Privacy Policy

Information we process

We process account details, operational records, files, support communications, and technical records needed to provide and secure our services.

Google user data and Gmail messages

Black Flow Dev TMS accesses Google user data only after an authorized user grants OAuth permission. Depending on the permissions selected, the service may read Gmail messages and attachments, organize operational email, apply requested mailbox changes, and send business email from the connected account.

Google user data is used only to provide and improve the user-facing features described on the Black Flow Dev TMS product page. It is not sold or used for advertising.

Black Flow Dev TMS's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Who receives Google user data and why

Black Flow Dev L.L.C. discloses Google user data only to the following recipients and only for the purposes described below:

• Supabase provides the managed database and private file storage used to retain synchronized messages, attachments, labels, message state, encrypted OAuth credentials, workflow links, and audit records.
• Railway provides the application hosting and server infrastructure that processes synchronization events, user requests, and limited operational logs needed to run and secure the service.
• OpenAI may process a selected business-document attachment or extracted text when document OCR or rate-confirmation field extraction is required. OAuth access and refresh tokens are not sent to OpenAI. Google user data is not used to train generalized artificial intelligence or machine learning models.
• Google, including the Gmail API and Google Cloud Pub/Sub, provides the connected-mailbox service and synchronization notifications. Pub/Sub notifications contain mailbox and change-history metadata, not Gmail message bodies or attachments.
• Authorized users within the customer's workspace may access synchronized business email according to tenant membership, assigned role, and mailbox permissions.
• Recipients chosen by an authorized user, such as a broker, driver, shipper, customer, or other business contact, receive email and attachments only when the user sends, replies to, or forwards a message.
• Legal authorities may receive limited data when disclosure is required by applicable law, valid legal process, or necessary to protect users, the service, or the public.

We do not sell Google user data, share it with advertising networks or data brokers, or disclose it to unrelated third parties. Service providers may process the data only to deliver contracted services to Black Flow Dev L.L.C. and its authorized customers.

Fleet and transportation integration data

When a customer authorizes the connection, Black Flow Dev TMS may process operational data supplied by fleet, load-source, broker, carrier, accounting, or factoring providers. Depending on the approved integration, this can include vehicles and drivers, vehicle location, hours-of-service, inspection and fault information, load opportunities, shipment status, documents, invoices, factoring and payment status, mileage, and fuel records.

We use this information only to provide the connected customer's requested operational workflows. Provider data is not displayed as live unless the connection has been authorized and successfully validated.

Disconnecting a provider stops future synchronization. Previously synchronized business records remain subject to the customer's retention obligations and may be deleted or de-identified through the verified request process described below.

Storage and protection

Access is restricted by company workspace and user role. We use reasonable administrative and technical safeguards, including encrypted OAuth credentials, private attachment storage, tenant isolation, access controls, and audit records.

Retention and control

We retain information only as needed for service delivery, security, legal obligations, and authorized business records. A user can disconnect a mailbox or revoke access through their Google Account permissions. Revoking access stops future Google access but does not automatically delete records that the customer must retain for legitimate business or legal purposes.

Data deletion requests

An authorized customer administrator or connected Google account owner may request deletion of retained synchronized messages, attachments, OAuth credentials, and related account data by emailing admin@blackflowdev.com with the subject “Data Deletion Request.” We may verify the requester's identity and authority before acting.

After verification, we will delete or de-identify data that is not subject to a required legal or regulatory retention period and confirm the outcome to the requester. If a limited record must be retained, we will explain the category and reason and restrict it from ordinary product use.

Contact

Questions or requests may be sent to admin@blackflowdev.com.