CALIFORNIA PRIVACY NOTICE (CCPA/CPRA)

Last Updated: March 2026

This California Privacy Notice supplements our Privacy Policy and applies to residents of California as required by the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

This notice also covers rights for residents of Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Virginia (VCDPA), Texas (TDPSA), Oregon (OCPA), and Montana (MCDPA).

Business Identity:

AIAGS Ltd d/b/a Inflowave

71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

Website: https://inflowave.io

1. CATEGORIES OF PERSONAL INFORMATION WE COLLECT

The following table describes the categories of personal information we have collected from consumers in the preceding 12 months:

2. HOW WE USE YOUR PERSONAL INFORMATION

We use the categories of personal information listed above for the following business purposes:

• Providing our services — Account creation, CRM functionality, Instagram automation, messaging, scheduling, analytics, marketplace
• Processing transactions — Subscription management, payment processing via Stripe and CoinPayments
• Security and fraud prevention — Login monitoring, rate limiting, abuse detection, audit logging
• Analytics and improvement — Understanding feature usage, debugging errors, improving UX
• Marketing — Promotional emails (opt-in), retargeting via Meta Pixel and Google Ads (business targeting only)
• Legal compliance — Tax record retention, responding to lawful requests
• Support — Responding to inquiries, troubleshooting, onboarding/offboarding

3. SALE AND SHARING OF PERSONAL INFORMATION

We do NOT sell your personal information.

Inflowave has not sold personal information in the preceding 12 months and does not sell personal information for monetary consideration.

Sharing for Cross-Context Behavioral Advertising

We may "share" (as defined by CCPA) certain data with advertising partners for targeted advertising:

You can opt out of cookie-based sharing — see Section 5 below.

Server-side conversion tracking uses irreversibly hashed data sent from our servers when you register or make a purchase. This is based on contractual necessity and cannot be disabled via cookie settings. To opt out, email support@inflowave.io with subject "Opt-Out Server-Side Tracking".

4. CATEGORIES OF INFORMATION DISCLOSED TO SERVICE PROVIDERS

In the preceding 12 months, we have disclosed the following categories to service providers for business purposes:

All service providers are contractually bound to use data only for the specified business purpose.

5. YOUR CALIFORNIA PRIVACY RIGHTS

As a California resident, you have the following rights:

A. Right to Know (CCPA 1798.100, 1798.110)

You can request that we disclose:

• The categories of personal information we collected about you
• The categories of sources from which the information was collected
• The business or commercial purpose for collecting or sharing
• The categories of third parties with whom we share
• The specific pieces of personal information we collected about you

B. Right to Delete (CCPA 1798.105)

You can request that we delete personal information we collected from you, subject to certain exceptions (e.g., completing a transaction, detecting security incidents, complying with legal obligations, tax record retention).

C. Right to Correct (CPRA 1798.106)

You can request correction of inaccurate personal information.

D. Right to Opt-Out of Sale/Sharing (CCPA 1798.120)

You can opt out of the "sale" or "sharing" of your personal information for cross-context behavioral advertising. Since we share data with advertising platforms (Google, Meta, Clarity), this right applies.

How to opt out:

• Cookie Settings — Decline marketing/analytics cookies via our cookie consent banner or Cookie Settings
• Email — Send a request to support@inflowave.io with subject "CCPA Opt-Out"
• Global Privacy Control (GPC) — We honor GPC signals sent by your browser

E. Right to Limit Use of Sensitive Personal Information (CPRA 1798.121)

We do not collect or process sensitive personal information as defined by the CPRA.

F. Right to Non-Discrimination (CCPA 1798.125)

We will not discriminate against you for exercising your privacy rights. You will not receive:

• A different price or rate
• A different level or quality of service
• A denial of service

6. FINANCIAL INCENTIVES

We offer a free trial that requires providing personal information (name, email, Instagram account). This constitutes a "financial incentive" under CCPA.

Details:

• What you provide: Name, email address, connected Instagram account
• What you receive: Free access to platform features for the trial period
• Value estimate: The value of the data collected during the trial is proportional to the cost of providing the trial service
• How to opt out: You may cancel your trial at any time and request deletion of your data

We do not offer other financial incentives, loyalty programs, or price differences in exchange for personal information.

7. HOW TO SUBMIT A REQUEST

Email: support@inflowave.io

Subject line: CCPA Request — [Right to Know / Right to Delete / Right to Correct / Opt-Out]

What to include:

• Your full name
• Email address associated with your Inflowave account
• The specific right you are exercising
• California residency (state)

Verification:

We will verify your identity by matching the information you provide against our records. We may ask for additional information if needed.

Authorized Agents:

You may designate an authorized agent to submit a request on your behalf. The agent must provide:

• Written authorization signed by you, or
• Power of attorney

We may still require you to verify your identity directly.

Response Timeline:

• We will acknowledge your request within 10 business days
• We will respond to your request within 45 days (extendable by an additional 45 days with notification)

8. DO NOT TRACK / GLOBAL PRIVACY CONTROL

• Do Not Track (DNT): We do not currently respond to DNT browser signals as there is no uniform industry standard.
• Global Privacy Control (GPC): We do honor GPC signals. If your browser sends a GPC signal, we will treat it as a valid opt-out of the sale/sharing of your personal information.

9. DATA RETENTION

We retain personal information only as long as necessary:

10. CHILDREN'S PRIVACY

Inflowave does not knowingly collect personal information from consumers under 16 years of age. We do not sell or share the personal information of consumers under 16.

11. CHANGES TO THIS NOTICE

We may update this California Privacy Notice periodically. The "Last Updated" date at the top reflects the most recent revision. Material changes will be communicated via email or in-app notification.

12. CONTACT US

For questions about this notice or to exercise your rights:

Email: support@inflowave.io

Phone: +44 744 533 4361

Address: AIAGS Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

Related Policies

• Privacy Policy — Full privacy notice
• GDPR Rights — EU/UK data protection rights
• Cookie Policy — Cookie details and consent
• Do Not Sell/Share — Opt-out form
• AI Data Consent Policy — AI-specific data processing
• Terms of Service — Platform terms

Last reviewed: March 2026

Next review due: September 2026