Terms of Service

1. Acceptance of Terms

By accessing or using Penzago at penzago.com, you agree to be bound by these Terms of Service. Penzago is a service of GETREFLOW LLC (d/b/a Penzago) ("we," "our," or "us"). If you do not agree to these terms, you may not use our services. Changes to these terms are made only as described in Section 21 (Changes to These Terms). By using our platform, you also agree to comply with the terms, policies, and guidelines of any third-party services you connect through Penzago, including but not limited to Google, Meta, and LinkedIn.

2. Description of Service

Penzago is a software-as-a-service platform that provides managed automation playbooks and AI-assisted communication features for businesses in real estate, home services, and professional services. Our platform enables you to subscribe to industry-specific workflows, connect your existing tools and third-party integrations via OAuth authorization, and automate lead management and revenue operations. Depending on the features enabled for your account, the Service includes an automated AI assistant that responds to text messages and website chat conversations on your behalf and can book appointments on your connected calendar, as well as AI-assisted content generation (for example, listing presentations and marketing copy). AI-generated messages identify themselves as automated in the conversation (see Section 7). The platform facilitates connections to services such as Google (Google Calendar, Google Sheets, Google Forms), Meta (Facebook, Instagram), LinkedIn, HubSpot, Salesforce, and other supported providers.

3. User Accounts

You must create an account to use our services. You are responsible for maintaining the confidentiality of your account credentials and for all activities that occur under your account. You agree to provide accurate and complete information when creating your account and to update it as necessary. You must notify us immediately of any unauthorized use of your account.

4. Third-Party Integrations and OAuth Authorization

Penzago enables you to connect third-party services to power your automation playbooks. When you connect an integration, you authorize Penzago to access specific data from that service on your behalf through industry-standard OAuth 2.0 authorization. We only access data that you explicitly authorize through the OAuth consent process presented by each third-party provider.

The types of data we may access, depending on the integrations you connect, include:

• CRM platforms (HubSpot, Salesforce, Zoho CRM): Contact records, company information, and deal data to facilitate lead management and automation workflows.
• Google services (Google Calendar, Google Sheets, Google Forms): Calendar event management, spreadsheet data, and form response data to power scheduling and lead-intake automations.
• Microsoft services (Outlook Calendar, Outlook Mail): Calendar event management and email sending capabilities for workflow automations.
• Social media platforms (Facebook, Instagram, LinkedIn, TikTok): Page management, lead retrieval, content publishing, and engagement data to automate social media workflows.
• Email and marketing platforms (Mailchimp): Audience and campaign data to automate email marketing workflows.
• Form and data platforms (Typeform, JotForm, Google Sheets): Form submissions and response data for lead capture automations.

We request only the minimum scopes necessary to provide the functionality of your subscribed playbooks. You may review and manage your connected integrations at any time from your account dashboard.

5. User Data and Consent

Before we collect or access any data from your connected third-party services, we obtain your explicit consent through the OAuth authorization flow. By granting authorization, you consent to our accessing, processing, and storing the data described in the integration's consent screen for the purpose of providing Penzago's automation services.

You have the right to:

• Know what data is being collected and when it is collected
• Understand how your data will be used and disclosed
• Know the specific types of data being accessed from each connected service
• Withdraw your consent at any time by disconnecting the integration from your dashboard
• Request deletion of your data at any time (see Section 9)
• Access and export your data upon request

We use your third-party integration data solely to provide the Penzago services you have subscribed to — your automation playbooks and the AI-assisted features described in Section 7 — and for no other purpose. We do not use your data for profiling, advertising, or any purpose unrelated to the services you have requested.

6. Limited Use Disclosures

Our use of data received from third-party platforms is subject to the following restrictions and disclosures:

Google API Services

GETREFLOW LLC's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We limit our use of Google user data to providing and improving user-facing features that are prominent in Penzago's interface. We do not use Google user data for advertising, and we do not allow humans to read your Google data unless (a) we have your affirmative agreement, (b) it is necessary for security purposes, (c) it is necessary to comply with applicable law, or (d) our use is limited to internal operations and the data has been aggregated and anonymized.

Meta Platform Data

Data received from Meta platforms (Facebook and Instagram) is used exclusively to provide the automation services you have requested. We will not transfer Meta platform data to any advertising network, data broker, or other advertising or monetization-related service. We will not use Meta platform data for surveillance purposes or to build user profiles for advertising. We comply with the Meta Platform Terms and Developer Policies.

LinkedIn Data

Data received from LinkedIn APIs is used solely for the purposes disclosed and authorized by you during the OAuth consent process. We do not use LinkedIn data for recruiting, advertising, or any purposes beyond executing the automation workflows you have configured. We comply with the LinkedIn API Terms of Use.

