Follow · Policy
Privacy Policy
Last updated: 31 August 2026
Follow is customer relationship software for real estate brokers in Québec. This policy explains what data Follow collects, why, how long it is kept, and how you have it deleted. It also covers, in detail, the data Follow obtains from Google.
1. Who is responsible for your data
Follow is operated from Québec, Canada. For any question about privacy, access to your data, or deletion, write to support@followtheflow.io.
Two kinds of people appear in Follow: users (the broker and their team, who hold an account) and contacts (the clients and leads whose details a broker records). The broker remains responsible for their contacts' information; Follow processes it on their behalf.
2. What Follow collects
- Account — name, email address, hashed password, brokerage name, language preference.
- Content you enter — contacts, deals, tasks, notes, appointments, forms, files you upload.
- Conversations — the texts and emails exchanged with your contacts through Follow.
- Technical data — sign-in logs, IP address, device and browser type, used only to secure accounts and diagnose faults.
- Integration data — whatever you choose to connect, such as your Google Calendar. See section 3.
Follow does not collect continuous location data, does not track your browsing on other sites, and does not buy contact lists.
3. Google user data (Google Calendar)
Connecting Google Calendar is optional. Follow works fully without it. If you do connect it, this is exactly what happens.
What Follow accesses
| Scope requested | Why |
|---|---|
| .../auth/calendar.events | To read the times your calendar is already busy, so Follow never offers a slot you are not free for, and to create, update or cancel the appointments booked in Follow. |
| openid, email, profile | To know which Google account is connected and show it in Follow, so you can confirm it is the right calendar. |
Follow requests no Gmail, Google Drive, Contacts, Photos or other permission. No other Google service is touched.
What Follow does with it
Follow accesses Google Calendar only for two things: to read your availability (the busy periods on your calendar) and to create and update appointments booked in Follow. Nothing else. The contents of your Google events are not mined for information, not indexed, and not used for any analysis.
How it is stored
The access and refresh tokens Google issues are encrypted at rest (AES-256-GCM) in a separate credential vault — never in plain text in a database column, never in a log, never in a configuration file. Every read of a token is recorded. Only the connected account address and the chosen calendar id are kept in plain form, so they can be shown back to you.
What Follow never does
- Sell Google user data, or anyone's data.
- Transfer it to third parties, except where the law requires it or where it is strictly necessary to provide the feature you asked for.
- Use it for advertising, profiling or targeting of any kind.
- Use it to train artificial intelligence models, generalized or otherwise.
- Allow a human to read it, except with your explicit consent, for security purposes, to comply with the law, or on aggregated and anonymized data.
Limited Use
Follow's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Disconnecting and deleting Google data
You can withdraw access at any time from Calendar → Availability → Disconnect inside Follow: the button immediately and permanently deletes the Google tokens Follow holds, along with the link to your calendar. You can also revoke access directly at Google, at myaccount.google.com/permissions. To request full deletion of your Follow account and all of its data, write to support@followtheflow.io; it is handled within 30 days.
4. Why Follow processes this data
- To run the service you asked for: keeping your files, sending your messages, booking your appointments.
- Security: detecting abnormal access, rate-limiting sign-in attempts, keeping an audit trail.
- Billing, where you hold a subscription.
- Legal obligations, including the rules that apply to real estate brokerage in Québec.
5. Sharing
Follow sells no data and rents none to anyone. Data is disclosed only to the providers strictly required to run the service — hosting, database, email and SMS delivery, payments — each bound by contract and entitled only to the data its function requires. It may also be disclosed where the law compels it.
6. Security and retention
Data lives in an encrypted Postgres database, partitioned by brokerage: a user in one brokerage cannot reach another's files, and that is enforced on the server, not merely on screen. Passwords are hashed. Integration secrets are encrypted. Traffic is over HTTPS.
Data is kept while your account is active. A deleted item goes to a recovery bin first, then disappears for good. When an account is closed, all of its data is deleted within 30 days, except what the law requires be kept.
7. Your rights
You may request access to your personal information, its correction, its deletion, or an export in a readable format. You may also withdraw a consent you gave. Write to support@followtheflow.io; a reply follows within 30 days. If the reply does not satisfy you, you may contact the Commission d'accès à l'information du Québec.
8. Cookies
Follow uses strictly necessary cookies: keeping your session open and remembering your language. No advertising cookies, no third-party trackers.
9. Changes
If this policy changes materially, the date at the top is updated and active users are notified by email before it takes effect.
10. Contact
Follow — Québec, Canada · support@followtheflow.io