Privacy Policy

Who we are

Bespoke Tech Solutions, LLC (MyBTS.io) builds and operates JoeFlow, an all-in-one business operations platform. You can learn more about us at mybts.io. Our corporate privacy information lives at mybts.io/privacy; this document covers the JoeFlow service specifically.

• Registered address: [[placeholder — registered address]]
• Privacy contact: [[placeholder — privacy contact email]]

Our roles

We act in two different roles depending on the data:

• Controller. BTS is the data controller for the data we collect about our own customers and visitors: account and billing records, website usage, Joe onboarding-chat conversations on our marketing site, support conversations with us, and the security logs of the service itself.
• Processor. For the workspace data our customers enter into JoeFlow — tickets, contacts, chats, deals, projects, invoices, documents, Joe workspace conversations, Community and Team Chat content, and the like — the organization that uses JoeFlow is the controller and BTS is the processor. That organization decides why and how that data is used; we process it only to provide, secure, and support the service on their documented instructions. Organizations that need a data processing agreement (DPA) can request one from [[placeholder — privacy contact email]].

If you are an end customer of a JoeFlow organization (for example, you opened a support ticket, chatted with their agents, booked an appointment, or paid an invoice), please contact that organization for questions about your data — they own the relationship and the data. We help them respond where we can.

Data we collect

• Account and profile data. Name, email address, password (stored only as a hash), timezone, appearance preferences, and — where you sign in with single sign-on (SSO) — the identifier, email, and name your identity provider asserts.
• Sign-up handoff records. When you create an account through the Joe onboarding chat, we keep a short-lived pending sign-up record (the name and email you gave in the conversation and a single-use, expiring token that hands you to the password page — the email never travels in a link). The conversation itself is kept only briefly on our servers to run the chat.
• Joe conversations. In a workspace, Joe conversations are stored per user so you can revisit and resume them — your messages, Joe's replies, and the workspace context used to answer. On the marketing site, the onboarding chat is conversational front door only: its live state is short-lived and its durable output is the account you create.
• Joe actions and approvals. Where Joe can act on the workspace, each proposed action, your approval or denial, and each executed action are recorded (who, what, when) as an audit trail. Your autonomy settings (how much Joe may do without asking) and interface mode (Operator or Managed) are stored with your preferences.
• AI usage metering records. Every AI call is metered: we record the feature, the AI provider and model, token counts, the computed cost in credits, and which surface made the call (workspace chat, onboarding bot, help, or your own BYOK key). Metering records contain no prompt or response content.
• Organization data. The workspace records an organization and its members create: settings, modules, pipelines, templates, and business-hours configuration.
• CRM and customer data. Contacts, companies, deals, notes, and activities entered by the organization, including data pushed in through JoeFlow's REST API or migration integrations.
• Support content. Tickets and their comments and attachments, email messages (inbound and outbound, including Message-ID threading headers), chat conversations and transcripts, Team Chat channels and direct messages, voice-call metadata and recordings, SMS content, CSAT responses, and QA reviews.
• Community content. Where the opt-in Community module is on: the company profile your organization publishes, connection requests between organizations, feed posts and comments, and direct messages between connected organizations.
• Widget and visitor data. When someone uses a JoeFlow live-chat widget on a customer's site, we collect the visitor's messages, a first-party cookie and local-storage identifier set on the customer's site, the source site (so the conversation reaches the right workspace), and any name/email the visitor supplies.
• Billing and payment records. Invoices, estimates, credit notes, payments, credit balances and their ledger entries, and e-signature audit records. E-signature records capture the typed name, the timestamp, and the signer's IP address as proof-of-signing. Card data is handled entirely by the payment provider (for example Stripe); JoeFlow never stores card numbers or card secrets — it keeps only provider references and payment status.
• Uploads. Files attached to tickets, knowledge-base articles, projects, and acquisition requests. Files are stored on BTS-managed storage by default; workspaces with their own S3-compatible storage (Enterprise BYOK, where enabled) keep files on storage they control.
• Integration credentials. API keys, OAuth tokens (for example Google or Microsoft OAuth used for SSO or email intake over IMAP/Gmail/Graph), SMTP/IMAP mailboxes, AI provider keys (where your plan supports BYOK AI), and other provider credentials the organization connects so JoeFlow can act on its behalf. These are stored in an encrypted vault, used only to operate the organization's own integrations, and never used to advertise or to train models.
• Security settings. Two-factor authentication enrollment data for accounts that turn it on (an encrypted TOTP secret and lockout counters) and the password-policy rules in force on the platform.
• Usage and log data. IP address, device and browser characteristics, pages and actions taken, audit trails, security logs, server events, client key-step events, and error reports generated in the course of operating the service — see the Session and activity logging section below.
• Cookies and local storage. A small set of strictly necessary cookies (sign-in session, consent record, chat-widget identifier, landing-chat session) plus optional analytics cookies, described in our Cookie Policy. See "Cookies" below.

