Privacy Policy

Effective date: November 3, 2026

This Privacy Policy explains what personal information Thinkfleet AI, LLC ("ThinkFleet", "we", "us", "our"), collects, how we use and share it, how long we keep it, and the choices and rights you have. Flobyte, ServFlo, iSpector, SkuFlow, Base316, MemMesh and EngageIt are products of Thinkfleet AI, LLC, and this policy covers all of them (together, the "Services").

Our products and which policy applies

Product	What it is	Product policy
ThinkFleet (thinkfleet.ai)	Our company website and the ThinkFleet platform, APIs and AI agents	This policy
Flobyte (flobyte.ai)	AI automation platform: workflows, connectors, AI agents and a knowledge base, on the web, Android and iOS, desktop, and browser, Microsoft Office and VS Code extensions	This policy
ServFlo (servflo.ai)	Field service software for home-service businesses	servflo.ai/legal/privacy-policy
iSpector (ispector.ai)	Home inspection software, with the iSpector inspector app	ispector.ai/legal/privacy-policy
SkuFlow (skuflow.ai)	Commerce software for custom and decorated products	skuflow.ai/legal/privacy-policy
Base316 (base316.com)	Sign-in, billing, usage metering and access control that software companies add to their own apps	base316.com/legal/privacy-policy
MemMesh (memmesh.ai)	Persistent memory for AI assistants and tools, over MCP	This policy
EngageIt (engageit.ai)	Customer data, rewards and messaging for businesses	This policy

Which one applies. Where a product publishes its own privacy policy, that policy describes that product in detail and applies to it; this policy applies to the rest of what we do and to anything a product policy does not address. If the two ever conflict for a product, the product's own policy controls for that product. Whichever applies, the commitments in this policy hold across all our products: we do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use customer content to train AI models.

Two roles: our own data, and data we hold for businesses

Most of our products are used by businesses to run their work, so personal information reaches us in two ways:

As a controller. For visitors to our websites, people who create an account with any of our products, and the people who buy from us, we decide how personal information is used. Sections 1 to 13 describe that.
As a processor (service provider). When a business uses ServFlo, iSpector, SkuFlow, EngageIt, Base316, Flobyte or MemMesh, it puts information about its own customers, clients, contacts and users into our products (for example names, addresses, phone numbers, orders, appointments, inspection reports, messages or sign-in records). For that information the business is the controller, and we process it only to provide the product to that business, on its instructions and under our agreement with it.

If you are a customer of a business that uses one of our products (for example you received a text, an invoice, a report link or a sign-in code from them), please contact that business first with questions or requests about your information. If you contact us, we will pass your request to the business and help it respond.

1. Information we collect

1.1 Information you give us

Account information: your name, email address, password (stored only as a secure hash), company or workspace name, and your role in it.
Billing information: your plan, billing address and invoices. Payment card details are collected and stored by our payment processor (Stripe); we never receive or store your full card number.
Content you create: workflows (flows), automations, AI agent configurations, prompts and instructions, knowledge base documents, files you upload, tables, notes and settings.
Connected accounts: when you connect another service (for example Google, Microsoft, Slack or a CRM), the access and refresh tokens or API keys needed to act on your behalf, and your account identifier on that service.
Support and communications: messages, emails, attachments and feedback you send us.

1.2 Information collected when you use the Services

Usage information: features and pages used, workflows and agents run, run history and errors, and actions taken in the Services.
Device and app information: device type and model, operating system and version, app version, language, time zone, and browser type.
Log information: IP address, access times, referring pages and request logs.
Crash and performance diagnostics: if the app crashes or an error occurs, technical details needed to fix it (such as the error, the screen and the app version).
Cookies and local storage: see section 7.

1.3 Information from services you connect

When your workflows or AI agents run, they read and write data in the services you connected and authorized (for example emails, calendar events, documents, spreadsheet rows or CRM records). We process that data only to carry out what you configured. It is not kept beyond what is needed to run your workflows and show you their results and run history (see section 5).

2. Product details

Flobyte, including the Flobyte mobile app

The Flobyte mobile app lets you sign in to your Flobyte account to view and run your workflows and agents, follow their runs, approve actions, and chat with your AI agents. In the app we collect and use:

Data	Why	Optional?
Account information (name, email) and sign-in session	To sign you in and show your account	Required to use the app
Content you create or view (workflows, agent chats, prompts, files you choose to attach)	To provide the features you use	Required for those features
Device and app information, crash and performance diagnostics	To keep the app working, secure and up to date	Required
Push notification token	To send notifications you turn on (for example, a run that failed or an action waiting for your approval)	Optional: only if you allow notifications
Photos, files or microphone input	Only when you choose to attach a photo or file, or dictate a message	Optional: only when you use that feature and grant permission

The app asks for a device permission (such as notifications, photos or the microphone) only when you use a feature that needs it, and you can turn a permission off at any time in your device settings. Data sent between the app and our servers is encrypted in transit. We do not sell data collected in the app, and we do not use it for advertising.

MemMesh

MemMesh stores the memories, facts, documents and notes that you or the AI assistants and tools you connect (over MCP) send to it, so they can be recalled in later sessions. It keeps them in your account, scoped to the projects and users you choose, until you delete them or your account. Memories you send may include personal information you or your tools include in them; MemMesh uses them only to answer your own and your tools' requests. Content is not used to train AI models.

EngageIt

EngageIt holds a business's customer records (such as names, email addresses, phone numbers, purchases, visits and reward balances), the messages the business sends them by email and text, and their replies, consent and unsubscribe choices. We process this as the business's processor. Messages are sent only through EngageIt's sending queue, which honors each person's consent: anyone can stop a business's marketing emails with the unsubscribe link and its texts by replying STOP.

