Privacy Policy

This Privacy Policy explains how Better Brain Lab LLC, a Wyoming limited liability company doing business as HarperFlow ("HarperFlow," "we," "us," or "our"), collects, uses, discloses, stores, and protects personal information when you visit harperflow.io, use the HarperFlow application, request a guide, report, or free GEO audit, subscribe to our newsletter or marketing emails, communicate with us, or otherwise use our services (collectively, the "Services").

HarperFlow provides a GEO/AEO publishing pipeline for Webflow websites and related services. The Services may research, generate, structure, score, schedule, and publish articles and related content to customer websites.

If you have questions about this Privacy Policy or want to exercise your privacy rights, contact us at support@harperflow.io or by mail at:

Better Brain Lab LLC
30 N Gould Street
Sheridan, WY 82801
United States

This Privacy Policy is intended to provide notice under applicable privacy laws, including the General Data Protection Regulation ("GDPR"), the UK GDPR, and U.S. state privacy laws where applicable.

1. Information We Collect

We collect information directly from you, automatically through the Services, and from third parties you connect to HarperFlow.

1.1 Account and Contact Information

We may collect your name, email address, company name, job title, password or authentication information, billing contact details, support communications, and other information you provide when creating an account, contacting us, booking a call, subscribing to updates, or requesting support.

1.2 Website, Business, and Content Information

To provide the Services, we may collect information about your website, business, products, services, customers, target audience, competitors, brand voice, content preferences, content strategy, published articles, blog categories, CMS fields, metadata, media assets, internal links, source materials, audit inputs, and related website or business information.

1.3 Webflow Integration and Credential Information

If you connect a Webflow site, we may collect authorization grants, API tokens, CMS IDs, site IDs, collection IDs, field mappings, publishing permissions, and related technical information needed to operate the Services.

Webflow access tokens and similar credentials are stored in encrypted form. You may revoke HarperFlow's access through Webflow's Apps & Integrations settings where applicable.

1.4 Generated Content and Operational Data

We may collect and store article drafts, generated article outputs, citations, source lists, research logs, prompts, prompt outputs, article audit scores, formatting decisions, internal-link suggestions, publishing schedules, article history, CMS publishing logs, and related workflow data.

1.5 Billing Information

Payments are processed through Stripe. We may collect billing plan, subscription status, invoice history, payment status, transaction identifiers, billing address, tax information, and limited payment metadata. We do not intentionally store full payment-card numbers on our own systems.

1.6 Guide, Report, and Marketing Information

When you request a HarperFlow guide or report, we collect your email address, request time, source, page and referrer reduced to origin and path, campaign parameters, browser locale, delivery status, and related provider identifiers so we can deliver the requested material, prevent abuse, measure the request flow, and resolve delivery problems. We record whether you selected the separate newsletter checkbox, the time of that choice, and the version of the consent wording shown.

Requesting a guide does not by itself subscribe you to marketing. If you separately select the optional newsletter checkbox, that selection records your consent and we add your address to the HarperFlow newsletter list and Segment in Resend. We may then collect communication preferences, campaign interactions, clicks, unsubscribes, and related delivery records. Email opens can be affected by privacy features and are not treated as a precise measure of human interest.

We use an IP address transiently for rate limiting, security, and Cloudflare Turnstile verification for the guide form, but our guide-delivery database does not store that IP address. The guide form does not collect your name, job title, company size, device fingerprint, advertising identifier, or precise location. Its hidden company field is a spam honeypot; suspected automated submissions are discarded.

1.7 Analytics, Cookies, and Device Information

Subject to your privacy choices and applicable law, we may use Google Analytics, PostHog, Reddit Ads, Lemlist visitor tracking, Affonso affiliate attribution, Trustpilot widgets, cookies, pixels, tags, local storage, and similar technologies. Information may include IP address, browser and device characteristics, pages viewed, referring pages, session duration, clicks, approximate location, campaign information, and usage events.

Necessary technologies support security, consent preferences, requested features, and popup suppression. Optional analytics and marketing storage remains disabled until you allow the relevant category where consent is required. When that storage is denied, Google may receive limited cookieless consent and measurement signals through Consent Mode. Other optional analytics and marketing providers remain unloaded until you allow the relevant category. Section 6 explains how to make or change these choices.

