Privacy Policy

Who we are

Cuflo is a marketing platform operated by SME Growth Limited (NZBN 9429051641706), a New Zealand company. We help marketing agencies and their clients consolidate brand knowledge, campaign data, and AI-generated content in one place.

If you have questions about this policy or how your data is handled, email privacy@smegrowth.ai.

What we collect

When you use Cuflo, we collect:

• Account information - name, email, authentication details
• Business information - anything you record about your business or your clients' businesses (brand voice, products, contacts, pricing, etc.)
• Connected-service tokens - when you connect platforms like Google Analytics, Google Ads, Meta Ads, Xero, ServiceM8, etc., we store the OAuth tokens needed to fetch your data. Tokens are encrypted at rest.
• Data fetched from connected services - metrics, campaigns, customer records, and similar data pulled on your behalf from the platforms you connect.
• Competitor research data - for competitors you choose to track, we fetch publicly available information including ads from Meta's Ad Library and Google's Ads Transparency Center, and we snapshot their public websites.
• Usage information - basic logs of how the platform is being used (page views, action timestamps) so we can debug and improve the product.

How we use it

• To provide the Cuflo service you signed up for
• To generate AI content (drafts, summaries, recommendations) from the knowledge and data you've given us
• To send transactional emails on your behalf (e.g. review requests, NPS surveys) when you've configured those flows
• To show when enquiries were answered or quoted by email, if you connect a Gmail mailbox (see Gmail reply tracking below)
• To find new enquiries among the emails a connected Gmail or Outlook inbox receives, if you turn that on for the mailbox (see Finding new enquiries in your inbox below)
• To debug and improve the platform - never to sell or share your data for marketing purposes

Gmail reply tracking (optional)

A business using Cuflo can choose to connect one or more of its Gmail mailboxes, so that enquiries answered or quoted by email are counted in its enquiry reporting. This section explains what that connection reads and keeps. None of it applies unless a mailbox is connected.

The permission we ask for

Google asks you to allow Cuflo to "View your email messages and settings". This is read-only access. Cuflo cannot send, delete or change any email through this connection.

What Cuflo reads

Cuflo searches the connected mailbox for emails sent from it to the email address of a customer enquiry already recorded in Cuflo, and reads only the emails that search returns. For each one it reads who the email was addressed to, when it was sent, the subject line, the names of any attachments and up to the first 5,000 characters of its text. It uses these to work out whether the email answered the enquiry and whether it contained a quote. Reply tracking does not read emails the mailbox received. Reading received email is a separate choice, made mailbox by mailbox and off until someone turns it on, described under Finding new enquiries in your inbox below.

What Cuflo keeps

Reply tracking does not store the text of any email it reads. When it finds a reply or a quote, it records on that enquiry the time the email was sent and which connected mailbox sent it. For a quote it also keeps the subject line or attachment name (up to 200 characters) and Gmail's identifier for the message, so the same email is never counted twice. The access token Google issues for the connection is encrypted at rest.

How it is used

These details are used only to show the business when its enquiries were first answered and when they were quoted, in its Cuflo enquiry reports. They appear on the enquiry in Cuflo, where the business's own users and the SME Growth staff who manage its account can see them. Nobody at SME Growth reads the emails themselves.

Data received from Gmail is never sold and never used for advertising. It is not shared with anyone apart from the hosting providers listed below that run Cuflo and, only where a business has turned on finding new enquiries in its inbox, Anthropic for the purpose described in that section, except where the law requires it. It is never used to train or improve artificial intelligence or machine learning models, and reply tracking sends no email content to any AI service.

Cuflo's use and transfer of information received from Google APIs, including Google Workspace APIs such as Gmail, will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Turning it off

A mailbox can be disconnected at any time under Settings, Integrations in Cuflo. Reading stops straight away and the stored access token is deleted. You can also remove Cuflo's access from your Google Account at myaccount.google.com/permissions. Reply and quote times already recorded stay in your enquiry history, and you can ask us to delete them by emailing privacy@smegrowth.ai.

Finding new enquiries in your inbox (optional)

A business using Cuflo can choose to let Cuflo read the emails that arrive in a connected Gmail or Microsoft Outlook inbox, so that customers who enquire by email are counted alongside website forms and calls. It is off for every mailbox until someone turns it on for that mailbox under Settings, Integrations, after being shown what it does. It can be turned on by the business's owner or its own administrator, or by SME Growth staff who manage the business's account. None of this section applies to a mailbox where it is off.

The permission we ask for

For Gmail, it uses the same read-only permission as reply tracking: "View your email messages and settings". For Outlook, Microsoft asks you to let Cuflo Inbox read your mail and your basic profile, and to keep that access until you remove it. Many Microsoft 365 organisations only let an administrator approve this, once for the whole organisation. Both are read-only: Cuflo cannot send, delete, move or change any email through them.

What Cuflo reads

Every hour, Cuflo reads the emails that have arrived in the inbox since it last looked. The first time it is turned on, it looks back over the previous 45 days. For each email it reads who it is from, any reply-to address, the subject, the email's technical headers, its Gmail labels, when it arrived and its text. It does not open attachments, and it does not read the business's sent mail for this purpose.

