Privacy Policy

Who we are

FollowUp ("FollowUp", "we", "us") helps businesses reply to their own customers on time. This policy explains what data we collect, why, and how you can control it. Contact us at contact@followupbase.io with any questions.

What we collect

• Account info — your name and email address from Google sign-in.
• Your business details — the name, kind of business and mailing address you enter in Settings. Your business name and mailing address go at the bottom of the emails FollowUp sends on its own for you, with a line saying the customer can reply "stop". A customer who replies "stop" gets nothing more from FollowUp on its own.
• Sign-ins — each time you sign in, the kind of browser and device (for example, "Chrome on Mac") and the approximate city our host reports. Never your IP address. We keep them for 90 days so you can see recent sign-ins in Settings and so we can email you about a sign-in from a device we haven't seen before.
• Gmail and Outlook data — with your explicit permission, we read recent inbox threads to identify customer conversations, and store the ones we identify as leads (sender, subject, message content, timestamps) so we can score them and draft replies. By default, FollowUp never sends anything until you approve it. If you choose to turn on sending without asking (in Settings, or for a specific lead), FollowUp sends only simple, low-risk follow-ups for you; anything about price or anything sensitive still waits for you.
• Your past Gmail replies (only if you turn on "Write like me") — we read the replies you sent from Gmail in the last 12 months and keep up to 300 of them, with names, email addresses, phone numbers and street addresses removed first, so your drafts sound like you. They are used only for your own drafts, never for anyone else and never to train an AI model. Turning it off deletes them all.
• Instagram and Facebook data — with your explicit permission (connecting your Instagram professional account or Facebook Page), we receive the direct messages and lead-form submissions sent to your account, so we can identify them as leads, score them, and draft replies. By default, FollowUp never sends anything until you approve it. If you choose to turn on sending without asking (in Settings, or for a specific lead), FollowUp sends only simple, low-risk follow-ups for you; anything about price or anything sensitive still waits for you.
• Your website and Instagram posts (only if you add them) — when you give FollowUp your business's website, we read up to six of its public pages; when your Instagram is connected and you tick it, we read your own bio and your last 30 posts. Never comments, never messages, never anyone else's pages. FollowUp copies only what answers its questions about your business, word for word, and nothing is used in a reply until you check it and tap Looks right. We keep the link and the addresses of the pages read, not the pages themselves.
• WhatsApp data — when you connect your WhatsApp Business number through Meta, we receive the messages sent to and from that number so we can identify customers and draft replies. Because it may be the same number you use for personal chats, a message from someone who isn't already a lead is first checked by our AI provider. Chats that look personal are set aside rather than treated as leads; we keep them only so you can bring one back if we got it wrong. Their messages are deleted after 30 days with no new message, and the rest with your account. Instagram and Facebook messages get the same check.
• Leads you add yourself — manually entered leads, ones imported via CSV, and contacts from a CRM you connect (Follow Up Boss, HubSpot or GoHighLevel). With GoHighLevel we also read the texts, emails and chats in its conversations, so FollowUp can answer them there. In your CRM, FollowUp adds a note when it sends a message and when a customer is ready to talk. It also moves the customer to one of your stages: when they book a meeting (the stage you choose or, until you choose, the one whose name fits), and when where they stand changes (Ready, Warm or Later, only to stages you picked). You can turn each of these off. If you leave "Read my notes" on (GoHighLevel), we also read your own notes on a customer, like call notes, to tell where they stand. We never read FollowUp's own notes, and we keep only the few words that show it. When a customer who wrote to you isn't in your CRM, FollowUp shows you who; when you tap Add, it adds them to your CRM (their name, email, phone and where they wrote) with their messages as a note. After your first Add, new ones are added the same way by themselves, until you turn that off.
• Your booking settings — your booking hours, where customers book (FollowUp's calendar, or your Google Calendar if you choose it), and, if you tell us, the name of the calendar you use. For any calendar other than Google, we keep only its name; FollowUp doesn't connect to it.
• What you tell FollowUp about your business — your answers in "Tell FollowUp about your business", kept as the facts FollowUp uses in your replies. If you choose to talk instead of typing, your recording is sent to our AI provider to be turned into words and is never kept by FollowUp: we keep only the words, with your answers, until you tap Looks right, and then only the facts you approved.
• Billing info — handled entirely by Stripe; we never see or store your card details ourselves.
• Usage data — basic product analytics (pages visited, features used) to improve FollowUp.
• A record of what FollowUp did — every message FollowUp drafts, holds or sends is written down with the reason, so you can see what happened and why.

Google user data — Limited Use disclosure

FollowUp's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only access the Gmail and Google Calendar scopes needed to identify sales conversations, send follow-ups on your behalf, and create a calendar event when a lead asks to schedule a call.
• We never use Gmail or Calendar data for advertising.
• We never use Gmail or Calendar data to develop, improve or train generalized AI or machine-learning models. When you turn on "Write like me", your past replies are used only to shape your own drafts.
• We never allow humans to read Gmail or Calendar data except: (a) with your explicit consent, (b) to investigate abuse or a security issue, or (c) to comply with the law.
• We never transfer Gmail or Calendar data to third parties except our AI processing provider (to draft/score follow-ups on your behalf), or as required by law.

