Privacy Policy
Last updated: October 9, 2026
Flomailr is an email marketing service operated by Colorado Web Forge LLC, based in Lone Tree, Colorado ("Flomailr", "we", "us"). This policy explains what we collect, why, who we share it with, and the choices you have. It covers flomailr.com, the Flomailr app, the Flomailr API, and the hosted MCP connector that AI apps use.
If anything here is unclear, email hello@flomailr.com.
Two kinds of data
Your account data. When you sign up and use Flomailr, we hold information about you and your workspace. For this data, we decide how it is used.
Your contacts' data. When you upload or collect contacts and send them email, you decide what that data is for and we process it on your behalf, only to provide the service. You are responsible for having the right to collect and email those people (see our Terms of Service). If one of your contacts asks us about their data, we will point them to you and help you respond.
What we collect
Account and workspace information: your name, email address and a hashed password (we never store the password itself), the workspace name, sender name, reply-to address and the postal address you add for email footers, team members and their roles.
Content you create: campaigns, designs, templates, brand kits (logo, colours, fonts, and anything we read from a website you ask us to import a brand from), landing pages, forms, automations and images you upload.
Contacts you manage: email addresses, names, tags, list memberships, custom fields you define, phone numbers and SMS consent if you use SMS, subscription status, and the record of when and how a contact agreed to hear from you.
Engagement data: when your emails are delivered, opened or clicked, and when they bounce or are marked as spam. Opens are measured with a small image in the email and clicks by routing links through Flomailr. We record the IP address and user agent of those requests so we can tell a person reading an email from an automated system (such as Apple Mail Privacy Protection) that opens it in the background. If you install our site tracking script, it records page views on your own site for contacts who arrive from your emails, and it keeps its identifier in the browser's session storage rather than a long-lived cookie.
Credentials for integrations: API keys and OAuth tokens for the MCP connector. We store only a one-way hash of each key and token, so we cannot read them back.
Activity records: a log of actions taken through the API and AI connector (for example a dry run or a send), which you can read in your settings, and security records such as sign-in attempts and the IP addresses they came from.
Cookies: one session cookie that keeps you signed in. We do not use advertising cookies or third-party analytics on flomailr.com.
How we use it
We use this data to run the service: storing and sending your email, measuring results, enforcing the sending rules you and we set (suppression lists, daily caps, quiet hours), keeping accounts secure, preventing abuse and spam, answering support requests, and telling you about changes to the service. We may email you about your account and about Flomailr itself. You can unsubscribe from product news at any time.
We do not sell personal data. We do not use your content or your contacts' data to train AI models.
AI apps you connect
If you connect an AI app (such as Claude or ChatGPT) to Flomailr, that app can read and change data in the workspace you approved, within the limits of the tools Flomailr offers it, for example designing a draft, reading campaign results or sending a campaign through Flomailr's safeguards. What the AI app then does with that data is governed by its provider's terms and privacy policy, not ours. You can see what a connected app did in Settings, Activity, and disconnect it at any time in Settings, Connected apps.
Who we share it with
We share data only with service providers that help us run Flomailr, under agreements that limit them to that purpose:
- Vercel, for hosting the app and storing uploaded images.
- Neon, for our database.
- Resend, for sending and receiving email.
- Amazon Web Services, for sending SMS messages if you use SMS.
When an email you send uses a web font, a recipient's email app may load that font from Google Fonts, which then sees the recipient's IP address. The default themes work without web fonts.
We may also disclose data if the law requires it, to protect the rights and safety of our users or the public, or as part of a sale or merger of our business, in which case this policy continues to apply to it.
How long we keep it
We keep your data while your account is open. When you delete contacts, we keep the email addresses of people who unsubscribed, bounced or complained on a suppression list, so they are never emailed again by mistake. If you ask us to close your account, we delete your workspace data within 30 days, except records we must keep for legal, security or fraud-prevention reasons, and data in routine backups, which expires on its own schedule.
Security
Connections to Flomailr are encrypted. Passwords are hashed with a modern algorithm, API keys and tokens are stored as hashes, and every workspace's data is kept separate from every other workspace's. No system is perfectly secure, so please use a strong password and tell us right away if you think your account has been compromised.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to or restrict how we use it. To make a request, email hello@flomailr.com. We will verify that the request comes from you and respond within the time the law allows. If you are in the EU or UK, you can also complain to your local data protection authority.
Children
Flomailr is not meant for anyone under 16, and we do not knowingly collect their data.
Changes
If we change this policy, we will update the date at the top. If a change is significant, we will tell account holders by email or in the app before it takes effect.
Contact
Colorado Web Forge LLC, Lone Tree, Colorado. Email hello@flomailr.com.