Privacy Policy

Last updated: July 19, 2026

Flamingo Flow ("we", "us") is operated by Endless Marketing Inc., an Ontario, Canada company. We provide a done-for-you Google review service for local businesses in Canada and the United States. This policy explains what personal information we collect, how we use it, who we share it with, where it is stored, and the choices you have. It applies to flamingoflow.ca, our free tools (including the Google review QR code generator), our onboarding and booking workflows, and the review outreach we run on behalf of client businesses.

Our commitment: customer lists entrusted to us by client businesses are never sold and never shared with anyone for their own use. We do not sell customer lists or the information clients entrust to us, and we do not exchange personal information for money. Customer lists are used only to send review requests for the client that provided them, and are handled only by service providers acting strictly on our instructions, under contracts that bar them from using the information for anything else. Separately, our ad landing and confirmation pages use common analytics and advertising tools (Microsoft Clarity and the Meta Pixel) that collect limited technical data about website visitors, described under Website usage data below. Those tools never receive customer lists, but the transfers they involve may qualify as a "sale" or "sharing" under California law; see Your Privacy Choices.

Information We Collect

Information you give us directly. When you submit a form, book a call, start a trial, or contact us, we collect details such as your name, email address, phone number, business name and website, appointment preferences, your answers to our short qualification questions, and the content of your messages. Our forms also record your IP address and browser user agent, and the campaign parameters and ad click identifiers that brought you to the site (such as utm_source, fbclid, gclid, msclkid, and ttclid), so we know which marketing led you to us.

Customer lists provided by client businesses. To send review requests on a client's behalf, the client provides us with contact details of their real past and new customers (typically name, phone number or email, and service date). The client business tells us which of its customers to contact and confirms it has the consent required to do so, and we apply our own checks before sending. We use the list only to request honest Google reviews for that client, and we never sell it or use it to market unrelated products. If you believe you were contacted without your consent, contact us and we will stop and investigate.

Messages you exchange with us. We keep records of the emails and text messages sent through the service, including booking confirmations, reminders, review requests, and replies. Our SMS system stores inbound replies, including opt-out words such as STOP, so we can honour them and show that we did.

QR code and scan data. When someone scans a tracked Google review QR code created with our tool, we record the scan time, the campaign ID and placement, and basic technical details about the device that scanned it, including IP address, browser, operating system, device type, language, and approximate location derived from the IP address by our hosting and security providers. We use this to count and compare scans by placement. We do not use it to identify the person scanning, and we do not add scanners to any outreach list.

Payment information. Payments are processed by Stripe. When you start a trial, your payment method is saved securely with Stripe so your subscription can be billed automatically after the trial unless you cancel. We do not store full card numbers on our servers; we keep the card brand, last four digits, and expiry date, along with records of plan, billing status, and transaction references.

Account and administrative records. Our admin panel holds client records, staff login accounts and sessions, and an event log of actions taken in the system. These records exist to run the service, support clients, and investigate problems.

Website usage data. We use cookies and similar technologies to understand how visitors use our pages and to measure advertising. Microsoft Clarity (session analytics) and the Meta (Facebook) Pixel (advertising measurement) run on our ad landing and confirmation pages. These tools may collect device identifiers, pages viewed, and interaction data.

How We Use Information

• Provide, operate, and improve the review outreach service and free tools.
• Send review requests to a client's real customers and polite follow-ups, in line with our review compliance standards.
• Communicate with you about onboarding, support, billing, and service updates.
• Measure QR code performance and help businesses understand which placements create review intent.
• Attribute signups to the marketing campaign that brought them and measure advertising performance.
• Keep records of consent and opt-outs so we can show our messaging was lawful.
• Detect abuse, secure our systems, and meet legal obligations.

When we send commercial electronic messages, we do so in accordance with Canada's Anti-Spam Legislation (CASL) and, for US recipients, applicable US laws. Review request messages are sent on behalf of the business you actually dealt with. You can stop text messages at any time by replying STOP, and you can ask us to stop emailing you at any time by replying to the message or emailing info@flamingoflow.ca.

Automated Decisions

We do not use personal information to make decisions about individuals by automated means that produce legal effects or similarly significant effects for them. Our systems automate scheduling, message timing, and billing, but a person makes the decisions that matter, such as whether to accept, pause, or end a client account.

Service Providers We Use

Customer lists are never sold and never shared for any third party's own use. We give personal information to service providers only so they can perform a specific job for us, under contracts that bar them from using it for anything else. The providers we rely on fill these roles:

• Stripe - payment processing and secure storage of saved payment methods
• Google - Places API, Maps, and review links
• Zoom - video meetings for onboarding and setup calls
• Microsoft Clarity - session analytics on our ad and confirmation pages
• Meta - advertising measurement pixel on our ad and confirmation pages
• A third-party SMS gateway that delivers our text messages, including confirmations, reminders, and review requests
• A website hosting and business email provider that stores our systems and sends our email
• A content delivery and security provider that protects and speeds up our website

If you want to know the identity of a specific provider handling your information, ask our Privacy Officer at info@flamingoflow.ca and we will tell you.

One exception, stated plainly: Meta and Microsoft may use the limited technical data their tools collect from website visitors for their own advertising and analytics purposes, as independent companies. That never includes customer lists or the information clients entrust to us for review outreach. We may also disclose information if required by law or to protect our rights, users, or the public.

