Privacy Policy

Last updated: July 22, 2026

Summary

Here's the short version. The full policy below controls.

• We collect the information you give us to create and run your account (name, email, organization, billing details) and basic technical data needed to operate and secure the service.
• We use it to run, secure, bill, support, and improve the Service, and to comply with law.
• Reflexio does not use Customer Content to train or fine-tune AI models owned by Reflexio or shared among Reflexio customers. To run the service, your content is processed by third-party AI providers, and some — under the terms applicable to Reflexio's account — may use it to develop or improve their services, which may include model training.
• We don't sell your personal information or share it for advertising. We use service providers and AI providers to run the Service — see §4.
• We use third-party service providers to run the service — for example, cloud hosting, AI providers, billing, and analytics (the categories are listed in §4).
• You have privacy rights (access, deletion, correction, and more) and can exercise them at support@reflexio.ai.

1. Who we are and what this policy covers

This Privacy Policy explains how Reflexio, Inc. ("Reflexio," "we," "us") handles personal information in connection with the Reflexio managed platform (the "Service").

Scope — please read. This policy describes the personal information we collect directly as a business: information about account holders, administrators, billing contacts, and visitors to our sites and app.

When you use the Service to process your own content — such as interactions, transcripts, or documents that may contain personal information about your end users — Reflexio generally acts as that customer's processor or service provider, as applicable, under the customer agreement and any applicable Data Processing Addendum. Reflexio processes Customer Content on the Customer's documented instructions and as necessary to provide, secure, support, and administer the Service, including through authorized AI providers described in this Policy. Our handling of that customer-submitted content is governed by your customer agreement, not by this policy.

2. Personal information we collect

We collect the following categories of personal information, from the sources and for the purposes shown.

Reflexio does not require users to provide most categories of sensitive personal information to create a standard account. We collect authentication information necessary to authenticate and secure accounts; passwords, where used, are processed through our authentication provider and are not stored by Reflexio in plaintext. Customer Content may contain sensitive personal information submitted by or on behalf of a Customer — including information in communications, transcripts, documents, or generated inferences — which Reflexio processes on the Customer's instructions and subject to the customer agreement and the Terms prohibited-data rules. We do not knowingly collect information from children (see §10).

3. How we use personal information

We use personal information only for these business purposes:

• To provide and operate the Service, including authentication and tenancy.
• To bill you and manage subscriptions.
• To secure the Service, prevent abuse, and debug problems.
• To communicate with you about your account, security, and support requests.
• To understand product usage in aggregate and improve the Service.
• To comply with legal obligations and enforce our agreements.

Artificial intelligence and your data

The Service uses third-party large-language-model ("LLM") providers to process content you submit so that the product can function (for example, to extract structure from your interactions).

Reflexio does not use Customer Content to train or fine-tune AI models owned by Reflexio or shared among Reflexio customers.

To operate the Service, your content is sent to third-party AI providers. Some AI providers, under the terms and configurations applicable to Reflexio's account, permit them to use submitted inputs or generated outputs to develop or improve their services, which may include model training. Where a provider offers a no-training option, we use it; not every provider does. Deleting Customer Content from Reflexio stops future processing by Reflexio and triggers applicable provider-deletion instructions for retained copies; it may not reverse model or service improvements a provider made before deletion. AI providers may vary by feature, availability, cost, customer configuration, or deployment model. Enterprise customers may be able to use customer-selected providers or private deployment options under their applicable agreement.

We do not use automated processing of Reflexio Account Data to make decisions that produce legal or similarly significant effects about account holders.

4. How we disclose personal information

We disclose personal information to service providers, processors, subprocessors, AI providers, and other authorized recipients as necessary for the purposes described below. Each recipient's permitted uses and legal role depend on the service and applicable agreement. These fall into the following categories:

• Cloud hosting and infrastructure
• Data storage and authentication
• AI providers (to process submitted content for the Service)
• Payment processing
• Error monitoring and logging
• Email delivery
• Product analytics

The categories above are the recipients we use, and we update them as they change. Where a recipient processes Customer Personal Data as our subprocessor, we require it to comply with applicable contractual data-protection obligations. Business and enterprise customers can request our current named sub-processor list and a Data Processing Addendum by contacting support@reflexio.ai.

