Privacy Policy

1. Who we are

TrulyFinal (trulyfinal.com and app.trulyfinal.com, together the “Service”) is operated byAgentic Flow LLC, a limited liability company organised in Texas, United States (“Agentic Flow”, “we”, “us”). Our full postal address is available on request athello@trulyfinal.com.

TrulyFinal is client review and approval software for design studios. Studios (our customers) upload proofs, invite their clients to review them by link, collect comments and approvals, and deliver the approved files.

2. Our role: controller or processor

Who is responsible for your data depends on how you use TrulyFinal.

• Studio account holders and team members. For the account, billing and usage data of the people who sign up for and work in a studio workspace, Agentic Flow is thecontroller. This policy applies in full.
• Clients and reviewers invited by a studio. When a studio uploads files and invites people to review them, the studio decides what is uploaded and who is invited. For that content and for data about reviewers (names, email addresses, comments, markup, decisions and the technical data recorded on approval records), the studio is the controller and Agentic Flow acts as its processor under our Data Processing Addendum. If you were invited to review work, please contact the studio that invited you with questions or requests about your data. We will help them respond.
• Visitors to our website. For the limited data we collect on trulyfinal.com, Agentic Flow is the controller.

3. What we collect

Studio accounts

• Account details: name, work email address, password (stored only as a salted hash), studio name, and branding you add such as a logo and colours.
• Team data: the names, email addresses and roles of people you invite to your workspace.
• Billing data: plan, billing contact, billing address and tax details. Card and payment details are collected and stored by Stripe; we see only limited information such as card brand, last four digits and expiry.
• Usage and device data: sign-in times, IP address, browser and device type, and logs of actions taken in the workspace, used to run, secure and support the Service.
• Support communications: the content of emails and messages you send us.

Content and reviewer data (processed for studios)

• Files and projects: proofs uploaded by a studio (PDF, PNG, JPEG, TIFF and WebP files), project names, versions and delivery files. Files can contain personal data if the studio includes it.
• Reviewer details: clients do not need an account. Before commenting, a reviewer gives a name and email address.
• Review activity: comments, markup, replies, approvals and change requests.
• Approval records: each approval creates an append-only record of who approved, when, which version, a SHA-256 fingerprint of the file, any comments still open, and the IP address and browser user agent used.
• Email activity: delivery status of the review invitations, reminders and digests we send for a studio.

Website visitors

We use Cloudflare Web Analytics, which is cookieless and does not track you across sites, to count page views and see which pages are useful. If you email us, we receive your email address and message.

4. How we use it

• To provide the Service: host files, render previews, show comments, record approvals and deliver files.
• To send service email: review invitations, reminders, digests, approval notifications, password resets and account notices.
• To bill you and manage your subscription and free trial.
• To keep the Service secure: detect abuse, prevent fraud and spam, and investigate incidents.
• To answer support requests and help studios respond to their clients.
• To understand and improve the Service, using aggregated usage information.
• To tell studio account holders about important product changes. You can opt out of any non-essential product email at any time.
• To meet legal obligations, such as tax and accounting rules, and to enforce our Terms.

We do not sell personal data, we do not use it for advertising, and we do not use customer content or reviewer data to train machine learning models.

5. Lawful bases (GDPR and UK GDPR)

Where the EU or UK GDPR applies and we act as controller, we rely on:

• Contract — to set up and run your account and provide the Service you signed up for.
• Legitimate interests — to secure the Service, prevent abuse, provide support, understand how the Service is used and improve it, and send relevant product updates to business contacts. We balance these interests against your rights, and you can object at any time.
• Legal obligation — to keep billing and tax records and respond to lawful requests.
• Consent — where we ask for it, for example for optional communications. You can withdraw consent at any time.

Where we process reviewer data and customer content as a processor, the studio is responsible for having a lawful basis for that processing.