7. Artificial Intelligence Features

Some features of the Service are powered by large language models from third-party AI providers — currently Anthropic and OpenAI. These features include the automated AI assistant that responds to text messages and website chat on your behalf, and AI-assisted content generation.

• What is shared with AI providers. To generate each response or piece of content, we send the conversation or prompt content together with relevant business context you have configured (such as your business name, services, hours, FAQs, and appointment availability). Consumer phone numbers are structurally excluded from AI prompts.
• No training on your data. Our AI providers are bound by commercial terms that prohibit using your data to train their models, with no retention beyond short-lived operational logs.
• Automated-nature disclosure. Conversations handled by the AI assistant are stored by the Service, and the assistant identifies itself as automated — and discloses that messages are recorded and processed by our AI service provider — at the start of the conversation. You are responsible for any additional notices or consents required at your own touchpoints (your website, forms, and phone greetings), including any notice required by applicable communication-recording laws.
• No concealment. You agree not to configure, prompt, or instruct any AI feature to conceal its automated nature or to make claims you know to be false.
• Acting on your behalf. You authorize the Service, including its AI features, to send messages, respond to inquiries, and book appointments in your business's name, solely as directed by your configuration. You can pause or disable these features from your dashboard or by contacting us.
• Your responsibility to review. AI-generated content may contain inaccuracies. You — not GETREFLOW LLC — are responsible for reviewing and supervising your programs' content and configuration, including any AI-generated content you approve for publication (see Sections 16 and 18).

8. Data Handling and Security

We implement industry-standard security measures to protect all data processed through our platform, including data received from third-party integrations:

• All data is encrypted in transit using TLS and at rest using AES-256 encryption
• OAuth access tokens and refresh tokens are stored in encrypted vaults and are never exposed in plaintext
• Tenant data is isolated using row-level security policies, ensuring your data is never accessible to other users
• We do not create permanent copies of third-party platform data beyond what is necessary for service delivery
• We conduct regular security assessments and monitoring to protect against unauthorized access, alteration, disclosure, or destruction of data

If we become aware of any security incident affecting your data, we will notify you promptly and take immediate steps to mitigate the impact.

Data Processing Addendum. Where we process personal information on your behalf — including the contact details of the consumers who reach your business through the Service — that processing is governed by our Data Processing Addendum at penzago.com/legal/dpa, which is incorporated into these Terms by reference. The Addendum contains the service-provider terms required by the California Consumer Privacy Act and comparable state privacy laws, the current list of our authorized subprocessors, the specific technical and organizational security measures we maintain (Exhibit B), our security-incident notification commitments, and our retention and deletion practices. If the Addendum conflicts with these Terms as to the processing of personal information, the Addendum controls.

9. Data Deletion and Portability

You may request deletion of your data at any time by contacting us at hello@getreflow.ai or through your account dashboard settings. Upon receiving a deletion request, we will:

• Permanently delete all your personal data and account information
• Revoke and delete all stored OAuth access tokens and refresh tokens for your connected integrations
• Remove all third-party platform data associated with your account
• Complete the deletion process within 30 days of your request

Where applicable under your jurisdiction, you have the right to request a copy of your data in a portable, machine-readable format. To exercise this right, contact us at hello@getreflow.ai.

10. Integration Disconnection and Token Revocation

You may disconnect any third-party integration at any time from your account dashboard. When you disconnect an integration:

• The associated OAuth access and refresh tokens are immediately revoked and permanently deleted from our systems
• Any cached data from that integration is purged
• Automation playbooks that depend on the disconnected integration will be paused until a new connection is established

You may also revoke Penzago's access directly from the third-party platform (for example, through your Google Account permissions, Facebook App Settings, or LinkedIn Permitted Services page). We honor all revocations and will delete the associated tokens upon detection.

11. Data Sharing Restrictions

We do not sell your personal information or any data received from third-party integrations. We impose the following restrictions on data sharing:

• We do not share, sell, rent, or trade user data with advertising networks, data brokers, or any advertising-related service
• We do not use third-party platform data for purposes beyond providing and improving the automation services you have subscribed to
• Data is shared only with trusted service providers essential to platform operations: Stripe (payment processing), Supabase (database hosting), Vercel (application hosting), Railway (hosting of our workflow-automation engine), Telnyx (SMS and voice delivery), Mailgun (email delivery), Anthropic and OpenAI (AI language model providers — see Section 7), Upstash (rate limiting and short-lived caching), and Sentry (error monitoring). These providers are contractually obligated to protect your data and are prohibited from using it for their own purposes
• We will not transfer, disclose, or sell data received from any third-party platform to any entity conducting surveillance

12. Billing and Payments

Penzago offers subscription plans with usage-based billing. By subscribing to a plan, you authorize us to charge your payment method on a recurring basis. Usage fees are calculated based on the number of leads processed through your active playbooks. All fees are non-refundable unless otherwise stated. We reserve the right to change pricing with 30 days' notice. Payment processing is handled securely through Stripe.

