Privacy Policy

Last updated: October 14, 2026

1. Who we are

FlashCrafter is a service of Cald Solutions Inc., 2832 Rascommon Way, Sacramento, CA 95827, United States ("FlashCrafter", "we", "us"). This policy covers our website, www.flashcrafter.ai, and Growth Briefs by FlashCrafter, our reporting and management application at briefs.flashcrafter.ai (see the Growth Briefs page). It is the one place to read how we handle information across both.

Questions or requests: privacy@flashcrafter.ai.

2. The short version

• We help local businesses understand and improve how they show up on Google, and, when asked, we manage part of that work (Google Business Profile, Google Ads, Search Console, Google Analytics and publishing business videos to YouTube).
• Connecting a Google account is optional. You choose which accounts, properties and locations a connection covers.
• We use Google user data only to provide those features to the business that connected it. We do not sell it, we do not use it for advertising, and we do not use it to train AI models.
• You can disconnect at any time and you can ask us to delete your data.

3. Information we collect

Account information. Your name, email address and sign-in identity. Sign-in is handled by our identity provider (WorkOS); we do not see or store your password.

Business information. Name, address, phone, website, categories, service areas, and the photos, logos and videos you or we add for the business, plus the reports we build from public sources (search results, directories and public reviews).

Billing information. Payments are processed by Stripe. We do not store card numbers.

Communications. Messages you send us, and the email and text messages we send you (see Section 13).

Automatic information. Log data (IP address, browser type, pages visited), device information and cookies. We use Google Analytics and Microsoft Clarity to understand how our pages are used. We skip staff sessions and honor Do Not Track and Global Privacy Control, and we do not send your name, email or business to those tools.

4. Information we receive from Google

Only after you connect (or authorize) a Google product, and only for the accounts, properties and locations you select. This section describes the connections that Growth Briefs uses and the Google permissions (scopes) each one requests.

• Google Business Profile (auth/business.manage). We read the categories, hours, services, location details, photos and videos already on the profile, and its reviews, including each reviewer's display name, rating, review text and any published owner reply. With your authorization we add FlashCrafter as a manager of the location and publish the photos you approve. We do not post or edit reviews or replies.
• Google Ads (auth/adwords). We read the account, campaign, ad group, keyword and search-term structure and performance (spend, clicks, impressions, conversions). With your authorization we link the account to our manager account and apply the changes you or your account manager approve in the app (pausing or enabling campaigns, keyword and shared negative-keyword lists).
• Google Analytics (auth/analytics.readonly). We read the list of properties you can see, so you can choose one, and then sessions, traffic sources and conversion events for that property. Read-only: we never write to Analytics.
• Google Search Console (auth/webmasters.readonly). We read your site list, and clicks, impressions, click-through rate and average position by query and page for the property you select. Read-only: we never add, remove or modify sites, sitemaps or settings. Where you share a property with FlashCrafter's service account, we read the same figures through that account.
• YouTube (auth/youtube.upload, being introduced). When video publishing is enabled for your business, we upload a business video to the YouTube channel you select, as Unlisted unless the owner approves Public. We keep only the id, privacy setting and processing status of the videos we uploaded. We never read your watch history, subscriptions or other channel data.
• Google sign-in (openid, email). The email address of the Google account used for a connection, so you can recognize and manage it. Signing in to FlashCrafter is handled separately from these connections.
• Google Meet transcripts (meetings.space.readonly, staff-only service connection). For client meetings we hold on Google Meet, we may turn on Google Meet's transcript. We read the transcript of our own meetings as the meeting host, through a read-only service connection that FlashCrafter's Google Workspace administrator authorizes. No client Google account is connected and no client Google account data is read. See Section 7.

We never read your Gmail, Drive, Calendar, contacts or YouTube watch or subscription history. These connections request no Google scopes other than those listed here.

5. How we use information

• To produce, update and display the Growth Brief and related dashboards for the business that connected the data.
• To operate the Business Profile, Google Ads and YouTube actions that the business authorized, and nothing beyond them.
• To keep the service secure, prevent abuse and fix problems.
• To communicate with you about your account and reports.

We do not use Google user data to build advertising profiles, to target advertising, to sell or rent it, or to develop, improve or train generalized artificial-intelligence or machine-learning models. We do not use Google user data for any purpose other than providing and improving the user-facing features described here.

6. Google API Services User Data Policy: Limited Use

FlashCrafter's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice: we use Google user data only to provide or improve the user-facing features visible in Growth Briefs. We transfer it only to provide those features, to comply with law, or as part of a merger or sale with notice to you. We do not use it for advertising. No human reads it except (a) with your consent, which includes the FlashCrafter staff who operate your account at your request under our Terms, (b) where needed for security or to investigate abuse, (c) to comply with law, or (d) where the data is aggregated and anonymized for internal operations.

7. YouTube API Services and Meet transcripts

Where you use video publishing, Growth Briefs uses YouTube API Services. By doing so you agree to be bound by the YouTube Terms of Service, and Google's use of information is governed by the Google Privacy Policy. You can revoke Growth Briefs' access to your YouTube data at any time through the Google security settings page, or by disconnecting in Growth Briefs.

When access is revoked or you disconnect, we revoke the token at Google and delete the YouTube API data we stored (video ids, processing status, upload session addresses and playlist ids) at once, and in any case within 30 days. Stored YouTube API data is never kept more than 30 days without being refreshed from YouTube: from day 20 we re-read it when your connection is healthy, and data we cannot refresh is deleted by day 28. Videos are uploaded as Unlisted by default and changed to Public only after the business owner approves. Uploads are marked "not made for kids" unless the owner says otherwise, and we do not publish content directed to children.

