Privacy Policy

This Privacy Policy explains how Filta, Inc., a Delaware corporation (Filta, we, us, or our), collects, uses, shares, and protects information when you use the Filta website, application, and related services (the Service).

Filta is a business product for travel professionals. It connects to inboxes you authorize, looks for supplier marketing, and builds a private catalog of offers for your agency. It is not a consumer email client and is not intended for children’s use.

If you have questions or want to exercise a privacy right, email hello@filta.app with the subject line “Privacy Request.”

1. Information we collect

1.1 Account and workspace information

When you create an account or workspace, we collect:

• name, email address, and authentication credentials;
• agency or workspace name, if you provide one;
• team membership, roles, and invitations you send or receive; and
• communications you send us, including support and contact-form messages.

If you sign in with a third-party identity provider, we receive the account identifiers that provider shares with us (typically name and email).

1.2 Connected inbox information

If you connect Gmail or Outlook, we receive OAuth tokens and basic mailbox identifiers (such as the connected email address) so we can read messages you have authorized. We request read-only access. We do not ask for permission to send, delete, or modify your email.

To operate the Service we may process message metadata and content, including sender name and address, subject, timestamps, labels or folder signals, snippets, body text or HTML, and links. An initial scan typically looks back about 90 days. Later scans look for new supplier marketing.

We use sender, subject, and similar signals to set aside personal and one-to-one messages — such as replies, client threads, and booking conversations — so they are not processed as supplier offers. That classification is automated and will not be perfect. Those messages are not used to build your offer catalog.

1.3 Catalog, notes, and product activity

We collect information generated by your use of Filta, such as:

• extracted offers, events, and incentives associated with your workspace;
• saves, dismissals, corrections, notes, and feedback; and
• scan history and similar operational records needed to run and debug the Service.

1.4 Billing information

If you subscribe, our payment processor collects payment-method details, billing name, and transaction records. Filta receives limited billing metadata (such as plan, status, and invoice history). We do not store full card numbers on our own servers.

1.5 Device and usage information

We automatically collect technical information such as browser type, device and operating-system information, approximate location derived from IP address, referring URLs, pages viewed, and timestamps. We use cookies and similar technologies as described in our Cookie Policy.

2. How we use information

We use information to:

• provide, operate, maintain, and improve the Service, including inbox connection, classification, extraction, search, and workspace features;
• authenticate you and keep the Service secure;
• process subscriptions and send related notices;
• respond to support requests and communicate about the Service;
• monitor performance, prevent abuse, and debug failures; and
• comply with law and enforce our Terms of Service.

We do not use connected-inbox content to train foundation models for unrelated products, to build marketing profiles of your clients, or to sell advertising.

3. Inbox processing, AI, and shared supplier analysis

Filta is built to read supplier marketing, not your client book. Before offer analysis, we attempt to exclude personal and operational messages using rules and, when enabled, AI classification.

To recognize suppliers and summarize offers, we may send supplier marketing content to trusted AI processors (currently OpenAI) under contracts that restrict use of that content to processing our request. We configure those providers so your content is not used to train their models. They are not permitted to retain it beyond what is needed to complete the request and operate their API, except as required by law or their security logs.

Your raw inbox, client information, corrections, and notes are not shared with other agencies. When identical public supplier marketing reaches many agencies, we may store a de-duplicated copy of that marketing content and reuse the extracted analysis. That improves speed and avoids repeatedly processing the same public campaign. It is not a shared inbox and does not include your private correspondence.

Humans at Filta do not read connected-inbox content except in the limited cases allowed by Google’s Limited Use rules and applicable law: to provide support you request, to secure the Service, to investigate abuse or a Terms violation, or to comply with a legal obligation. Access is limited to personnel who need it for those purposes.

4. How we share information

We share information only as described below:

• Service providers. Hosting, database, authentication, email delivery, payment processing, and AI processing vendors that process data on our instructions. Current categories include cloud infrastructure and database (including Supabase), Google and Microsoft for inbox authorization and mail APIs, OpenAI for classification and extraction, and Stripe for payments.
• Workspace members. People you invite to a workspace can see catalog data and other content available in that workspace.
• Shared supplier analysis. De-duplicated public supplier marketing and the structured offers extracted from it, as described in Section 3. This does not include your raw mailbox, client threads, notes, or corrections.
• Legal and safety. If we believe disclosure is required by law, valid legal process, or to protect Filta, our customers, or the public.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality.
• With your direction. If you ask us to share information or use a feature that sends you to a supplier or other third party.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We have no advertising partners that receive your inbox content.