13. SMS/Text Messaging

Penzago enables businesses to send automated SMS text messages to leads who submit inquiries through web forms connected to our platform. By using our SMS features, you agree to the following terms:

Program Description

Penzago's SMS programs send automated text messages to prospective customers (leads) who submit an inquiry through a web form (such as Typeform, JotForm, Google Forms, or a website contact form) that includes their phone number, or who call or text a business using our platform. Messages are conversational and informational follow-ups to contact initiated by the recipient and, only where the opt-in expressly disclosed it, recurring informational or marketing messages. Some messages are generated by an automated AI assistant that identifies itself in the conversation (see Section 7).

Message Frequency & Content

• Message frequency varies by program and conversation, as disclosed at opt-in
• Messages relate to the recipient's inquiry: acknowledgments, scheduling and appointment messages, requested information, and any recurring content expressly disclosed at opt-in
• Recurring or marketing messages are sent only where the recipient's opt-in expressly disclosed them

Message & Data Rates

Message and data rates may apply depending on the recipient's mobile carrier and plan. GETREFLOW LLC is not responsible for any charges incurred from receiving SMS messages.

Consent & Opt-In

Recipients consent to receive SMS by voluntarily submitting a web form that includes their phone number. Forms display consent language informing the user that they may receive an automated text message in response to their inquiry. For full details, see our SMS Consent & Opt-In Policy at penzago.com/privacy/sms-consent.

Opt-Out & Support

• Reply STOP to any message to opt out and stop receiving texts
• Reply HELP for assistance
• Contact us at hello@getreflow.ai for support

Phone Number Privacy

Phone numbers are used only to deliver the consented SMS response. Phone numbers are never sold, rented, or shared with third parties for marketing purposes. Phone numbers are shared only with Telnyx, our SMS delivery provider, for the sole purpose of message delivery. See our Privacy Policy at penzago.com/privacy for full details.

14. Your Warranties

Our messaging programs run on phone numbers and carrier campaigns that we register and operate on behalf of every customer on the platform. Because one customer's consent failure creates legal and deliverability exposure for us and for every other customer, you represent and warrant, on a continuing basis, that:

• Consent. For every consumer whose phone number you submit to the Service with consent asserted — directly, through a form, or through a connected integration — that consumer has given prior express written consent to receive automated text messages of the kind the applicable playbook sends, captured in a manner that meets the requirements of the Telephone Consumer Protection Act, applicable state telemarketing and telephone-solicitation laws, and the CTIA Messaging Principles and Best Practices. (Contacts you submit without asserting consent are not messaged by the Service.)
• Accurate disclosures. Your opt-in disclosures accurately describe the messages that will be sent, including recurring messages where applicable, and were presented unbundled from any condition of purchase.
• No purchased lists. You have not purchased, rented, borrowed, or harvested the contact information of any consumer submitted to the Service, and no list you submit was obtained from a data broker or lead reseller without consent that specifically named your business.
• Your own touchpoints. Where your website, forms, or phone lines feed the Service, you have made the disclosures required by applicable call- and message-recording laws for your jurisdiction and your consumers' jurisdictions.
• Records. You will maintain records evidencing the consent described above — including the consent text presented, the timestamp, and the source — for at least four (4) years, will not delete those records while a related claim or audit is pending, and will provide them to us within five (5) business days of a reasonable request.

15. Acceptable Use

Your use of the platform is also subject to our Acceptable Use Policy at penzago.com/legal/aup, which is incorporated into these Terms by reference. You agree not to use Penzago to:

• Violate any applicable laws or regulations
• Send unsolicited messages, spam, or bulk communications
• Transmit malware, viruses, or other harmful code
• Interfere with or disrupt the platform or its infrastructure
• Attempt to gain unauthorized access to other accounts or systems
• Use the service for any fraudulent or deceptive purposes
• Violate the terms of any third-party integrations connected through our platform, including the terms of service of Google, Meta, LinkedIn, and any other connected provider
• Use data obtained from third-party integrations for purposes not authorized by the user or the third-party platform
• Scrape, build databases of, or create permanent copies of third-party platform data outside of our platform

16. Intellectual Property

All content, features, and functionality of the Penzago platform — including but not limited to software, designs, text, playbook templates, prompts and AI configurations, and automation workflows — are owned by GETREFLOW LLC and are protected by intellectual property laws. You retain ownership of your data and content that you upload or process through the platform. As between you and GETREFLOW LLC, content generated for you by the Service's AI features — such as messages sent on your behalf and generated presentation or marketing copy — is your content, and we claim no ownership of it; the prompts, templates, and AI configurations used to produce it remain part of the platform. By using our service, you grant us a limited license to process your data solely for the purpose of providing the services you have subscribed to.