Instagram and Facebook data — Meta Platform Terms

FollowUp's use of data received from Meta's Instagram and Facebook APIs adheres to the Meta Platform Terms. Specifically:

• We only request the permissions needed to receive Instagram/Messenger DMs, WhatsApp messages and Facebook Lead Ads submissions, to reply to them on your behalf, and, when you ask, to read your own Instagram bio and posts so FollowUp learns about your business.
• We only reply to people who have messaged your business first. We never message people who haven't contacted you.
• We never use this data for advertising, and never sell it.
• We never allow humans to read it except: (a) with your explicit consent, (b) to investigate abuse or a security issue, or (c) to comply with the law.
• We never transfer it to third parties except our AI processing provider (to draft/score follow-ups on your behalf), or as required by law.
• To request deletion of your Instagram/Facebook data, use the account-deletion process below, or remove FollowUp's access directly from your Facebook Business Integrations settings.

How we use AI

To score leads and draft follow-up messages, relevant conversation text (and, if you leave "Read my notes" on, your own notes on that customer in your CRM) is sent to our AI provider (currently OpenAI) for processing. When you talk to FollowUp about your business, your recording goes to the same provider to be written down. That provider does not use your data to train its models under our account terms with them. AI-drafted messages are never sent without your approval unless you have turned on sending without asking, as described above.

Helping improve FollowUp (off unless you turn it on)

In Settings you can choose to help improve FollowUp. It is off by default. If you turn it on, we keep FollowUp's draft beside the message you actually sent, and review the differences in de-identified form (names, email addresses and phone numbers removed) to improve how FollowUp writes. We do not train AI models on your data. You can turn it off at any time.

How we protect your data

• Encrypted in transit — every connection to FollowUp uses HTTPS (TLS), and browsers are told never to connect to us without it.
• Encrypted at rest — our database provider (Supabase) encrypts everything we store. On top of that, the keys that let FollowUp reach your accounts (Gmail and Outlook access, Instagram, Facebook and WhatsApp access, your Twilio auth token and CRM API keys) are encrypted again by FollowUp with AES-256-GCM before they are saved, using a key that is kept outside the database.
• No passwords to steal — you sign in with Google, so FollowUp never stores a password.
• Each business's data is kept apart — every request is checked against your signed-in account and your business before anything is read or changed, and the database refuses direct outside access to every table.
• Only real messages get in — messages from Google, Meta, Twilio and Stripe are accepted only with that service's signature or a secret only it holds.
• Less personal data in more places — error reports have email addresses and phone numbers removed, and past replies kept for "Write like me" have names, email addresses, phone numbers and street addresses removed before they are stored.
• You can see who signed in — Settings lists recent sign-ins, we email you when your account is signed in from a new device, and exporting or deleting your data asks you to sign in again first.
• If something goes wrong — we have a written plan for it. We stop the problem, tell the affected businesses in plain words what happened and what to do, and report it to the privacy regulator where the law requires.

Data retention & deletion

We keep your data for as long as your account is active. You can delete an individual lead (and its full conversation history) at any time from that lead's page. You can export all of your data, or delete your entire account and all associated data, yourself from Settings → Your data. You can also email contact@followupbase.io and we'll confirm deletion within 2 business days. Revoking FollowUp's Gmail access at myaccount.google.com/permissions stops future access immediately; it doesn't delete data already stored — use the account deletion request above for that.

Cookies and your browser

FollowUp uses only the cookies it needs to work. There are no advertising or tracking cookies, and nothing that follows you to other websites.

• Signing in — keeps you signed in, for up to 7 days, and protects the forms you submit.
• Connecting an account — while you connect Gmail, Outlook, Instagram or Facebook, a short-lived cookie makes sure the connection comes back to you. It ends after 10 minutes.
• Team invites — remembers the invite link you opened until you finish signing in, for up to an hour.

Your browser also keeps a few small notes for FollowUp on your own device: a reply you started writing, until you close the tab, so it isn't lost; the last day you opened the app, so we count it once; whether you said "Not now" to phone alerts; and, on our home page, whether animations should be calmer on a slower computer.

We count visits to our pages with Vercel Web Analytics, which uses no cookies and stores no personal data; only the page's address is sent. If you open the WhatsApp section of Settings, Facebook's own script loads so you can connect WhatsApp, and Facebook may set its own cookies under its own policy.

Third parties we use

• Google — sign-in, Gmail and Google Calendar access.
• Microsoft — Outlook / Microsoft 365 access, if you connect it.
• Meta — Instagram DM, Messenger, Facebook Lead Ads and WhatsApp access.
• Twilio — text messages and voice calls, if you connect it (and WhatsApp for businesses that connected it through Twilio before).
• Follow Up Boss, HubSpot and GoHighLevel — only if you connect your CRM.
• OpenAI — AI scoring, message drafting, and writing down what you say to FollowUp.
• Stripe — subscription billing.
• Supabase and Vercel — database and application hosting.
• Sentry — error reports, with email addresses and phone numbers removed.
• Resend — the alert emails FollowUp sends to you, like when a customer is waiting or your account is signed in from a new device (sent from the United States).

We never sell your data.

Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to certain processing. To exercise any of these, contact contact@followupbase.io.

Changes to this policy

If we make material changes, we'll notify you by email or an in-app notice before they take effect.