.

3) Sources of information

We collect information from:

• You, when you create an account, subscribe, connect tools, or contact support.
• Your use of the Services, including extension events and operational telemetry.
• Third-party providers you direct us to use (for example, identity/auth and payment providers).
• Connected lead and messaging platforms, including Thumbtack, when you authorize Feply to access the platform on your behalf.
• Security and anti-fraud sources where necessary to protect our Services and users.

4) How we use information

• Provide and operate the Services and requested features.
• Authenticate users and manage account access.
• Process subscriptions, billing events, and account administration.
• Generate, store, and manage draft and automation workflows.
• Improve reliability, performance, and product safety.
• Investigate misuse, fraud, policy violations, and security incidents.
• Comply with legal obligations and enforce our legal terms and rights.

5) reCAPTCHA Enterprise

We use reCAPTCHA Enterprise on selected public forms and account-access flows to help detect spam, automated misuse, credential abuse, fraud, and other malicious activity. This processing supports the security and reliability of the Services and is part of how we verify that requests come from legitimate users.

In connection with those protections, request, browser, device, and interaction data may be evaluated before we accept a submission or allow a security-sensitive action to proceed. We use that information only for security, abuse prevention, and service protection purposes described in this policy.

Feply determines the purposes for which reCAPTCHA Enterprise is used on our site. Google Cloud processes related reCAPTCHA data on our behalf under our Google Cloud contractual terms and applicable data processing commitments.

6) Legal bases (where applicable)

Depending on your jurisdiction, we rely on one or more legal bases, including: contract performance, legitimate interests (such as fraud prevention, product security, and service improvement), legal obligation compliance, and consent where required.

7) Browser extension disclosures

The Feply extension is designed to run on specified Thumbtack lead pages and uses browser permissions for storage, background scheduling, tab context, and service notifications. Extension data may be stored locally in your browser and synchronized with your Feply account as needed to deliver functionality.

You are responsible for your lawful use of the extension, including whether you are permitted to process and send lead-related content through connected services.

8) Thumbtack integration

If you connect a Thumbtack account, Thumbtack authorizes Feply through OAuth and provides the data permitted by the scopes you approve. Depending on the features you enable, this may include your Thumbtack business profile and identifiers, leads and project details, customer names and contact information, locations, scheduling preferences, conversation history, customer-uploaded photos and other attachments, lead status, reviews, review images, and your public responses.

We use this information to display and synchronize Thumbtack activity, notify you of new leads or messages, generate suggested responses, analyze customer-provided photos for relevant project context, send messages or review responses you approve or configure Feply to send, prevent duplicate sends, and report job-status updates when you enable that functionality. Automated sending is controlled through your Feply settings and can be paused or disabled.

We store Thumbtack access and refresh credentials using encryption and restrict their use to operating the connected integration. Disconnecting Thumbtack stops new API access and synchronization. Information already copied into Feply may remain for account history, security, dispute resolution, legal compliance, or other retention purposes described below until it is deleted or no longer needed. You may also close your Feply account or submit a full deletion request for eligible data.

Thumbtack is an independent service. Your use of Thumbtack and the information Thumbtack processes remain subject to Thumbtack's own terms and privacy notices.

9) AI and automated drafting

Our Services may process lead and profile inputs to generate suggested first-reply content. Generated outputs may contain inaccuracies and require user review before use. You are responsible for final messages, compliance representations, and commitments made to prospects.

Feply also uses Google's Gemini models and related Google AI services for selected features such as reply drafting, marketing campaign suggestions, support search, support chat assistance, and related workflow tooling. When you use those features, we may send the prompt, related workspace or account settings, lead or campaign context, support query text, and other content you choose to process through the feature to Google so the feature can return a result.

We may use service providers to perform AI-related processing on our behalf under contractual confidentiality and security obligations. For more information about Google's Gemini privacy information, review Google's Gemini privacy page.

10) When we disclose information

We may disclose information to:

• Service providers that support authentication, hosting, billing, infrastructure, analytics, support, and security operations.
• Workspace administrators where an account is managed by an organization or team owner.
• Authorities and legal recipients where required by law, legal process, or for rights/safety protection.
• Corporate transaction parties in merger, acquisition, financing, bankruptcy, or asset transfer contexts.

We do not sell personal information for monetary consideration.

11) Data retention

We retain personal data for as long as needed to provide the Services, maintain account history, resolve disputes, enforce agreements, prevent abuse, and satisfy legal, accounting, tax, and compliance obligations. Retention periods vary by data type and purpose.

Closing your account from the Dashboard cancels active subscriptions and removes active workspace access, but it does not erase all admin, billing, security, or legal records. To request full deletion of eligible personal data where permitted by law, use our secure full deletion request page.

12) Security

We use administrative, technical, and organizational safeguards designed to protect personal data against unauthorized access, alteration, disclosure, and destruction. No system is completely secure, and we cannot guarantee absolute security.

13) International transfers

We and our providers may process data in countries other than your own. Where required, we use appropriate legal transfer mechanisms and safeguards under applicable law.

14) Your rights and choices

Depending on your location, you may have rights to access, correct, delete, port, restrict, object to processing, or withdraw consent for certain processing. You may also have rights to opt out of certain advertising or "sharing" practices where those laws apply.

To protect account security, we may verify identity before processing requests. You may be able to designate an authorized agent where permitted by law.

Full deletion requests require email confirmation and additional account verification, such as a verified phone number or subscription card details.

15) Third-party services and links

Our Services may integrate with or link to third-party services. Their privacy practices are governed by their own policies and terms. We are not responsible for third-party privacy practices outside our control.

This includes Google services used in connection with Gemini-powered features. You should review the applicable Google policies before using those features, including Google's Gemini privacy information.

16) Children

Our Services are not intended for children. If you believe a child has provided personal data, contact us so we can review and take appropriate action.

17) Policy changes

We may update this Privacy Policy from time to time. The latest version and effective date will be posted on this page.

18) Contact

For privacy requests or policy questions, use the support form. For full legal deletion requests, submit a secure request at /privacy/delete-account.

If you are contacting us to exercise legal rights, include enough information for us to identify your account and jurisdiction.