Privacy Policy

Effective date: September 12, 2026
Operated by: FollowThrough is a product of Kate Craig Consulting, LLC, a limited liability company registered in the State of Tennessee, USA, which operates it under the registered assumed name "FollowThrough" ("we," "us," or "our").
Registered address: Kate Craig Consulting, LLC, PO Box 5893, Johnson City, TN 37602, USA
Contact: contact@myfollowthrough.com

This Privacy Policy explains how we collect, use, share, and protect information when you use the FollowThrough web application and related services (the "Service"). By using the Service, you agree to this Policy.

1. Scope

This Policy applies to information we process about (a) our customers and their authorized users ("you"), and (b) individuals whose information you input into the Service (such as your contacts, clients, and meeting participants). For data you input about others, you are the controller of that data and are responsible for having a lawful basis to provide it to us; we process it on your behalf to provide the Service.

2. Information We Collect

• Account & profile information: name, email, password, phone, job title, company name, business address, and time zone. We ask you to confirm you are 18 or older and record that confirmation; we do not collect or store your date of birth.
• Payment information: processed by our payment provider (Stripe). We receive limited billing details (such as the last four digits and card brand) but do not store full card numbers.
• Customer Data you provide: projects, tasks, notes, contacts and CRM records, documents and files, invoices, proposals, contracts, calendar events, email and marketing content, subscriber lists, and similar content.
• Connected-account data: with your authorization, data from services you connect — for example Google or Microsoft calendars and email, and contacts — used to provide the features you enable.
• Meeting recordings & transcripts: audio and text from meetings you choose to record or transcribe.
• Form and registration data from the public: when someone books a meeting, registers for an event, donates, subscribes, or completes a form or survey you publish, we process what they submit — which may include their name, email, phone, address, and any details your form asks for (for events, that can include dietary or accessibility needs they choose to share).
• Notification tokens: if you enable browser (push) notifications, we store the notification token your browser issues so we can deliver them.
• Usage & device data: log data, IP address, browser/device type, and actions taken in the Service, used for security, troubleshooting, and improvement. When an error occurs, our diagnostics provider (Sentry) may capture a session replay to help us fix it, with all text, form inputs, and media masked.
• Cookies: we use necessary cookies to keep you signed in and operate the Service, a bot-protection cookie on public forms, and privacy-preserving analytics identifiers that count activity without identifying individuals.

3. How We Use Information

We use information to: provide, maintain, secure, and improve the Service; authenticate users and manage Accounts; process payments and subscriptions; provide customer support; send service, billing, and (where permitted) product communications; send browser push notifications where you enable them; protect public forms against automated abuse; enforce our Terms; and comply with legal obligations.

AI providers. Where you use AI features (such as analysis, drafting, transcription, and contact search), the content needed for that feature is sent to our AI provider (Anthropic) to generate the result. Our providers do not use your content to train their models, and you can turn AI features off for your account in Settings. Meeting transcription additionally uses Deepgram.

4. How We Share Information

We do not sell your personal information. We share information only as needed to run the Service:

• Service providers (sub-processors) that host and power the Service. Each processes data only to provide its service to us:
  • Always: Supabase (database, authentication, file storage), Vercel (application hosting), Resend (email delivery), Sentry (error diagnostics).
  • When you use the feature: Anthropic (AI features — see section 3), Deepgram (meeting transcription), Stripe and Square (payments), Twilio (text messages — receives the recipient's phone number and the full message), OpenStreetMap/Nominatim (address lookup in the location field).
  • For security: Cloudflare Turnstile (bot protection on public forms such as booking, event registration, donation and signup — receives the visitor's IP address and a one-time challenge token; not used for advertising).
  • When you connect the integration: Google and Microsoft (calendar, email), Zoom (meetings), Dropbox and Google Drive (documents), LinkedIn, Meta/Facebook, Instagram, Threads, TikTok and Bluesky (social posting), Givebutter, Donorbox and Bloomerang (donation platforms).
• At your direction, with integrations and recipients you choose (for example, sending an email or publishing a social post).
• Legal & safety, when required by law or to protect rights, safety, and the integrity of the Service.
• Business transfers, in connection with a merger, acquisition, or sale of assets, subject to this Policy.

5. Google and Microsoft API Data

FollowThrough's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We access this data only to provide features you turn on, do not use it for advertising, do not sell it, and do not allow humans to read it except as necessary for the Service, with your consent, for security, or as required by law.

What we ask Google for, and why:

• Calendar (read): to show your existing commitments and work out the times you are genuinely free, so scheduling links never offer a slot you cannot make.
• Calendar (events): to create, update and cancel the meetings booked through FollowThrough on your own calendar, and to invite the people attending them.
• Gmail (send): to send the email you write in FollowThrough — proposals, invoices, follow-ups and replies — from your own address rather than ours.
• Gmail (read and modify): to show your mail in the Inbox Dashboard, and to mirror what you do there back to your mailbox — read and unread, archive, spam and trash. FollowThrough does not permanently delete your mail.
• Contacts: to save a CRM contact to your Google Contacts when you ask it to, and to recognise the people you are already in touch with.
• Google Drive (per-file): only the files you pick, or that FollowThrough creates. This scope gives no access to the rest of your Drive.

You can disconnect any account at any time in Settings → Connections, which revokes our access and deletes the stored tokens.

6. Data Retention

We retain information for as long as your Account is active and as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements.

When your subscription ends, we keep your data for thirty (30) days so you can reactivate or take a copy with you. We email the account's administrators a warning before that window closes, and we do not delete an account that was not warned. After the window, the account and its contents are permanently deleted.

Some records are removed on a shorter schedule regardless of your Account: security and rate-limiting counters (7 days), delivery logs for payment and email providers (30 days), error diagnostics (90 days), abandoned donation checkouts that were never completed (180 days), and page-view analytics (400 days). Deleted data may persist for a short period in routine backups.

7. Data Security

We use reasonable administrative, technical, and physical safeguards designed to protect information, including encryption in transit and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential.

8. Your Rights and Choices

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, or to object to or restrict certain processing. You can update most account information in the Service, unsubscribe from marketing email via the link in those messages, and disconnect integrations at any time. An administrator can download everything the account holds at any time — as a spreadsheet or as a complete file — from Download my data in the account menu. To make a request, contact contact@myfollowthrough.com. For data you provided about others, direct their requests to you as the controller; we will assist as required.

9. Meeting Recordings and Consent

Where you use recording or transcription features, you are responsible for obtaining any consent required by law from participants. We process recordings and transcripts to provide the feature to you and do not use them to train third-party models except as permitted by our providers' terms.

10. Children's Privacy

The Service is for business users 18 and older and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

11. International Users and Data Location

The Service is operated from the United States, and information is processed and stored in the United States and, where applicable, other regions used by our service providers. If you access the Service from outside the U.S., you consent to processing in the U.S., which may have different data-protection laws than your country.

12. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will provide notice (for example, by email or in-app) and update the effective date above. Your continued use of the Service after changes take effect constitutes acceptance.

13. Contact

Questions or privacy requests? Contact us at contact@myfollowthrough.com · Kate Craig Consulting, LLC, PO Box 5893, Johnson City, TN 37602.