17. Indemnification

By you. You will defend and indemnify GETREFLOW LLC, its member or members, and its personnel against third-party claims — including regulatory actions and class claims — and resulting damages, penalties, statutory damages, settlements, and reasonable attorneys' fees, arising out of: (a) your breach of the warranties in Section 14 or of the Acceptable Use Policy; (b) lead data or lists you submitted, including their source and the consent, or absence of consent, behind them; (c) message content, offers, or business practices specific to your business, including content you supplied or approved; (d) your breach of the terms of any third-party platform you connect through the Service; and (e) your violation of law in your use of the Service.

By us. We will defend and indemnify you against third-party claims alleging that the Service, as provided by us and used as authorized, infringes a U.S. patent, copyright, or trademark, or misappropriates a trade secret, and we will pay the resulting damages and reasonable attorneys' fees finally awarded or agreed in settlement. If the Service is enjoined, we may procure the right for you to continue using it, modify it to be non-infringing, or terminate and refund prepaid unused fees. This paragraph does not apply to claims arising from your data, your content or configuration, combination of the Service with items we did not provide, or use of the Service in breach of these Terms, and it states our entire liability for infringement.

Procedure. The party seeking indemnification must give the other prompt written notice of the claim, tender sole control of the defense and settlement — provided that no settlement imposing a non-monetary obligation on the indemnified party may be made without its consent — and provide reasonable cooperation at the indemnifying party's expense.

18. Limitation of Liability

To the maximum extent permitted by law, GETREFLOW LLC shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to loss of profits, data, or business opportunities. Our total liability for any claims arising from these terms or your use of the service shall not exceed the amount you paid to GETREFLOW LLC in the twelve (12) months preceding the claim. The service is provided "as is" without warranties of any kind, either express or implied. We do not warrant that AI-generated content will be accurate or error-free; you — not GETREFLOW LLC — are responsible for reviewing and supervising your programs' content and configuration (see Section 7).

The limitations in this Section do not apply to your indemnification obligations under Section 17, your liability for breach of Section 14, your payment obligations, or either party's fraud, gross negligence, or willful misconduct. Statutory damages asserted by consumers or regulators that arise from your consent failures are not capped by this Section.

19. Suspension and Termination

Your termination. You may terminate at any time, for any reason, through your account settings or by contacting us at hello@getreflow.ai.

Our termination for convenience. We may terminate for convenience on at least thirty (30) days' advance written notice to the email address registered on your account. Because the Service hosts lead-capture forms and embedded widgets that you may have published on your own website, this notice period is intended to give you time to replace them before they stop functioning.

Suspension or termination for cause. The thirty-day notice period above does not apply where we need to act immediately. We may suspend or terminate your account, or suspend an affected campaign, playbook, or phone number without terminating your account, if: you materially breach these Terms and fail to cure within fifteen (15) days of our notice — five (5) days for a breach of Section 14 (Your Warranties) or of the Acceptable Use Policy; the breach is incapable of cure; you become insolvent; your payment fails and remains unpaid after notice; or immediate action is required to comply with law, to satisfy a carrier or third-party platform requirement, or to prevent material harm to the Service, to other customers, or to consumers.

Effect of termination. On termination: (a) your access ends on the effective date and we cancel your subscription; (b) a seven (7) day grace period follows, during which deletion of your account data is pending, you may request an export of your data — delivered as time-limited secure download links — and you may reverse a termination initiated in error; (c) after the grace period we revoke and delete your OAuth tokens and stored credentials, remove your workflows from the automation engine, and delete or de-identify your data as described in the Data Processing Addendum; and (d) records we are legally required or permitted to retain, including consumer opt-out records, billing records, and audit logs, are retained as described in the Addendum. You may request immediate deletion of all data at any time by contacting us at hello@getreflow.ai.

Sections 9, 11, 14, and 16 through 22 survive termination.

20. Governing Law

These Terms of Service shall be governed by and construed in accordance with the laws of the State of California, without regard to its conflict of law provisions. Any disputes arising from these terms shall be resolved in the state courts located in Contra Costa County, California, or the United States District Court for the Northern District of California.

21. Changes to These Terms

We may update these Terms of Service from time to time. If we make material changes — including changes to fees, liability, dispute resolution, or how we access, use, or share data from third-party integrations or our AI providers — we will notify you by email and through a prominent notice on our platform at least 30 days before the changes take effect, and we will require you to affirmatively accept the updated terms (for example, by clicking to agree at your next sign-in) before they apply to you. Material changes are never effective against you merely because you continued using the platform. Non-material changes (such as clarifications and typo fixes) take effect when posted, with the "Last updated" date revised. If you do not accept a material change, you may terminate under Section 19 and the prior terms govern until termination.

22. Contact Us

If you have questions about these Terms of Service, your data, or how we handle third-party integration data, please contact us at hello@getreflow.ai.