Who we are
CyberFlow is a private manufacturing operations and export sales platform operated by Cyber Design. Companies receive access through direct onboarding. This policy covers the platform and its optional integrations. Your manufacturing company also determines how it uses the business information it enters; contact your company administrator about that use.
Information we process
We process account and invitation details, names, email addresses, company memberships and roles; business contacts, products, orders, production progress, quality records, invoices, payments, shipments and uploaded documents; and export profiles, public buyer research, outreach drafts and conversation records that users create or authorize.
Optional connections require provider API keys, OAuth tokens or SMTP credentials. We also process operational and security records, such as action timestamps, delivery states, provider usage, errors and audit events. Hosting and authentication services may process technical request information, including IP addresses and browser details, to operate and secure the service.
Why we use information
We use information to authenticate users, enforce company and role permissions, provide manufacturing and customer portal features, store documents, deliver notifications, perform requested research, send approved correspondence, synchronize linked replies, resolve support issues and prevent misuse. Company team members see information according to their permissions; customer portal access is limited to the customer-visible records assigned to them.
Google and Gmail access
Connecting Gmail or Google Workspace is optional and uses Google OAuth. CyberFlow does not ask for your Google password. We obtain your mailbox email address and access and refresh tokens to identify the connected mailbox and maintain the connection.
We request gmail.send to send email you approve and gmail.readonly to read replies. The read permission grants broad mailbox read access. CyberFlow uses it to fetch existing export conversation threads linked to messages sent through the platform, rather than importing your entire inbox. This includes message headers, sender and recipient addresses, subject, plain-text message content and thread identifiers. Relevant conversation records and delivery information are stored for your authorized company users.
Outgoing messages include the recipient, subject, body and any documents explicitly selected for that message. Messages must be approved in CyberFlow and pass sending limits and suppression checks. Connecting a mailbox alone does not authorize unrestricted sending. Incoming attachments are not downloaded or executed, and incoming Gmail text and attachments are not automatically sent to Gemini.
Limited use of Google data
CyberFlow's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Google user data is used only to provide the visible mailbox and export conversation features. We do not sell it, use it for advertising or credit decisions, or use it to train or improve general-purpose AI or machine learning models. Transfers are limited to providing these features with your consent, security purposes, legal obligations, or a business transfer with your prior explicit consent.
Cyber Design personnel do not read Google message content unless you affirmatively agree to access specific messages for support, access is necessary to investigate security issues or abuse, or access is required by law. Authorized users in your company can review the export conversations made available through their platform permissions.
AI and buyer research
When you approve buyer research, Apify receives the search criteria and processes public web information. Gemini receives the approved export company profile and relevant public research to assess matches or draft requested outreach. These workflows do not automatically include internal costs, historical customer records or confidential production specifications. API access, quotas, charges and provider data handling follow your provider account and its terms.
Separately, using the order AI Import feature sends the document you select to Google Gemini to extract order fields. Use that feature only for documents you are authorized to share. This is distinct from the Gmail connection: CyberFlow does not automatically forward mailbox content to AI. Review provider terms before submitting confidential information; provider data practices can differ by plan.
Service providers and sharing
CyberFlow uses Vercel for hosting and Supabase for authentication, database and private document storage. Resend handles platform notifications. Optional integrations use Google for Gmail and Gemini, Apify for public research, and a company-selected SMTP provider for outgoing business email. Each provider receives the information needed for the feature you use; email recipients receive the content and attachments you send them.
Providers may process information in countries other than yours under their own service terms and privacy policies. We may disclose information when required by law or necessary to address security incidents or abuse. Google API data remains subject to the additional Limited Use restrictions above.
Security and cookies
CyberFlow uses HTTPS, authenticated access, company-scoped database permissions and private document storage. Saved export provider keys, mailbox tokens and SMTP credentials are encrypted at rest, with encryption keys managed separately from stored credentials. These safeguards reduce risk; no online service can guarantee absolute security.
Cookies maintain your sign-in session and remember your selected light or dark theme. Keep your account secure and notify your company administrator or Cyber Design if you suspect unauthorized access.
Retention, disconnection and deletion
We retain information as needed to provide the service and maintain necessary business, security and audit records. Retention depends on the record type, company arrangements and applicable obligations; there is no single retention period for every record.
An authorized company user can use Disconnect mailbox in the export sales settings. This removes saved mailbox credentials, stops queued mailbox work and attempts to revoke Google authorization. You can also revoke access in your Google Account connections. Revoking access stops future authorized access; it does not automatically erase existing correspondence or audit records.
For access, correction, export or deletion requests, contact your company administrator or cyberdesignpk@gmail.com. We verify the requester's authority and explain any information that must remain for legitimate recordkeeping or legal obligations. Removing a CyberFlow record does not remove copies already held by recipients or independent providers.
Policy changes and contact
We publish updates here with the revised date. Material changes to Google data access or purposes will be disclosed before the new use, with renewed consent where required. CyberFlow is intended for authorized business users, not children. Questions about this policy can be sent to Cyber Design at cyberdesignpk@gmail.com.