Separately from the technologies above, when you arrive at our site through one of our own campaign links (URLs containing utm_ parameters), our edge infrastructure records an aggregate, cookie-less count of that campaign landing: the campaign labels from the link, the page path, coarse location (country and city), network identifier, and a bot-or-human classification. We also count, without any identifier, which option visitors choose in the consent banner. These records set no cookies, contain no identifiers or browsing history, are not linked to you, and are used solely to measure which of our own campaigns bring visitors.

1.8 Information From Third-Party Services

We may receive information from services you connect to HarperFlow or use to interact with us, including Webflow, Stripe, Supabase, Anthropic, Google Cloud, Cloudflare, n8n, Resend, Google Analytics, PostHog, Reddit, Lemlist, Affonso, Trustpilot, and other providers described in this Policy.

2. How We Use Information

We use information for the following purposes:

• To provide, operate, maintain, secure, and improve the Services.
• To connect to your Webflow site and operate the publishing workflow you request.
• To research, generate, structure, score, schedule, and publish articles.
• To map content into your CMS and maintain publishing workflows.
• To generate GEO audits, guides, reports, recommendations, and related outputs.
• To deliver requested materials and maintain delivery, consent, and suppression records.
• To process subscriptions, payments, invoices, upgrades, downgrades, and cancellations.
• To communicate about accounts, support, product updates, security, legal, and administrative matters.
• To send newsletters, research, offers, and other marketing only where permitted.
• To measure site and campaign performance where permitted by your choices and applicable law.
• To troubleshoot, develop features, and improve product functionality.
• To prevent fraud, abuse, security incidents, misuse, unlawful activity, and technical harm.
• To enforce our Terms of Service and other agreements.
• To comply with legal obligations and respond to lawful requests.

3. Legal Bases for Processing

If GDPR, UK GDPR, or similar laws apply, the legal basis depends on the purpose:

Purpose	Typical legal basis
Accounts, paid Services, Webflow integration, billing, and requested publishing workflows	Performance of a contract, steps requested before entering a contract, and legal obligations
Delivering a guide, report, audit, or response that you request	Our legitimate interest in responding to your request and, where applicable, steps requested before a contract
Newsletter and optional marketing subscription	Consent where required; otherwise legitimate interests subject to applicable opt-out rights
Necessary security, fraud prevention, consent storage, and requested site functionality	Legitimate interests, contract, and legal obligations
Optional analytics, advertising, visitor identification, and attribution	Consent where required; otherwise legitimate interests subject to applicable choices and opt-out rights
Aggregate, cookie-less measurement of our own campaign links and consent-banner choices	Legitimate interest in measuring our own campaigns without identifying visitors

Where we rely on legitimate interests, we consider the nature of the data, your relationship with HarperFlow, the purpose of processing, the likely effect on you, and available safeguards. You may contact us to ask about the basis for a particular activity.

4. AI, Content, and Model Training

HarperFlow uses AI systems and automation to help research, generate, structure, evaluate, and publish content. We may process your website content, business information, brand-voice inputs, CMS data, and generated outputs to provide the Services.

We do not use customer content to train foundation models. We may use customer content, generated outputs, operational metadata, audit scores, workflow data, and performance data to operate, maintain, troubleshoot, secure, evaluate, and improve HarperFlow's own Services, including through aggregation, anonymization, or de-identification where appropriate.

We may use third-party AI and infrastructure providers, including Anthropic and Google Cloud, to process content and provide the Services. Their handling of data is governed by our arrangements with them and their applicable terms and policies.

5. How We Share Information

We do not sell personal information for money. We disclose information as described below and only to the extent relevant to the service or feature being used.