How we use data, and why (legal bases)

We process personal information only for specific purposes, each tied to a GDPR Article 6 legal basis:

We do not sell personal information, and we do not use workspace data to advertise to anyone.

Session and activity logging

To operate, secure, and troubleshoot JoeFlow, we record diagnostic activity about how the service is used. This section describes what is recorded, why, how long we keep it, and when it needs your consent.

• Server events. When you use the JoeFlow app or a public surface we publish, our servers log technical events: requests and the actions they performed, sign-in and security-relevant activity, audit-trail entries for sensitive changes, and errors. These records carry technical metadata — timestamp, the workspace and account identifiers involved, IP address, and request identifiers.
• Client key steps. In the JoeFlow web app, key interface steps (for example opening a page, starting a flow or chat, or an action that failed) may be recorded as lightweight client events so we can reproduce problems and see which parts of the product need work. Client events carry the signed-in account identifier and technical context (page, action, timestamp). We do not record keystrokes, screen content, or full session replay.
• Error tracking. When the app crashes or an error occurs, an error report may be sent with the error message, a stack trace, and technical context such as the page or route where it happened and the release build it occurred on.
• How long we keep it. Activity and diagnostic records — server events, client key steps, and error reports — are kept for 30 days and then deleted, except where a specific record must be kept longer (for example an audit-trail entry or security record subject to a legal or security obligation).
• Consent. Client key-step logging tied to product analytics is optional and runs only with your consent: it starts only after you allow the Analytics category in the cookie banner (see the Cookie Policy), and stops when you withdraw that consent. If you decline, we still keep the security, audit, and error records described above — that logging does not rely on consent; we do it under our legitimate interest in operating and securing the service, and it uses no optional cookies.
• Screen recording. JoeFlow does not record your screen and does not replay sessions today. If session replay or screen recording is ever introduced, this policy — and your consent choices — will be updated first.
• Self-hosted installs. On a self-hosted JoeFlow install, this activity stays on the operator's own infrastructure and is not sent to BTS.

AI features

JoeFlow's AI features — Joe (workspace chat and Managed mode), the marketing-site onboarding chat, drafts, summaries, and suggestions — process your content to produce the answer or action you asked for. How that processing is arranged depends on the mode:

• Platform-managed AI (default). AI runs on provider accounts operated by BTS. Prompts and content are sent to those providers under BTS's own agreements to serve your request; BTS meters the usage in AI usage records (feature, provider, model, token counts, credit cost, calling surface — no content). Where BTS itself provides an AI-supported service, this policy and the terms describe it before it applies.
• Your own keys (BYOK). Where your plan enables it (Enterprise, or any plan we expressly enable), the organization can connect its own AI provider keys; that processing happens under the organization's own agreement with that provider, on the organization's instructions, and BTS meters only the usage record.

BTS does not train models on customer data, and AI features are optional — a workspace works fully without them.

Joe acting on your behalf (Managed mode)

Joe can only do what the signed-in user's own role and permissions allow, and how much he may do without asking is set per capability by the user's autonomy settings — the default is the most restrictive level, where Joe only suggests. Actions queued for approval run only when the user approves them from the approval queue; proposals, decisions, and executions are recorded as an audit trail the workspace can see. Managed Mode also adds three workspace surfaces with their own data: the business-stats column Joe organizes from your own module data; setup steps whose progress is tracked against the live workspace; and input requests — a record that Joe asked you for something (what kind, whether it was answered, when it expires). Sensitive inputs such as passwords are never collected inside the chat itself: Joe sends you a dedicated secure popup instead, and what you type there goes straight into the encrypted email-settings vault — never stored with the conversation or transcript, and never sent to an AI provider. Non-sensitive answers ride the approval rail back into the conversation.