Where Your Information Is Stored and Processed

We are based in Ontario, Canada, but several of the service providers listed above store and process personal information in the United States and in other countries. That includes payment, messaging, hosting, security, and analytics providers.

While personal information is in another country, it is subject to the laws of that country. This means it may be accessible to the courts, law enforcement, and national security authorities of that country under their laws, and those laws may differ from Canadian law.

We choose established providers and we limit what each provider receives to what it needs to do its job. With the providers that handle information on our behalf, we contract for processing only on our instructions and for safeguards comparable to our own. Meta and Microsoft are the exception described above: they act as independent companies for the limited technical data their tools collect from website visitors. If you want to know where a specific category of information is handled, or you have concerns about transfers outside Canada, contact our Privacy Officer at info@flamingoflow.ca with "Privacy Officer" in the subject line.

Your Rights

Canada (PIPEDA). You may request access to, or correction of, the personal information we hold about you, withdraw consent (subject to legal or contractual limits), and ask how your information has been used or disclosed. You may also complain to the Office of the Privacy Commissioner of Canada. If you are in Quebec, you have similar rights under Quebec's private-sector privacy law, including access, correction, and withdrawal of consent, and the right to be told when your information is transferred outside Quebec.

United States (including CCPA/CPRA for California residents). Depending on your state, you may have the right to know what personal information we collect, request deletion or correction, and opt out of the sale or sharing of personal information. We do not sell customer lists or the information clients entrust to us. The advertising and analytics tools on our ad and confirmation pages may involve a transfer that qualifies as a "sale" or "sharing" under California law; you can opt out as described under Your Privacy Choices. We do not use sensitive personal information for purposes that require an opt-out under the CPRA.

Your Privacy Choices. These advertising and analytics tools run only on our ad landing and confirmation pages, and not on the rest of the site. You can block or delete the cookies they use through your browser settings, and you can ask us to exclude you by emailing info@flamingoflow.ca with the subject "Opt out of sharing". We will treat that request as an opt-out of sale and sharing and confirm it to you.

If you received a review request. The business you dealt with asked us to contact you and told us it has your consent. You can stop further messages at any time by replying STOP to a text message, or by replying to an email or writing to us. You can also ask us to delete your contact details by emailing us. If you have opted out, we keep the minimum needed to recognize you - normally your phone number or email address alone - on a do-not-contact list, so you are not contacted again. We do not use that record for any other purpose.

To exercise any right, email info@flamingoflow.ca. We will verify your request and respond within the time required by applicable law.

Accountability

Endless Marketing Inc. has designated a Privacy Officer who is accountable for our handling of personal information under PIPEDA. You can reach the Privacy Officer at info@flamingoflow.ca with "Privacy Officer" in the subject line.

Data Retention

We keep personal information only as long as we need it for the purposes described above. In practice:

• Client and billing records. Kept for the life of the relationship, and after that for the period Canadian tax law requires business books and records to be kept - generally six years from the end of the last tax year they relate to.
• Customer outreach lists. Kept while the client's campaign is active. When a client's account ends, we delete or anonymize the list once it is no longer needed to run the service or to meet a legal obligation. We separately keep a minimal record of the consent basis and opt-out status for each contact, because Canada's anti-spam law allows proceedings to be commenced for three years and we need that record to show our messaging was lawful.
• QR scan analytics. We do not keep individual scan records, which include IP address and device details, for longer than twelve months. Aggregate scan counts, which do not identify anyone, may be kept for as long as the campaign exists.
• Leads who never become customers. Kept while there is a realistic prospect of doing business, and deleted on request.
• SMS and email conversation records. Kept while needed for support and as evidence of consent, opt-outs, and compliance with messaging law.
• Do-not-contact records. The minimum identifiers needed to recognize an opt-out are kept indefinitely, because we need them to make sure a person who asked not to be contacted is not contacted again.

We may keep information longer where the law requires it or where it is needed for a legal claim, an audit, or an investigation. When information is no longer needed, we delete it or strip out the details that identify a person.

Security

We use HTTPS across the site, restrict access to systems holding personal information, process payments through Stripe rather than storing card data, and apply server-side protections such as rate limiting and access controls. No method of transmission or storage is completely secure, but we work to protect your information with measures appropriate to its sensitivity. If a breach of our security safeguards creates a real risk of significant harm, we will notify affected individuals and report to the Office of the Privacy Commissioner of Canada as required by PIPEDA.

Cookies

The advertising and analytics tools described above run only on our ad landing and confirmation pages. You can block or delete cookies through your browser settings, and you can also ask us to exclude you from those tools by email, as described under Your Privacy Choices above. Blocking some cookies may affect parts of the site such as the QR code generator and booking calendar. Analytics cookies are used to improve the site and measure campaigns, not to identify you personally. Text messages can be stopped by replying STOP, and you can ask us to stop emailing you at any time by replying to the message or emailing info@flamingoflow.ca.

Children

Our services are intended for businesses and are not directed to children under 13. We do not knowingly collect personal information from children.

Changes to This Policy

If we make material changes, we will update this page and the date at the top. Where a change means using information you already gave us for a new purpose, we will ask for your consent before doing so. For clients, we will send notice of material changes to the email address on the account.

Contact

Questions about privacy can be sent to info@flamingoflow.ca or by phone at +1 (365) 889-8810. Flamingo Flow is operated by Endless Marketing Inc., Ontario, Canada. See also our Terms of Service and Review Compliance standards.