FollowIncome privacy notice

Controller and contact

The data controller is Followincome, USA. Contact [email protected].

Data and sources

FollowIncome processes account and security data, workspace records, files, support communications, device and request data, limited product analytics, and credentials or results from services an authorized user connects. Data comes from users, their organizations, connected services, and normal operation of the service.

Purposes and legal bases

Account, workspace, document, support, and integration data is processed to provide the requested service and take steps before entering the service relationship. Security, abuse prevention, reliability, and privacy-reduced product analytics are processed for legitimate interests in operating and improving a safe service. Data is also processed where necessary to comply with law or establish, exercise, or defend legal claims. Consent is used where the law requires it and may be withdrawn prospectively.

Required information

An email address, password or supported sign-in method, and basic workspace settings are required to create and protect an account. Without them FollowIncome cannot provide an authenticated workspace. Other business records and integrations are optional and depend on the features a user chooses.

Recipients and processors

Data may be provided only as needed to hosting and infrastructure providers, email-delivery providers, error monitoring, configured product-analytics providers such as PostHog or Google Analytics, support and professional advisers, and services deliberately connected by an authorized user. Authorities may receive data where legally required. FollowIncome does not sell personal data.

AI clients and the FollowIncome plugin

When a user deliberately connects ChatGPT, Codex, or another MCP client and approves the mcp:use OAuth permission, that client may request the company names, company details, promotion contacts, tasks, notifications, files, pricing and cost records, analytics results, memories, skills, service-connection status, and other business content available through the enabled FollowIncome tools. Those records may contain personal data entered by the user or the user’s organization.

FollowIncome sends only the fields needed for the tool the authorized client invokes. Account name and email are hidden by default; the client receives a pseudonymous profile identifier unless that account holder separately enables “Share my name and email” in Developer settings. Profile sharing can be withdrawn at any time, and disconnecting the OAuth client revokes its future access. Saved passwords, API keys, tokens, MFA codes, and other authentication secrets are never returned through the plugin. The connected AI provider receives data as a recipient under its own terms and privacy practices.

International transfers

Some providers or user-connected services may process data outside the EEA. Where GDPR transfer safeguards are required, the controller relies on an applicable adequacy decision, approved standard contractual clauses, or another lawful mechanism. Information about the safeguard relevant to a request is available from the contact address above.

Analytics

FollowIncome records page views, acquisition milestones, meaningful product actions, and privacy-reduced web performance measurements such as LCP, INP, and CLS using a first-party, data-minimized event collector. A random identifier and the first public landing route, referring domain, channel, and campaign labels are kept in first-party browser storage for up to 90 days, with tab-scoped storage as a fallback, and the identifier is sent during registration so acquisition steps can be linked. Query strings, search terms, email addresses, and page content are not stored in this attribution record. Authenticated product actions use a one-way account identifier. Performance events contain only the metric name, rounded value, rating, navigation type, and public route. Event payloads exclude email addresses, record titles, notes, messages, files, financial values, and business-record content. The first-party collector keeps a limited event ledger and can forward the same event contract to configured processors such as PostHog or Google Analytics. Automatic click capture and session recording are disabled. Browser analytics honors Do Not Track.

Retention

Active account and workspace records are kept while the service is provided. Deleting an account anonymizes its login identity and revokes its access. Workspace records are retained until they are deleted by an authorized workspace user or must be kept for legal claims or obligations. Encrypted operational backups expire after 30 days; application logs normally expire after 14 days; integration-call metadata expires after 30 days; website-health history expires after 90 days; the first-party browser acquisition record expires after 90 days, and an acquisition identifier linked to an account is removed from that account after 30 days; the first-party product-analytics ledger and PostHog product events are retained for no longer than 12 months; when Google Analytics is enabled, its user- and event-level retention is configured to 14 months. Support communications are retained only as long as needed to resolve the request and related claims. User-controlled business and financial records may require a longer period under laws that apply to the user.

Your rights

Subject to applicable conditions, a person may request access, correction, deletion, restriction, portability, or objection, and may withdraw consent without affecting earlier processing. A person may also complain to the data-protection supervisory authority in the country of habitual residence, workplace, or alleged infringement.

Security and automated decisions

FollowIncome uses company-scoped permissions, email verification, strong passwords, multi-factor authentication, authenticated file delivery, and encrypted operational backups. No solely automated decision produces legal or similarly significant effects for account holders.

Changes

Material changes will be dated here and communicated through an appropriate service channel when required. Last updated: October 13, 2026.