We do not sell personal information or share it for cross-context behavioral advertising. We disclose Customer Content to AI providers to provide the Service. Certain providers' applicable terms may permit them to use submitted content to develop or improve their services, as described in §3.

We may disclose personal information when reasonably necessary to comply with law, regulation, legal process, or governmental request; to protect the rights, property, security, or safety of Reflexio, our customers, users, or others; to investigate fraud or abuse; or in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets. Where required by law, we will provide notice or require the recipient to continue protecting the information consistently with this Policy.

5. Retention and deletion

We retain personal information for as long as your account is active and as needed to provide the Service, then delete or de-identify it, except where a longer period is required for legal, tax, security, or dispute-resolution purposes. Customer Content is retained until you delete it, delete the applicable workspace, or the Agreement ends, unless an earlier period is configured by you or specified for your plan.

Deleting an individual user removes that user's personal information but does not delete content the organization controls. You may request export or erasure at any time (see §6). When an authorized administrator deletes a workspace, Reflexio initiates deletion of the workspace's Customer Content from its active application databases and storage systems. Deletion is ordinarily completed within 30 days. Residual copies in backups expire within 90 days, except where retention is legally required. Deletion from third-party AI-provider systems is subject to each provider's applicable retention and deletion practices, and may not reverse model or service improvements a provider made before deletion.

6. Your privacy rights

Depending on your jurisdiction — and, for California residents, under the CCPA/CPRA — you may have the right to:

• Know / access the categories and specific pieces of personal information we hold about you, the sources, the purposes, and the categories of recipients.
• Delete personal information we have collected from you.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information, where applicable. Reflexio does not currently sell personal information or share it for cross-context behavioral advertising.
• Limit the use of sensitive personal information, to the extent this right applies.
• Not be discriminated against for exercising your rights. We will not deny you service, charge you a different price, or provide a different quality of service because you exercised a privacy right.

How to exercise your rights

Submit a request by email to support@reflexio.ai or through the in-product request form. We will:

• Confirm receipt within 10 business days and respond within 45 calendar days. Where reasonably necessary and permitted by law, we may extend the response period by an additional 45 days and will explain why.
• Verify your request against your account information before acting on it, using a method reasonable for the sensitivity of the data; we will not use verification information for any other purpose, and we may be unable to act on requests we cannot verify.
• Provide data portability where applicable, and an appeal where required by law.
• Allow an authorized agent to make a request on your behalf with your signed permission; we may ask you to verify your identity or confirm the agent's authorization directly.

Opt-out preference signals (Global Privacy Control). Because Reflexio does not currently sell personal information or share it for cross-context behavioral advertising, Global Privacy Control does not presently change our processing. We will honor applicable preference signals if our practices change or applicable law otherwise requires it.

If you use the Service on behalf of an organization and your data was submitted to us by that organization as customer content, we will refer your request to that organization (our customer), which controls that data.

7. Cookies and analytics

We use a small number of cookies and similar technologies:

• Strictly necessary cookies — required to sign you in and keep the Service secure. These cannot be turned off.
• Analytics (Google Analytics) — to measure product and website usage. We configure Google Analytics with advertising features, Google Signals, and Google-products-and-services data sharing disabled. Google Analytics may receive product-usage events, pseudonymous identifiers, device and browser information, and IP-derived approximate location, but is not intended to receive Customer Content.

We do not use advertising or cross-site tracking cookies.

8. Security

We use administrative, technical, and organizational measures designed to protect personal information, including tenant isolation, encryption in transit, access controls, and error monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Where your information is processed

The Service is operated from the United States. Personal information may be processed in the United States and in other countries where Reflexio and its authorized service providers operate or access data. The Terms currently prohibit customers from submitting personal information concerning individuals located in the EEA, the United Kingdom, or Switzerland unless Reflexio has expressly agreed otherwise in writing.

10. Children's privacy

The Service is a business product intended for users who are at least 18 and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time and will revise the "Last updated" date above. We will not retroactively make material, adverse changes to how we handle previously collected personal information — including any change that would materially expand how your data is used for AI model training — without giving you notice and, where required, obtaining your consent. We review and refresh this policy periodically and whenever our practices materially change.

12. Contact us

Questions or privacy requests — email support@reflexio.ai. Mailing address: Reflexio, Inc., Attn: Privacy, 10556 Northeast 25th Street, Bellevue, WA 98004.