ServFlo, iSpector, SkuFlow and Base316

Each has its own privacy policy (see the table above), which lists the data the product handles, its mobile apps where it has them, its service providers and its retention periods.

3. How we use information

We use personal information to:

provide the Services: run your workflows and AI agents, connect to the services you authorize, store your content and show results;
operate your account: sign-in, security, billing and support;
keep the Services safe: detect, prevent and investigate fraud, abuse, security incidents and violations of our Terms;
maintain and improve the Services: fix bugs, measure performance and understand which features are used (in aggregated or de-identified form where possible);
communicate with you: service messages (verification, password resets, run alerts, billing and policy notices) and, if you opt in, product news, which you can unsubscribe from at any time;
comply with law and enforce our agreements.

We do not use your content, your connected-service data or your knowledge base to train AI models, and we do not allow our AI providers to train on it.

We do not sell your personal information and we do not share it for cross-context behavioral advertising. We share it only:

With service providers who process it on our behalf under contracts that limit their use of it, including:
- Amazon Web Services (hosting, storage and email delivery);
- AI model providers such as Anthropic and OpenAI, which receive the prompts and data your agents and AI steps send them, only to produce a response;
- Stripe (payments and subscription billing);
- messaging providers that deliver the emails and text messages sent through our products;
- analytics and error-monitoring tools that help us operate and fix the Services.
With the services you connect, as directed by the workflows and agents you configure. You control this sharing and can disconnect a service at any time.
Within your workspace: members of a workspace you belong to can see the workflows, runs and content shared in it, according to their roles.
For legal reasons: when required by law, subpoena or court order, or when we believe in good faith it is necessary to protect the rights, property or safety of ThinkFleet, our users or others.
In a business transfer: if ThinkFleet is involved in a merger, acquisition or sale of assets, information may transfer to the successor, which will remain bound by this policy for the information it receives. We will notify you before that happens.

5. How long we keep information

Account information: while your account is open, and deleted within 30 days after you delete your account, unless the law requires us to keep it longer.
Content you create: until you delete it or delete your account (then within 30 days).
Workflow and agent run history: 90 days by default, or the period set in your workspace settings.
Connected-service tokens and API keys: deleted as soon as you disconnect the service or delete your account.
Payment and tax records: 7 years, as required for tax and accounting.
Backups: deleted data may remain in encrypted backups for up to 35 days before they are overwritten.
Aggregated or de-identified statistics that no longer identify you may be kept longer.

6. Deleting your account and data

You can delete your account with any of our products, and its data, at any time:

In the app or on the web: go to your account settings and choose to delete your account, where available; or
By email: send a request to privacy@thinkfleet.ai from the email address on your account, with the subject "Delete my account".

Name the product (for example Flobyte, MemMesh or EngageIt) in your email. For ServFlo, iSpector, SkuFlow and Base316 you can also use the address in that product's policy. We confirm the request, then delete your account, your content, your connected-service tokens and your run history within 30 days. We keep only what the law requires us to keep (such as payment and tax records, section 5). If you are a member of a workspace someone else owns, deleting your account removes you and your sign-in; content you created in that workspace stays with the workspace unless its owner deletes it. You can also ask us to delete specific data without deleting your account by emailing the same address.

7. Cookies and similar technologies

The website and web app use:

essential cookies and local storage for sign-in, security and remembering your settings, which the Services need to work;
analytics cookies to understand how the website and Services are used.

We do not use third-party advertising cookies. You can control cookies in your browser settings; blocking essential cookies may stop you from signing in.

8. Security

We protect personal information with technical and organizational measures, including encryption in transit (TLS 1.2 or later) and at rest, application-level encryption of connection tokens and API keys, role-based access to production systems, monitoring and alerting, and regular security reviews. No system is perfectly secure; if a breach affects your personal information we will notify you and the authorities as the law requires.

9. Your rights and choices

Depending on where you live, you may have the right to:

access the personal information we hold about you and receive a copy in a portable format;
correct inaccurate information;
delete your information (section 6);
object to or restrict certain processing;
withdraw consent where we rely on it;
opt out of marketing emails, using the unsubscribe link in any marketing email.

To make a request, email privacy@thinkfleet.ai. We verify your identity before acting, usually by confirming you control the email address on the account, and respond within the time the law requires (for example, 45 days under California law). We will not discriminate against you for exercising your rights.

US state privacy rights. Residents of California and other states with comprehensive privacy laws have the rights above as their laws provide. In the last 12 months we collected the categories described in section 1 (identifiers, commercial information, internet and app activity, and professional information such as company and role), from you, from the services you connect and automatically, for the purposes in section 3, and disclosed them only to the recipients in section 4. We do not sell or share personal information for cross-context behavioral advertising.

European Economic Area, UK and Switzerland. We process personal information to perform our contract with you, for our legitimate interests in operating and securing the Services, to comply with legal obligations, and with your consent where required. You may also complain to your local data protection authority.

10. International transfers

We are based in the United States and our servers are in the United States (Amazon Web Services). If you use the Services from elsewhere, your information is transferred to and processed in the United States, using standard contractual clauses or other lawful transfer mechanisms where required.

11. Children

The Services are for businesses and adults. They are not directed to children under 18, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact privacy@thinkfleet.ai and we will delete it.

12. Changes to this policy

We may update this policy as the Services change. We will post the new version here with a new effective date and, for material changes, notify you by email or in the Services at least 30 days before they take effect.

13. Contact us

Thinkfleet AI, LLC
A North Carolina limited liability company
2890 Mount Pleasant Road South, Mount Pleasant, NC 28124
privacy@thinkfleet.ai