SupportFlow Privacy Policy

1. Scope and operator

This Privacy Policy describes how Koquelani Systems of Oklahoma (“Koquelani,” “we,” “us,” or “our”) handles personal information in connection with SupportFlow, including SupportFlow accounts, attached PCs or stations, support sessions, billing, related communications, and visits to our public website.

SupportFlow is intended for use by businesses and adults age 18 or older in the United States. When an organization provides your account, that organization may control the account and associated session information. Its own privacy policies may also apply.

2. Information we collect

Account and contact information

• Your email address, which is required to create and use an account.
• A securely hashed form of your login password. We do not store the password in readable form.
• Your marketing preferences and any information you choose to provide when contacting support.

Device and network information

• Your public IP address.
• The Windows machine name of the computer running SupportFlow.
• The Windows machine names of attached PCs or stations you install or connect.

Service-usage information

• The number and types of tool calls made to the Koquelani MCP, but not the content of those calls (its encrypted with your ControlKey which we don't posses).
• Basic support-session summaries, including session start and end times and the amount of data transferred.

Public-website advertising measurement

On our public website only, we use Google Tag to measure advertising performance, such as whether an advertisement resulted in a website visit or other interaction. Google Tag may process website-interaction and device or browser information for this measurement under Google’s own privacy terms. Google Tag is not used inside SupportFlow, on attached PCs or stations, or to inspect SupportFlow communications or content.

Billing information

Payments are handled by Square Payments. Koquelani retains limited transaction records such as the cardholder name, last four digits of the card, product purchased, transaction date and time, and amount. Square may collect and process additional payment information under its own privacy policy.

3. Information we do not retain or use

• ControlKey: When in Medium or High Security mode, we do not store your ControlKey, which is used to encrypt and decrypt communications and control attached stations. When in Low Security mode, we store your ControlKey in an encrypted vault file, which, while reasonably secure, we DO NOT recommend using Low Security mode for anything other than testing or evaluation purposes. Always switch to Medium or High Security mode when using our products on production machines.
• Recovery key: We do not store the recovery key for your ControlKey.
• Tool-call content: We record counts and call types for calls to our MCP, but not their content. That content is encrypted with your ControlKey (which we do not handle or possess) while transmitted through SupportFlow.
• File-transfer data: In normal mode, the file contents pass through the service encrypted with your ControlKey and are not retained by Koquelani. The exception to this is SupportFlow Lite (the web-only version of the product) which allow file transfer thru the browser, files must be temporarily retained so that you can then download them. We delete them automatically after your session ends. NOTE: We do not recommend using the Support Lite thru the website for any purposes other than Test and evaluation. Please use the full SupportFlow Client for production uses where you enjoy higher security.
• AI training: We do not train models or permit AI providers to train on SupportFlow data. We are in the business of facilitating AI-driven tools and not the AI training business itself. We do not, however, control which AI harness you personally use to drive our MCP, and it will have its own data usage and retention policies. We have no control over how that provider may use your data; please see your LLM harness provider’s data usage and privacy policies.

4. How we use information

We use the information described above to:

• Create, authenticate, secure, and administer SupportFlow accounts.
• Connect and identify installed machines and attached stations.
• Operate the service, measure usage, enforce service limits, and troubleshoot product issues.
• Measure advertising performance on the public Koquelani website through Google Tag.
• Provide customer support and maintain basic session history for support purposes.
• Process purchases, maintain transaction records, and meet tax and accounting obligations.
• Detect misuse, protect accounts, and maintain the security and reliability of SupportFlow.
• Send service, security, special announcement, and upgrade notices.
• Send first-party marketing about Koquelani services only when you have opted in. You may opt out at any time.

5. When information is disclosed

We do not sell personal information, share it for cross-context behavioral advertising, rent it, or allow outside parties to use it for their own marketing or other independent purposes.

We disclose limited information in these circumstances:

• Google Tag (public website only): Website-interaction and device or browser information used to measure advertising performance. Google Tag is not used within SupportFlow or on attached stations.
• Square Payments: Information necessary to process and document your purchase, such as product, date and time, and amount. Payment information is processed by Square.
• Your organization: If your account belongs to an organization, its authorized administrators may manage the account and access organization-level usage or session-summary information.
• Legal and safety requirements: Information when reasonably necessary to comply with law or legal process, protect rights and safety, investigate misuse, or secure the service.
• At your direction: Information you ask or authorize us to disclose.

6. Retention and deletion

• Session summaries: Retained for up to 60 days for product-support purposes. You can clear this information at any time from your account portal.
• Individual accounts: Session-summary information is deleted immediately when you delete your account.
• Organization accounts: Session summaries associated with an organization belong to that organization and are retained while its Organization Admin account remains open, unless cleared earlier through the account portal.
• File transfers: File-transfer contents are not retained.
• Billing records: Limited records—cardholder name, last four card digits, product, amount, and transaction date and time—are retained as long as reasonably needed for tax, accounting, dispute, and legal obligations.
• Other account information: Retained while the account is active and deleted or de-identified after account closure, except where a longer period is needed for security, fraud prevention, dispute resolution, or legal compliance.

7. Security

We use administrative, technical, and organizational safeguards designed to protect information. These include hashing login passwords, encrypting SupportFlow communications, separating account authentication from the customer-controlled ControlKey, and not retaining ControlKeys, recovery keys, tool-call content, or transferred files.

No service can guarantee absolute security. You are responsible for protecting your login credentials, ControlKey, recovery key, connected AI environment, and access to your devices.

8. Your choices and requests

You may review or update account information through the account portal, clear available session summaries, delete your account, or unsubscribe from opt-in marketing messages. Essential service, billing, and security communications may still be sent when necessary.

You may also ask us to provide access to, correct, or delete personal information associated with you. Email inquiry@koquelani.com with the subject “Privacy request.” We may need to verify your identity and authority before completing a request. Certain information may be retained where permitted or required by law.

9. Notice for California residents

This section supplements the rest of the policy for California residents. Where the California Consumer Privacy Act, as amended, applies, California residents may have rights to know and access personal information, correct inaccurate information, request deletion, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive equal service when exercising privacy rights.

Koquelani does not sell personal information or share it for cross-context behavioral advertising. We do not use sensitive personal information to infer characteristics about you.

Categories handled in the preceding 12 months

We collect these categories directly from you, automatically from the public website, SupportFlow software, and connected machines, from Google in connection with website advertising measurement, and from Square in connection with a transaction. We disclose limited information to Google and Square as described in Section 5.

Exercising California rights

Submit a request by emailing inquiry@koquelani.com. An authorized agent may submit a request for you, subject to verification of the agent’s authority and your identity. We will not discriminate against you for making a privacy request.

10. Children’s privacy

SupportFlow is a business service intended only for adults. It is not directed to children under 18, and we do not knowingly collect personal information from children.

11. Changes to this policy

We may update this policy as SupportFlow or applicable requirements change. We will post the revised policy with a new effective date and provide additional notice when appropriate.

12. Contact us