Manipulation attempts

Joe is engineered to treat message content as data, not instructions, and to refuse attempts to exceed its permissions. Attempted manipulation may be rate-limited and treated as a breach of the Terms' acceptable-use rules. When an attempt is detected — for example an attempt to make Joe reveal its prompts or configuration, credentials or keys, other customers' data, or other secrets — Joe refuses it and BTS keeps a record: a low-priority support ticket filed automatically in BTS's own internal support workspace. The record contains the mode (which AI surface the attempt was made on), the category of the attempt, the workspace and the user or visitor-session ID involved, an excerpt of the attempted message (capped at 500 characters), and the tail of the surrounding conversation (capped at 2,000 characters). It contains no other conversation content, no settings, and no credentials. These records are visible only to BTS's platform team, are used to operate and refine our guardrails and to enforce the Terms, and are kept for 90 days and then deleted.

Referrals through Joe guidance

Joe's guidance content is configured by BTS, and it may include pointers to offerings — BTS's own services (such as MyBTS.io offerings) or, where configured, clearly identified third-party partner offerings with a link. Recommendations are commercial suggestions, never a condition of the service, and you can ask Joe for help without following any of them. We will label partner (non-BTS) recommendations as such when they are enabled.

Service providers and subprocessors

Two groups of companies may process data when JoeFlow runs. We list categories here; the named list is to be confirmed against production config before final publication.

BTS subprocessors (companies we engage to run the JoeFlow service):

• Cloud hosting provider(s) — [[placeholder — hosting provider(s)]]
• Transactional email delivery — [[placeholder — email provider(s)]]
• Payments (Stripe, as the platform's own payment processor)
• Telephony (Twilio, for platform voice features)
• CDN / DDoS protection (Cloudflare)
• AI providers used for BTS's platform-managed AI features (the providers BTS connects to serve credits-metered AI requests) — [[placeholder]]
• Object / file storage for BTS-managed workspace file storage — [[placeholder — storage provider(s)]]
• Error monitoring — none third-party: errors are reported to a GlitchTip instance BTS self-hosts on its own infrastructure (JOE-472), so error data stays on BTS-operated servers rather than reaching a vendor; event contents are scrubbed of secret material and reduced to internal IDs before send [[placeholder — confirm the self-hosted GlitchTip posture at production-config review]]

The organization's own processors (BYOK services): JoeFlow customers connect their own accounts for email (SMTP/IMAP, or Gmail/Outlook mailboxes via OAuth with Google or Microsoft), identity providers for single sign-on (for example Google or Microsoft), voice (Twilio), payments (Stripe), tax providers, calendar providers, and similar services; on Enterprise (or where expressly enabled) also AI providers and S3-compatible file storage under the organization's own accounts. When an organization does that, the organization — not BTS — is the controller of that processing, it happens under the organization's contract with that provider, and the data flows to the provider on the organization's instructions. Organizations should review their own providers' privacy terms.

We keep subprocessor contracts that impose equivalent data-protection obligations, and we will post updated subprocessor lists here as the production configuration is confirmed.

International data transfers

BTS operates from the United States. Where personal information is transferred out of the EEA, the UK, or Switzerland, we rely on an approved transfer mechanism — principally the European Commission's Standard Contractual Clauses (SCCs) (and the UK International Data Transfer Addendum where applicable) — together with supplementary technical and organizational measures such as encryption in transit. Organizations that need executed transfer documentation can request it at [[placeholder — privacy contact email]].

How long we keep data

• Account and workspace data is kept while the account or organization is active.
• Joe conversations in a workspace are kept while it is active (you can delete conversations yourself at any time); the marketing-site onboarding chat keeps only short-lived live state, and its durable artifact is the pending sign-up record, which expires unused after days and is consumed on use.
• AI usage metering records are kept as billing and audit records for the life of the workspace and as financial records require.
• Joe action/approval audit records are kept while the workspace is active.
• Manipulation-attempt records ("Guardrail" tickets filed automatically to BTS's own support workspace, described under Manipulation attempts) are kept for 90 days, then deleted.
• Soft-deleted items (tickets, articles, records deleted in the app where soft delete applies) are restorable for 30 days, then purged.
• Backups and operational logs are retained for [[placeholder — N]] days on a rolling basis.
• Financial records (invoices, payments, credit ledgers, e-signature audit records) are kept as long as tax, accounting, and evidence laws require.
• Community content is kept until deleted by the organization or until the workspace closes.
• Data is otherwise deleted or de-identified when the purpose above ends, or on request as described below.