Meeting transcripts. For client meetings on Google Meet we may turn on Google Meet's transcript so we can write down what we agree on. Google Meet tells everyone in the meeting when a transcript starts, and our booking messages tell you beforehand. We save a copy in private storage that only FlashCrafter staff can open, and use it to write a short summary and a list of next steps. We show you the summary and the next steps that concern you after our team has checked them. We do not sell transcripts, do not use them to train models, do not share them with other clients, and do not use them to rate or compare any person. A language-model service processes the transcript to draft the summary (see Section 8). We keep a transcript for up to two years and delete it sooner if you ask. To ask us not to transcribe a meeting or any of your meetings, or to delete a transcript, tell us before or after the meeting; we can switch it off for your business.

8. Who can see your information

• Business owners and members you invite, for their own business.
• FlashCrafter staff who operate your account, limited to the businesses they serve.
• People you give a link to. A Brief can be shared by a view link that expires after at most 31 days or when revoked. Anyone with the link can read that copy, including the connected Google figures it contains. Detailed period-over-period Search Console comparisons are excluded from shared copies.
• Service providers, only as needed to run the service and under their terms: cloud hosting, database and file storage (Cloudflare); sign-in (WorkOS); payments (Stripe); email and text delivery; customer-relationship and calendar tooling (GoHighLevel); and AI model providers (see below). Public search and review data providers receive search queries, not your Google data.
• Authorities, if required by law, and a successor in a merger or sale, with notice to you.

AI model providers. We use a language model to draft parts of the product: Growth Brief analysis, the in-app AI assistant, website planning where enabled for your business, and meeting summaries. By default requests go to OpenAI through a private connection that FlashCrafter operates; where configured, they go to OpenAI's API or to OpenRouter. The material sent for a feature can include data you connected from Google, such as your Google Ads, Analytics and Search Console figures and Business Profile review text, and the text of a meeting transcript. It is sent only to produce the result you see in Growth Briefs and is not sent for advertising. We do not sell it, and we do not use it ourselves to train models. These providers process it under their own terms, which bind them in how they handle it.

We do not sell your information, and we do not transfer Google user data to data brokers or advertising platforms.

9. How we protect it

Google OAuth access and refresh tokens are encrypted with AES-256-GCM under a dedicated server key stored separately from the database. Tokens are never sent to your browser and never appear in reports. Connections to our service use HTTPS. Staff access is role-based and recorded. No method of storage or transmission is perfectly secure.

10. How long we keep it

• Google access tokens: until you disconnect or revoke, then deleted at once. A connection not used for 180 days is revoked at Google and its token deleted (deleted here after 30 more days even if Google cannot be reached).
• Business Profile reviews we synchronized: refreshed daily while connected; deleted if not refreshed from Google for 30 days or removed at Google for 30 days.
• Google alert contents, Analytics and Ads readings, and Ads reads cached for speed: refreshed daily or on view; emptied or deleted if not refreshed for 30 days.
• Google evidence saved with each report run: 13 months, then deleted. The finished report stays.
• YouTube API data: never more than 30 days old. Refreshed from day 20, otherwise deleted by day 28, and deleted at once if access is revoked.
• Meeting transcripts: up to 2 years, or sooner on request.
• Data read through a Google account you disconnect: removed when you disconnect.
• Reports and findings (the history we compute for you): while the business is our customer; deleted within 30 days of a verified request or when you leave.
• Records of who did what (ids and counts, no Google content): kept for security and accountability.
• Content you own (photos, business details, your video files): until you ask or leave; deleted within 30 days of a verified request.
• Account and billing records: as long as needed for the service and our legal obligations.

11. Your choices and how to delete your data

• Disconnect in Growth Briefs. Open the Google connections for your business and disconnect. This ends the delegated access we hold (the Google Ads manager link and the Business Profile manager entry), revokes our authorization at Google, and deletes the stored credential. Further reading stops at once.
• Revoke at Google. Remove FlashCrafter at myaccount.google.com/permissions or the Google security settings page. We treat a revoked connection as disconnected and delete its YouTube API data at once.
• Ask us to delete, correct, access or export your information. Email privacy@flashcrafter.ai from the address on your account. We respond and complete deletion within 30 days. Figures already saved in past Briefs or an active share link are removed on request.
• Cookies and analytics: use your browser settings, Do Not Track or Global Privacy Control.
• Residents of California and other regions may have additional rights; contact us and we will honor applicable law.

12. Children

Our services are for businesses and are not directed to anyone under 16. We do not knowingly collect personal information from children under 16, and if we learn we have, we will delete it.

13. SMS messaging privacy

If you consent to receive text messages from FlashCrafter, we use your mobile number and messaging consent only to provide the messages described when consent was collected. Mobile information and text-messaging opt-in data and consent are not sold, rented or shared with third parties or affiliates for their marketing or promotional purposes. We may share information with service providers solely as necessary to deliver and operate the messaging service.

Message frequency varies and message and data rates may apply. You may reply STOP to opt out or HELP for assistance. See our SMS consent process and Terms and Conditions for more information.

14. International use

We operate in the United States and process information there.

15. Changes to this policy

We will post changes here and update the "Last updated" date. For material changes affecting Google user data we will notify connected users by email before they take effect.

16. Contact us

Privacy: privacy@flashcrafter.ai. Support: support@flashcrafter.ai. Mail: Cald Solutions Inc., 2832 Rascommon Way, Sacramento, CA 95827.