FollowIncome privacy notice
This notice explains who controls personal data, what FollowIncome processes, why it is processed, who receives it, how long it is kept, and the rights available to people in the EEA.
Controller and contact
The data controller is Followincome, USA. Contact info@followincome.com.
Data and sources
FollowIncome processes account and security data, workspace records, files, support communications, device and request data, limited product analytics, and credentials or results from services an authorized user connects. Data comes from users, their organizations, connected services, and normal operation of the service.
Purposes and legal bases
Account, workspace, document, support, and integration data is processed to provide the requested service and take steps before entering the service relationship. Security, abuse prevention, reliability, and privacy-reduced product analytics are processed for legitimate interests in operating and improving a safe service. Data is also processed where necessary to comply with law or establish, exercise, or defend legal claims. Consent is used where the law requires it and may be withdrawn prospectively.
Required information
An email address, password or supported sign-in method, and basic workspace settings are required to create and protect an account. Without them FollowIncome cannot provide an authenticated workspace. Other business records and integrations are optional and depend on the features a user chooses.
Recipients and processors
Data may be provided only as needed to hosting and infrastructure providers, email-delivery providers, error monitoring, configured product-analytics providers such as PostHog or Google Analytics, support and professional advisers, and services deliberately connected by an authorized user. Authorities may receive data where legally required. FollowIncome does not sell personal data.
International transfers
Some providers or user-connected services may process data outside the EEA. Where GDPR transfer safeguards are required, the controller relies on an applicable adequacy decision, approved standard contractual clauses, or another lawful mechanism. Information about the safeguard relevant to a request is available from the contact address above.
Analytics
FollowIncome records page views, acquisition milestones, and meaningful product actions using a first-party, data-minimized event collector. A random identifier is kept only in the current browser tab’s session storage and is sent during registration so acquisition steps can be linked. Authenticated product actions use a one-way account identifier. Event payloads exclude email addresses, record titles, notes, messages, files, financial values, and business-record content. The first-party collector keeps a limited event ledger and can forward the same event contract to configured processors such as PostHog or Google Analytics. Automatic click capture and session recording are disabled. Browser analytics honors Do Not Track.
Retention
Active account and workspace records are kept while the service is provided. Deleting an account anonymizes its login identity and revokes its access. Workspace records are retained until they are deleted by an authorized workspace user or must be kept for legal claims or obligations. Encrypted operational backups expire after 30 days; application logs normally expire after 14 days; integration-call metadata expires after 30 days; website-health history expires after 90 days; the browser acquisition identifier is removed from an account after 30 days; the first-party product-analytics ledger and PostHog product events are retained for no longer than 12 months; when Google Analytics is enabled, its user- and event-level retention is configured to 14 months. Support communications are retained only as long as needed to resolve the request and related claims. User-controlled business and financial records may require a longer period under laws that apply to the user.
Your rights
Subject to applicable conditions, a person may request access, correction, deletion, restriction, portability, or objection, and may withdraw consent without affecting earlier processing. A person may also complain to the data-protection supervisory authority in the country of habitual residence, workplace, or alleged infringement.
Security and automated decisions
FollowIncome uses company-scoped permissions, email verification, strong passwords, multi-factor authentication, authenticated file delivery, and encrypted operational backups. No solely automated decision produces legal or similarly significant effects for account holders.
Changes
Material changes will be dated here and communicated through an appropriate service channel when required. Last updated: September 11, 2026.