How we protect data

We use TLS in transit and encryption at rest for stored secrets, role-based access controls inside workspaces, scoped and rate-limited API keys, credential storage in an encrypted vault, optional and (for platform administration) required two-factor authentication, configurable password rules, and audit logs on sensitive actions. Workspace data is tenant-isolated: every request, query, file reference, and API call is scoped to the signed-in user's organization, and one organization's workspace data is not readable from another's — including Community connections and inter-organization DMs, which are visible only to the connected organizations. Joe can never act beyond the signed-in user's own permissions, whatever the conversation says. Platform staff access to customer data is limited to what support and operation require. If we become aware of a personal-data breach affecting your information, we will notify affected customers (and regulators where required) without undue delay.

No method of transmission or storage is perfectly secure; if you have a security concern, contact [[placeholder — security contact email]].

Your rights

Depending on where you live, you may have some or all of the following rights: access, rectification, erasure, restriction, portability, objection (including to legitimate-interests processing), and the right not to be subject to purely automated decisions with legal effect.

• If a JoeFlow organization controls your data (you are, for example, a customer of one of our customers), direct your request to that organization — we support them in fulfilling it.
• If BTS controls your data (your BTS/JoeFlow account, billing records, website usage, onboarding-chat conversations), contact [[placeholder — privacy contact email]]. You may also object to processing or withdraw consent (for example, for marketing emails) at any time, and you can ask Joe not to make referral suggestions.

California (CCPA/CPRA): California residents have rights to know, delete, and correct personal information, and to limit use of sensitive personal information. BTS does not sell or share personal information as those terms are defined by the CCPA/CPRA, and we treat all customer data accordingly. We do not process personal information of California consumers for cross-context behavioral advertising.

EEA/UK residents may complain to their data-protection authority. We will not discriminate against anyone for exercising their rights.

Data export and deletion

• Export. Organization admins can export their workspace data in-app (for example invoices, acquisition, and assets CSV exports) and via the REST API; on request we help with a full export.
• Deletion. When an organization terminates and its account is closed, its data enters a 30-day export window, after which it is deleted from production systems (subject to the backup and financial-record retention windows above, until those expire). Platform account data can be deleted on request to [[placeholder — privacy contact email]].

Children

JoeFlow is a business tool. The service is not directed to children under 13 (COPPA), and accounts require a minimum age of 16. This includes the Joe onboarding chat on our marketing site. We do not knowingly collect personal information from children under 16; if we learn we have, we will delete it. If you believe a child under 16 has created an account or chatted with Joe, contact [[placeholder — privacy contact email]].

Self-hosted installs

Self-hosted JoeFlow runs on the operator's own infrastructure. For self-hosted installs, BTS receives no workspace data — the software runs where the operator put it. The descriptions of BTS's processing above — subprocessors, international transfers, retention schedules, and breach notification — describe the JoeFlow cloud service and do not apply to a self-hosted install: there, the operator is the controller and the processor of its own instance and is responsible for the privacy and security promises it makes to its own users and customers. The only data that reaches BTS is what an operator deliberately sends us: messages in a support conversation with us, a bug report filed through the in-app assistant, or similar direct contact.

Cookies

We use a small number of strictly necessary cookies (sign-in sessions, consent records, the chat widget's first-party identifier, and the landing chat's short-lived session) and, where enabled, optional analytics cookies. We also keep a small set of browser local- and session-storage entries for interface preferences and safety guards. Details, purposes, and retention are in the Cookie Policy, and the cookie banner lets you accept or decline optional categories.

Changes to this policy

We will post any changes on this page and update the version and "Last updated" dates above. If a change materially affects how we handle personal information, we will announce it (in-app or by email to account admins) before it takes effect. The change history appears at the bottom of this page.

Contact

Questions about this policy or our data practices:

• Bespoke Tech Solutions, LLC (MyBTS.io)
• Registered address: [[placeholder — registered address]]
• Privacy contact: [[placeholder — privacy contact email]]
• Corporate privacy page: mybts.io/privacy