Privacy Policy

1. Introduction

ParentFlo is a school email organization service operated by Andrew White Consulting LLC ("Company," "we," "our," or "us"). This Privacy Policy describes how we collect, use, store, and disclose information when you use ParentFlo at parentflo.app (the "Service").

By creating an account or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with these practices, please do not use the Service.

This policy applies to all users of ParentFlo. Because the Service involves the processing of school-related communications that may reference minors, we have taken particular care to address children's privacy in Section 8.

2. Information We Collect

Account Information

When you create a ParentFlo account, we collect:

• Your name
• Your email address
• A password (stored as a one-way cryptographic hash using bcrypt; we cannot read your password)
• Your timezone preference

Children's Profile Information

To enable email routing and organization, you enter information about your children:

• Your child's first name
• Your child's grade level (optional)
• Your child's school email domain (e.g., lincoln.k12.tx.us) or specific sender email addresses you wish to track

This information is entered by you as the parent or guardian. ParentFlo does not collect any information directly from children, and children do not interact with our Service.

Forwarded School Emails

ParentFlo operates by receiving school emails that you forward to your personal ParentFlo address. When an email is forwarded to us, we store:

• The email subject line
• The email body (full content)
• The sender's email address and display name
• The date and time the email was received
• AI-generated metadata (urgency score, extracted dates, and optional summaries — see Section 4)

We receive only the emails you choose to forward. We do not access your personal email account, inbox, or any email not explicitly routed to your ParentFlo address.

Payment Information

ParentFlo Pro subscriptions are processed through Stripe, Inc. When you subscribe, your payment card details are entered directly into Stripe's secure payment interface. ParentFlo never receives, stores, or processes raw payment card numbers. We retain only Stripe's customer and subscription identifiers to manage your billing relationship. See Section 5 for details on Stripe's data handling.

Usage and Technical Data

We collect limited technical data to operate and maintain the Service, including:

• Login events and session activity
• Browser type and device type (for compatibility purposes)
• Push notification subscription tokens (if you enable notifications)
• Daily digest time preferences

3. How We Use Your Information

We use the information we collect exclusively to provide, maintain, and improve the ParentFlo Service. Specific uses include:

• Authenticating your login and maintaining your session
• Routing incoming forwarded emails to the correct child profile
• Displaying your school emails organized by child and urgency
• Sending push notifications and daily digest reminders at times you specify
• Processing AI analysis on email content (see Section 4)
• Managing your Stripe subscription and billing status
• Sending transactional emails (welcome email, password reset, urgent email alerts)
• Diagnosing errors and improving system reliability

We do not use your information to build advertising profiles, to send unsolicited marketing communications, or for any purpose unrelated to delivering the Service.

4. AI Analysis of Email Content

ParentFlo uses artificial intelligence to help you prioritize your school emails. Here is exactly how AI is used:

Automatic Analysis (On Arrival)

When a school email arrives, we automatically analyze it to extract:

• An urgency score (Action Required, Important, Informational, or Low Priority)
• Key dates and deadlines mentioned in the email
• A brief two-sentence preview summary

On-Demand Summaries (User-Initiated)

When you tap "AI Summary" on a specific email, we send that email's content to Groq's API to generate a plain-English summary. This action occurs only when you explicitly request it.

Groq Data Handling

AI analysis is performed via the Groq API. Groq does not use API-submitted content to train its models. For details, see groq.com/privacy-policy.

Email content sent to Groq is transmitted securely over HTTPS/TLS and is subject to Groq's data protection commitments. No email content is shared with any other AI provider or third party for analysis or any other purpose.

5. Third-Party Service Providers

We work with a limited set of trusted service providers to operate ParentFlo. Each provider accesses only the data necessary to perform its function. We do not share your data with advertising networks, data brokers, social media platforms, or any party not listed below.

6. Data Retention

We retain your data for as long as your account is active. Specific retention rules:

• Forwarded school emails are retained for 12 months from the date received, then automatically deleted. You may also delete individual emails at any time from within the app.
• Account and profile data (name, email, children's profiles) are retained for the lifetime of your account.
• Payment records (Stripe identifiers and billing history) are retained for 7 years to satisfy applicable tax and accounting requirements.
• Server logs used for error diagnosis are retained for 30 days, then automatically purged.

When you delete your ParentFlo account, all account data, children's profiles, and stored emails are permanently deleted from our systems immediately. Deletion is irreversible. Stripe payment records may be retained by Stripe for their legally required period independently of ParentFlo's deletion.

7. Security

We implement the following security measures to protect your information:

• Encryption in transit: All data transmitted between your browser and ParentFlo's servers is encrypted using HTTPS/TLS. Email routing through Mailgun occurs over encrypted connections.
• Password security: Passwords are hashed using bcrypt with a unique salt before storage. Your plaintext password is never stored and cannot be retrieved by ParentFlo staff.
• Payment security: All payment card data is handled exclusively by Stripe. ParentFlo does not receive, store, or transmit payment card numbers, CVVs, or billing addresses.
• Access controls: Database access is restricted to ParentFlo's application servers. Direct database access requires authentication and is logged.
• Infrastructure security: Servers are hosted on DigitalOcean, which maintains SOC 2 Type II certification and provides DDoS protection and network-level security controls.

No system is completely impervious to breach. In the event we become aware of a security incident that materially affects your personal information, we will notify you by email at the address on your account as promptly as required by applicable law.

8. Children's Privacy (COPPA Compliance)

ParentFlo is designed exclusively for use by parents and legal guardians who are 18 years of age or older. The Service is not directed at children, and we do not knowingly collect personal information from children under the age of 13.

If you believe that a child under 13 has provided us with personal information without parental consent, please contact us at info@andrewwhiteconsulting.com and we will take immediate steps to delete that information.

9. Your Rights

You have the following rights with respect to your personal information. You can exercise most of these rights directly from within the ParentFlo app without contacting us.

• Right to access: You may view all information stored in your account at any time by logging in. To request a machine-readable export of your data, contact us at the address below.
• Right to correction: You may update your account information, children's profiles, and preferences directly within Settings.
• Right to deletion: You may delete your account at any time from Settings > Danger Zone > Delete My Account. Deletion removes all personal data immediately and is irreversible.
• Right to opt out of data sale: We do not sell personal information. This right is inherently satisfied.
• Right to opt out of AI processing: On-demand AI Summaries require your explicit action. You may simply not use this feature if you prefer that your emails not be processed by Groq.

Texas residents may have additional rights under the Texas Data Privacy and Security Act (TDPSA). California residents may have additional rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA, including the right to know, the right to delete, the right to correct, and the right to opt out of the sale or sharing of personal information.

To exercise any right or to submit a verifiable request, contact us at info@andrewwhiteconsulting.com or info@parentflo.app. We will respond within 45 days.

10. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, the law, or the features we offer. If we make material changes, we will notify you by email to the address on your account and update the effective date at the top of this page. Your continued use of ParentFlo after notice constitutes acceptance of the updated policy.

We encourage you to review this policy periodically.

11. Contact

For privacy questions, requests, or concerns, contact us: