Privacy Policy

Five S LLC (“TransfAI”, “we”, “us”) operates the TransfAI platform available at transf.ai and app.transf.ai. This Privacy Policy explains how we collect, use, disclose, and protect information about you when you use our Service.

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

2.1 Information you provide: name, email address, business name, business type, phone number, website, and payment information (processed by Stripe — we never store full card numbers).

2.2 Integration data: OAuth access tokens and data accessed from connected services (QuickBooks invoices, Gmail contacts and email threads, Google Calendar events, Twilio SMS logs, HubSpot contacts) solely to provide the Service. We access only the scopes you explicitly authorize.

2.3 Usage data: IP address, browser type, operating system, pages visited, features used, agent run history, timestamps, and device identifiers. This data helps us operate and improve the Service.

2.4 Customer data: Contact information of your customers that you add to the platform or that is imported from connected integrations. You are the data controller for this information; we process it only on your instructions.

• To provide, maintain, and improve the Service and your AI agents
• To process payments and manage your subscription via Stripe
• To operate AI Agents on your behalf (sending emails, SMS, accessing connected services)
• To send transactional emails (receipts, confirmations, agent run summaries, security alerts)
• To send product updates and marketing communications (you may opt out at any time)
• To comply with legal obligations and enforce our Terms of Service
• To detect, prevent, and investigate fraud, security incidents, and abuse
• To analyze aggregate, anonymized usage patterns to improve product features

We do not use your data or your customers’ data to train AI models. Data sent to Anthropic’s API is used solely for inference under our enterprise agreement.

We do not sell your personal data. We may share data only in the following circumstances:

• Service providers: Supabase (database and auth), Vercel (hosting), Stripe (payments), Anthropic (AI inference) — each bound by data processing agreements.
• Third-party integrations you authorize: QuickBooks, Gmail, Google Calendar, Twilio, HubSpot, DocuSign, Meta — only as necessary to execute your configured agents.
• Legal requirements: When required by law, subpoena, court order, or to protect the rights, property, or safety of Five S LLC, our users, or the public.
• Business transfers: In connection with a merger, acquisition, or sale of assets, with at least 30 days’ notice to you.

• Account and business data: retained for the duration of your subscription plus 90 days after termination.
• Agent run logs: retained for 12 months; deletable on request at any time.
• Financial records: retained as required by applicable law (typically 7 years).
• Upon verified deletion request, all personal data is permanently deleted within 30 days, except where retention is legally required.

We implement industry-standard technical and organizational security measures including:

• AES-256-CBC encryption for all stored OAuth tokens
• TLS 1.2+ for all data in transit
• Row-level security (RLS) policies on all database tables
• Access to production data restricted to authorized personnel only
• Regular security reviews and dependency audits

No system is perfectly secure. If you discover a vulnerability, please report it to security@transf.ai.

Depending on your location, you may have rights to:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Deletion — request deletion of your personal data (“right to be forgotten”)
• Portability — request your data in a machine-readable format (JSON or CSV)
• Restriction — request that we restrict processing in certain circumstances
• Opt-out — opt out of marketing communications at any time via unsubscribe link or by contacting us
• Withdraw consent — where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact privacy@transf.ai. We will respond within 30 days.

If you are located in the European Economic Area or United Kingdom, you have additional rights under GDPR. Our legal bases for processing are:

• Contract performance — to provide the Service you subscribed to
• Legitimate interests — security, fraud prevention, service improvement
• Consent — for marketing communications (withdrawable at any time)
• Legal obligation — to comply with applicable law

You may lodge a complaint with your local data protection authority (supervisory authority) at any time.

California residents have rights under the California Consumer Privacy Act (CCPA), including:

• The right to know what personal information is collected and how it is used
• The right to delete personal information (subject to legal exceptions)
• The right to opt out of the sale of personal information — we do not sell personal information
• The right to non-discrimination for exercising your privacy rights

We use strictly necessary cookies for authentication and session management. We do not use advertising cookies, cross-site tracking pixels, or third-party analytics cookies. You may disable cookies in your browser settings, but this will prevent you from logging in to the Service.

The Service is not directed to children under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact privacy@transf.ai and we will delete it promptly.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email and by displaying a prominent notice in the dashboard at least 14 days before the change takes effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.