6. Cookies and analytics

We only use cookies that are strictly necessary for the Service to work:

• Session cookie — keeps studio team members signed in to app.trulyfinal.com.
• Guest session cookie — scoped to a review link, it remembers the name and email a reviewer has given so they can keep commenting without re-entering them.

We do not use advertising or cross-site tracking cookies, and we do not use third-party advertising trackers. Our marketing site uses cookieless Cloudflare Web Analytics. Because we only use essential cookies, we do not show a cookie consent banner.

7. Who we share it with

We share personal data only with:

• Service providers (subprocessors) who help us run TrulyFinal, under contracts that require them to protect the data and use it only to provide their services to us:

• The studio you work with. If you review work, your name, email, comments and decisions are visible to the studio and to other people invited to the same review.
• Recipients you choose. When a studio shares a review or delivery link, anyone with that link can access what it shares.
• Legal and safety. When required by law, or to protect the rights, safety or property of our users, the public or Agentic Flow.
• Business transfers. If Agentic Flow is involved in a merger, acquisition or sale of assets, personal data may transfer as part of that transaction, subject to this policy.

The current list of subprocessors is kept in our Data Processing Addendum.

8. International transfers

Agentic Flow is based in the United States and our primary data is stored in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, your data will be transferred to the United States. We protect those transfers with the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, incorporated through ourData Processing Addendum, together with equivalent commitments from our subprocessors.

9. How long we keep it

• Active accounts: we keep account data and content for as long as the workspace exists.
• Read-only workspaces: if a free trial ends without a plan, or a subscription lapses, the workspace becomes read-only. Your data is kept and you can still view and export it.
• Deletion: we delete workspace data 90 days after an account is closed, or after it has been read-only for 90 days. Deleted data rolls off our backups within a further 7 days.
• Billing records: kept for as long as tax and accounting law requires.
• Logs: security and operational logs are kept for a limited period and then deleted or aggregated.

Approval records are append-only and serve as the studio’s business record of what was approved. If someone asks for their personal data to be erased, we pseudonymise the personal data in those records (for example, replacing the name, email address and IP address) rather than deleting the record of the approval itself.

10. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit (TLS), encryption of stored files at rest, hashed passwords, access controls, point-in-time database backups and tamper-evident, hash-chained approval records. More detail is in Annex 2 of theDPA. No system is perfectly secure; if you believe you have found a security issue, please email support@trulyfinal.com.

11. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy;
• correct inaccurate data;
• delete your data (subject to the approval-record pseudonymisation described above and legal retention duties);
• restrict or object to certain processing, including processing based on legitimate interests;
• receive your data in a portable format;
• withdraw consent where we rely on it; and
• complain to a data protection authority, such as your local EU supervisory authority or the UK Information Commissioner’s Office.

To make a request, email hello@trulyfinal.com. We may need to verify your identity. We aim to respond within one month. If your request concerns data that a studio controls (for example, comments you left on a review), we will pass it to that studio or ask you to contact them directly.

12. California residents

Under the California Consumer Privacy Act (as amended by the CPRA), we disclose that in the past 12 months we have collected the categories of personal information described in section 3 (identifiers, commercial information, internet activity, and professional information) for the business purposes in section 4, and disclosed them to the service providers in section 7.

We do not sell or share personal information as those terms are defined in the CCPA, and we do not use or disclose sensitive personal information for purposes that would give you a right to limit it. You have the right to know, delete and correct your personal information, and we will not discriminate against you for exercising these rights. You can make a request, or have an authorised agent make one, by emailing hello@trulyfinal.com.

13. Children

TrulyFinal is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you think a child has given us personal data, contact us and we will delete it.

14. Changes to this policy

We may update this policy as the Service changes. We will post the new version here and update the date at the top. If a change is material, we will notify studio account owners by email or in the app before it takes effect.

15. Contact us

Agentic Flow LLC, Texas, United States (full postal address available on request)
Privacy requests and general questions: hello@trulyfinal.com
Support: support@trulyfinal.com