5.1 Service Providers and Processors

• Webflow for website hosting, CMS integration, and publishing.
• Cloudflare for hosting, security, edge delivery, Workers, storage, queues, and Turnstile.
• Resend for requested guide delivery and separately consented newsletter contact management and email delivery.
• Stripe for payments and billing.
• Supabase for data storage, authentication, and backend services.
• Anthropic and Google Cloud for AI processing and cloud services.
• n8n for workflow automation.
• Google Analytics and PostHog for analytics and product/site measurement.
• Reddit Ads and Lemlist for advertising, campaign measurement, and visitor marketing where enabled.
• Affonso for affiliate referral attribution.
• Trustpilot for review widgets and trust-content display.
• Google-hosted font and asset services used to present the marketing website.
• Other vendors that provide hosting, monitoring, support, security, communications, compliance, research, or business-operations services.

A provider listed here may not receive information about every visitor or customer. The data disclosed depends on the feature used, your privacy choices, and the provider's role in that flow.

5.2 Connected Platforms

When you connect HarperFlow to Webflow, we share information with Webflow as needed to authenticate, map CMS fields, create drafts, publish content, update metadata, manage assets, and operate the integration.

5.3 Business Transfers

We may disclose information in connection with a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar transaction involving HarperFlow or Better Brain Lab LLC.

5.4 Legal, Safety, and Enforcement

We may disclose information when reasonably necessary to comply with law, legal process, court orders, government requests, tax obligations, law-enforcement requests, security investigations, fraud prevention, protection of rights, enforcement of agreements, or protection of HarperFlow, customers, users, third parties, or the public.

5.5 Customer Publicity

We use a customer's name, logo, testimonial, screenshot, or non-public example in HarperFlow marketing only with that customer's approval. Public website content may still be processed as needed to provide the Services or produce an expressly requested audit.

6. Cookies, Similar Technologies, and Privacy Choices

We use three categories of site technologies:

• Necessary: security, fraud prevention, consent preferences, requested functionality, guide delivery, and suppression of repeatedly displayed popups.
• Analytics: Google Analytics and PostHog, used to understand aggregate site use and improve the experience.
• Marketing and attribution: Reddit Ads, Lemlist visitor tracking, Affonso referral attribution, Trustpilot widgets, and Google advertising features used for campaigns, attribution, and related measurement.

Where required, analytics and marketing storage stays denied until you allow the corresponding category. HarperFlow uses Google Consent Mode, which can send Google limited cookieless consent and measurement signals while optional Google storage is denied. PostHog and the other optional providers listed above remain unloaded until the relevant category is allowed. You can accept all, reject non-essential technologies, or make a granular choice. An always-available Privacy choices control lets you change your selection later. Withdrawing a choice stops future optional loading or storage covered by that category; it does not reverse processing that already occurred.

The site treats an enabled Global Privacy Control signal or a Do Not Track signal as a request to keep optional analytics and marketing technologies disabled. Browser signals and local-storage settings can be cleared or changed by the browser, so your choice may need to be made again on another browser or device.

The aggregate, cookie-less measurement of our own campaign links and consent-banner choices described in Section 1.7 uses no cookies, storage, or identifiers, so it operates independently of the storage choices above and does not identify you.

The first-party key hf-privacy-consent:v1 stores your privacy-category choice. The session key hf-guide-popup-session:v1 prevents the guide offer from automatically appearing more than once during a browser session. The first-party key hf-guide-popup:v2 suppresses automatic display for 30 days after an explicit dismissal and for 365 days after a successful request. Cloudflare may set security storage such as _cfuvid. Optional providers may set storage such as Google _ga/_gcl keys or Reddit _rdt keys only after the applicable choice. Exact provider storage can vary as vendors update their services.

7. Marketing Communications

A request for a guide, report, audit, account message, security message, billing notice, or support response is not by itself a newsletter subscription. The requested item or service message may still be sent as a transactional communication.

If you separately select the optional marketing subscription, we may send product updates, newsletters, research, offers, launch information, and related communications. You may unsubscribe using the link in a marketing email or by contacting support@harperflow.io. Withdrawing marketing consent does not affect the lawfulness of processing before withdrawal or stop required transactional, security, billing, legal, or support messages.

8. Data Retention

We retain information only for as long as reasonably necessary for the purposes described here, including providing the Services, maintaining security and business records, complying with law, resolving disputes, and enforcing agreements. Retention depends on the data category, account status, consent choice, operational need, and legal requirements.