How it decides

Fixed rules set some emails aside without any AI: newsletters and other bulk mail, automatic messages from addresses such as noreply@ or billing@, and mail from the business's own addresses. An email from someone who is already one of the business's enquiries is linked to that enquiry.

For every other email, including job notifications from lead platforms such as hipages, Cuflo sends the sender's name and email address, the subject and the text of the email to Anthropic, which runs the AI model Claude. Earlier messages quoted beneath the email are removed first, and the text is cut to 4,000 characters. Claude decides whether the email is a new enquiry and, if it is, picks out the customer's name, email address, phone number, suburb and the work they want. That is the only thing the email is sent to Anthropic for. Anthropic's commercial terms do not allow it to train its models on this data, and Anthropic says it deletes what it receives through its API within 30 days, apart from limited exceptions such as enforcing its usage policy or complying with the law (Anthropic's retention policy). Cuflo's own record of each AI request keeps the email's length, never the email.

What Cuflo keeps

• For a new enquiry, what a website form keeps: the customer's name, email address and phone number, their message (up to 5,000 characters, without earlier quoted messages), their suburb and the work they asked about, when the email arrived, and a one-line note of why the AI judged it an enquiry. If the email carries a reference code from a link on the business's website, the enquiry is linked to that visit.
• For an email from someone who is already an enquiry, a note on that enquiry with the email's subject (up to 200 characters).
• When the AI is not sure, the sender's name and address, the subject (up to 200 characters) and a summary (up to 500 characters), shown under Check these on the Enquiries page until someone decides. Adding it as an enquiry creates the enquiry from the sender and the summary. Marking it as not an enquiry deletes them. Either way they are removed from the list.
• For every other email, only Gmail's or Microsoft's identifiers for the message and its conversation, a scrambled copy of the email's own message identifier (so the same email is never handled twice), when it arrived, what Cuflo decided, a short code for why, and the AI's confidence where it was asked. Never its sender, subject or text.

No alert is sent for an enquiry found this way, because the business already has the email.

How it is used

These details are used only to show the business its enquiries and where they came from, in Cuflo. The business's own users and the SME Growth staff who manage its account can see them. Nobody at SME Growth reads the emails themselves, except with the business's agreement to help with a support request, where it is needed for security, or where the law requires it.

Data received from Gmail or Outlook is never sold and never used for advertising. It is never used to train or improve artificial intelligence or machine learning models, by us or by Anthropic. It is shared only with the hosting providers listed below that run Cuflo and, for the one purpose described above, with Anthropic, except where the law requires otherwise. Data from Gmail is also covered by the Google API Services User Data Policy, including the Limited Use requirements, as set out in the Gmail section above.

Turning it off

It can be turned off at any time under Settings, Integrations. A check already under way finishes, and then Cuflo stops reading the inbox. Reply tracking on a Gmail mailbox carries on unless the mailbox is disconnected. Disconnecting a mailbox stops all reading and deletes the stored access token. You can also remove Cuflo's access in your Google Account at myaccount.google.com/permissions or in your Microsoft account settings. If it is turned on again later, Cuflo picks up from where it stopped, so emails that arrived while it was off may be read. Enquiries already found stay in your enquiry history, and you can ask us to delete them by emailing privacy@smegrowth.ai.

Sub-processors we rely on

Cuflo is built on top of trusted infrastructure providers and AI services. Your data passes through these services for specific, scoped purposes:

• Supabase - database + authentication (data location: Sydney, Australia region for Cuflo)
• Vercel - application hosting
• Anthropic (Claude) - AI processing for generating drafts and summaries, and for deciding whether an email is a new enquiry where a business has turned that on. Anthropic does not train its models on data submitted via the API.
• Google, Meta, Microsoft, LinkedIn, Xero, ServiceM8, etc. - platforms you choose to connect for data sync. We only access scopes you authorise.

We don't share your data with any third party for advertising or marketing purposes.

How long we keep it

We retain your data for as long as your account is active. If you delete your account, we remove your data within 30 days, except where law requires us to retain certain records (for example, billing records under NZ tax law).

Time-series data we've pulled from connected services (e.g. historical ad metrics, SEO snapshots) accumulates for as long as your account is active so you can see long-term trends. You can ask us to delete specific historical data at any time.

Your rights

Under the New Zealand Privacy Act 2020, you have the right to:

• Access the personal information we hold about you
• Correct anything that's wrong
• Request deletion of your data
• Complain to the Office of the Privacy Commissioner if you believe we've mishandled your data

To exercise any of these rights, email privacy@smegrowth.ai and we'll respond within 20 working days.

Security

All connections to Cuflo are encrypted (HTTPS). OAuth tokens and sensitive credentials are encrypted at rest in our database. Access to production data is restricted to the SME Growth engineering team. We don't store passwords ourselves - authentication is handled by Supabase Auth.

Cookies

Cuflo uses cookies only for essential purposes - keeping you logged in and remembering UI preferences. We don't use third-party advertising or analytics cookies.

Children

Cuflo is a business tool and is not intended for use by anyone under 18.

Changes to this policy

We may update this policy as Cuflo evolves. When we do, we'll update the "Last updated" date at the top. For material changes (e.g. new sub-processors, new categories of data), we'll notify account holders by email.

Contact

SME Growth Limited
New Zealand
privacy@smegrowth.ai