5. Google and Microsoft user data

Gmail access uses Google OAuth and the Gmail API with read-only scope. Outlook access uses Microsoft identity and Microsoft Graph mail-read permission. You can revoke those permissions in your Google or Microsoft account settings, and you can disconnect the inbox in Filta.

We use Google and Microsoft user data only to provide and improve Filta’s user-facing features: connecting the inbox you choose, identifying supplier marketing, extracting offer details, and showing those results to you and your workspace. We do not use that data for serving ads, for creditworthiness, or for unrelated data-broker products.

Transfers of Google or Microsoft user data to our processors (such as our database host or AI provider) are limited to what is needed to provide those features, and those processors are not permitted to use the data for their own purposes.

6. Retention

We retain information only as long as needed for the purposes above:

• Account and workspace data until you delete the account or we close it, and then for a limited period if needed for backups, billing, or legal compliance.
• OAuth tokens until you disconnect the inbox or revoke access. Disconnecting deletes the connection and the raw messages stored for that connection.
• Workspace catalog items (offers saved to your dashboard) may remain after an inbox is disconnected, until you delete them or close the account.
• De-duplicated public supplier marketing and structured offers extracted from it may be retained to operate the shared analysis described in Section 3, because that content is not unique to one customer.
• Billing records for the period required by tax and accounting law.

You can delete your account in settings. You can also email hello@filta.app and we will delete or anonymize personal information we control, unless we must keep it for law, security, or an outstanding dispute.

7. Security

We use administrative, technical, and organizational measures designed to protect information, including encryption in transit, access controls, and row-level isolation of customer data in our database. No method of transmission or storage is completely secure. You are responsible for protecting your account credentials and for connecting only inboxes you are authorized to share.

8. Your choices and rights

You can:

• access and update profile information in account settings;
• disconnect an inbox or revoke Google/Microsoft access;
• delete notes, saved items, or your account;
• opt out of non-essential product emails by using the unsubscribe link or contacting us (we will still send transactional messages about your account and security); and
• control cookies through your browser, as described in the Cookie Policy.

Depending on where you live, you may have additional rights to know, access, correct, delete, or export personal information, to appeal a denial, or to restrict or object to certain processing. California residents have rights under the CCPA/CPRA, including the right to know, delete, correct, and not be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by California law.

To make a request, email hello@filta.app. We will verify your request before fulfilling it. You may use an authorized agent where the law allows, if they provide proof of authorization. We will respond within the time required by applicable law.

If you are in the EEA, UK, or Switzerland and we process personal data about you, Filta is the controller of account and billing data. For inbox content you connect, we process that content to provide the Service to your organization. If your organization is the controller, we act as its processor for that content and you should contact your organization for those requests as well.

9. International transfers

Filta is based in the United States. If you access the Service from another country, your information will be processed in the United States and any other country where our providers operate. Those countries may have different data-protection laws than your own. Where required, we use appropriate safeguards for cross-border transfers, such as standard contractual clauses.

10. Children

The Service is for adults in a business context. We do not knowingly collect personal information from children under 18, and we do not direct the Service to children under 13. If you believe a child has provided information, contact us and we will delete it.

11. Do not track

Some browsers send “Do Not Track” signals. There is no common industry standard for responding to them. The Service does not currently respond to Do Not Track. We do not use third-party advertising cookies to track you across unrelated sites.

12. Changes

We may update this Privacy Policy from time to time. We will post the updated policy and change the date above. If a change is material, we will provide additional notice, such as email or an in-product message. Continued use of the Service after an update means you acknowledge the revised policy.

13. Contact

Privacy and data requests: email hello@filta.app or use our contact form.

If you are a California resident and have a request or complaint you could not resolve with us, you may also contact the California Privacy Protection Agency or your state attorney general. EEA/UK users may lodge a complaint with their local supervisory authority.