• Guide-lead records without newsletter consent, together with linked guide-request events, are scheduled for deletion 90 days after the last request.
• Remaining individual guide-request events are scheduled for deletion after 365 days.
• Newsletter contact and consent records are retained while the subscription is active and as needed to maintain unsubscribe, suppression, deletion, legal, and consent evidence.
• Guide-popup session suppression lasts for the browser session. Explicit-dismissal suppression is retained for 30 days and successful-request suppression for 365 days, unless browser storage is cleared sooner.
• Webflow access tokens and similar credentials are revoked or deleted when they are no longer required to provide the connected service, subject to documented security, backup, legal, and deletion procedures.

Cancelling a subscription stops renewal but does not itself delete an account. If you request deletion, we delete or de-identify information within the period required by applicable law, subject to lawful exceptions for security, fraud prevention, backups, disputes, tax and accounting, enforcement, suppression, and legal obligations.

9. Security

We use administrative, technical, and organizational measures designed to protect information, including encryption for sensitive integration credentials, access controls, spam and abuse checks, rate limits, and separation of transactional delivery from optional marketing consent. No method of transmission, storage, or processing is completely secure, and we cannot guarantee absolute security.

You are responsible for maintaining the security of your account credentials, connected Webflow permissions, website administration access, and devices.

10. International Data Transfers

HarperFlow is based in the United States and uses providers that may process information in the United States and other countries. If you are outside the United States, your information may be transferred to, stored in, or processed in countries with different data-protection rules.

Where required, we use appropriate safeguards for international transfers, which may include adequacy decisions, Standard Contractual Clauses, data-processing terms, and other lawful transfer mechanisms.

11. Your Privacy Rights

Depending on your location and applicable law, you may have rights to:

• Access personal information we hold about you.
• Correct inaccurate information.
• Delete personal information.
• Export or receive a copy of personal information.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.
• Opt out of marketing communications.
• Opt out of certain sales, sharing, targeted advertising, or profiling where applicable.
• Appeal certain privacy-rights decisions where required.
• Lodge a complaint with the data-protection authority where you live or work, or where you believe an infringement occurred, if GDPR or UK GDPR applies.

To exercise a right, contact support@harperflow.io. We may need to verify your identity and authority before fulfilling a request. We respond within the time required by applicable law. We appreciate the opportunity to address a concern, but contacting us is not a prerequisite to lodging a complaint with a supervisory authority.

12. California and U.S. State Privacy Notice

California and certain other U.S. state residents may have additional rights. Depending on the Services used, we may collect identifiers; commercial information; internet or network activity; professional or business information; product or content preferences; and limited sensitive information used for account security, authentication, or payment processing.

We do not sell personal information for money. Some analytics, advertising, or visitor-marketing technologies may constitute "sharing" or "targeted advertising" under applicable state laws. Where required, you can opt out through Privacy choices, an enabled Global Privacy Control signal, or by contacting us. We do not use guide-request emails for advertising-platform customer lists under the guide's optional newsletter checkbox alone.

You may use an authorized agent where applicable. We may verify the request, the agent's authority, and your identity. We will not unlawfully discriminate against you for exercising a privacy right. If we deny an appealable request, our response will explain how to appeal where required.

13. Children

The Services are intended for individuals who are at least 18 years old. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided information to us, contact support@harperflow.io.

14. High-Risk and Regulated Businesses

HarperFlow may support regulated, sensitive, or high-risk businesses only within reason and may require additional onboarding, safeguards, documentation, review, or written approvals. Customers are responsible for ensuring their use complies with laws, professional obligations, advertising rules, platform policies, and industry standards applicable to their business.

15. Data Processing Addendum

Where HarperFlow processes personal data on a customer's behalf as a processor and applicable law requires a data-processing agreement, our DPA applies or is available regardless of the customer's plan.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice through the Services, by email, or by another reasonable method. The updated Policy is effective when posted unless otherwise stated.

17. Contact Us

Better Brain Lab LLC
30 N Gould Street
Sheridan, WY 82801
United States
support@harperflow.io