Privacy Policy

1. Introduction

Welcome to FlowPay ("we", "our", or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, including our web application, payment processing features, invoicing tools, and related services (collectively, the "Service").

Please read this policy carefully. If you disagree with its terms, please discontinue use of the Service immediately.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: Name, email address, password, phone number, profile picture
• Business Profile: Company name, logo, address, phone, industry, tax and business settings
• Customer Records: Names, emails, phone numbers, addresses, company names, customer levels, vehicle information
• Financial Data: All invoices, payment records, amounts, payment methods, bank account information (last 4 digits for employees)
• Product & Service Data: Product names, descriptions, prices, images, SKU variants, stock levels, tax rates
• Expense Records: Expense descriptions, categories, amounts, dates, receipts, memos
• Booking Information: Service titles, dates, times, customer details, status updates, notes
• Employee Data: Names, emails, phone numbers, hire dates, salary information, tax withholding status, federal allowances, banking details for direct deposit, deductions
• Payroll Records: Hours worked, gross pay, tax withholdings (federal, state, Social Security, Medicare), net pay, payment methods, payment status
• Vendor Information: Vendor names, contacts, emails, phones, addresses, websites, categories, payment terms
• Purchase Orders & Bills: PO numbers, vendor details, line items, quantities, costs, payment status
• File Uploads: Receipts, invoices, images, documents, attachments and associated metadata
• Connected Mailbox Data: When a user explicitly connects a supported work mailbox, FlowPay may process customer email metadata and message content needed to identify quote requests, create draft estimates, and support review/approval workflows
• Activity Logs: Selected security-sensitive and business events, such as sign-ins, record changes, membership changes, and quote-automation actions, with timestamps and user attribution where available

2.2 Information Collected Automatically

• Log Data: IP address, browser type, browser version, pages visited, time spent on pages, referral source, click patterns, timestamps
• Device Information: Operating system, screen resolution, device type (desktop, mobile, tablet), browser language settings
• Usage Analytics: Features accessed, frequency of use, workflow patterns, feature adoption, error logs
• Cookies & Tracking: Session cookies, authentication tokens, preference cookies, analytics cookies, security cookies
• Performance Data: Page load times, feature performance metrics, system performance data
• Security Data: Login attempts, failed authentication records, password reset requests, security verification logs

3. How We Use Your Information

We use the information we collect to:

• Core Service Delivery: Create and manage your account, provide access to all features (POS, invoicing, payroll, inventory, reports)
• Transaction Processing: Process payments, calculate taxes, generate invoices, manage receipts, handle refunds and credit memos
• Payroll Administration: Organize employee information and payroll records. Automated tax calculation, tax filing, and direct-deposit processing are not enabled.
• Notifications: Send booking reminders, overdue invoice notifications, payment confirmations, system alerts, and quote-review notifications
• Email Quote Automation: Analyze connected-mailbox customer quote requests, match requests to company products/services, create draft estimates, and route them to an authorized user for review before customer delivery
• Customer Support: Respond to inquiries, troubleshoot issues, provide technical assistance
• Analytics & Improvement: Analyze usage patterns, identify trends, optimize features, improve user experience
• Activity Auditing: Track selected security-sensitive and business events for troubleshooting, security review, and audit support
• Fraud Prevention: Detect suspicious activity, prevent unauthorized access, protect against fraud
• Legal Compliance: Meet tax reporting requirements, comply with government requests, maintain records as required by law
• Multi-Company Management: Properly segregate and manage data across multiple companies under one account
• Security: Secure your account, verify authentication, monitor for breaches

4. Payment Processing

Card processing is not currently enabled in FlowPay. When card payments are introduced, FlowPay will use a dedicated payment processor so full card numbers and sensitive card data are not stored directly in FlowPay.

5. Sharing Your Information

We do not sell, trade, rent, or share your data with marketing or data brokers for advertising purposes. We may share your data only in these limited circumstances:

• Payment Processors: Card processing is not currently enabled. Any future processor integration will be disclosed here before production use.
• Cloud Infrastructure: Secure hosting providers store encrypted data with strict access controls.
• Essential Service Providers: Email delivery, file storage, analytics services under confidentiality agreements with data processing addendums.
• Legal Obligations: When required by law, court order, government authority, or to protect rights and safety.
• Business Transfers: In merger, acquisition, or asset sale, data transfers with privacy protections intact.
• Customer Portal Access: Limited customer information shared with your customers only for invoice viewing and payment.
• Employee Access Control: Only authorized company administrators can access employee and payroll data.
• Explicit Consent: Only with your written consent for any other purposes.

6. Data Retention & Deletion

Data retention varies by type:

• Active Account Data: Retained while your account is active
• Tax & Compliance Records: Retained for 7 years as required by tax law
• Payroll Records: Retained for 7 years (federal requirement)
• Activity Logs: Retained for 24 months for audit and security purposes
• Backup Data: Maintained for 30 days after deletion for recovery purposes
• Account Deletion: You may request complete account deletion. Upon request, we delete personal data (not tax-required records) within 30 days. Some information may persist in backups for 30 days.

7. Data Security & Protection

We implement comprehensive security measures:

• Encryption in Transit: TLS 1.2+ encryption for all data transmitted to/from servers
• Encryption at Rest: All sensitive data encrypted in database using industry-standard algorithms
• Access Controls: Role-based access control (admin, user, contractor). Employees only see their own data.
• Authentication: Individual authenticated user accounts, company memberships, role-based authorization, and session management
• Monitoring: Application and platform logging are used to investigate failures and security-relevant events; monitoring capabilities continue to be expanded
• Compliance: FlowPay is being hardened for production use. Specific regulatory or certification claims will only be listed after they are verified and applicable.
• Security Testing: Application security reviews, dependency checks, tenant-isolation testing, and targeted vulnerability testing are part of production-readiness work; independent penetration testing will be documented when completed
• Data Segregation: Company-owned records are logically separated using company identifiers and tenant-scoped authorization rules
• Operational Access: Administrative access to production data should be limited to authorized personnel and reviewed as FlowPay's operating team grows
• Incident Response: Incident-response and customer-notification procedures will be formalized before broad production rollout

While we maintain industry-standard security, no system is 100% secure. You are responsible for maintaining confidentiality of your login credentials.

8. Cookies & Tracking Technologies

We use the following types of cookies:

• Essential Cookies: Required for authentication, security, and core functionality (cannot be disabled)
• Session Cookies: Maintain your logged-in state during your visit
• Preference Cookies: Remember your settings and preferences
• Analytics Cookies: Track usage patterns to improve the platform
• Security Cookies: Prevent fraud and detect suspicious activities

You can disable non-essential cookies in your browser settings, but this may limit functionality. We do not use cross-site tracking or third-party advertising cookies.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request erasure of your personal data ("right to be forgotten").
• Portability: Request a machine-readable export of your data.
• Objection: Object to processing of your data for certain purposes.
• Withdrawal of Consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us at the details below.

10. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal data, we will take steps to delete such information promptly.

11. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing any personal information.

12. Specific Feature Privacy

12.1 Point of Sale (POS)

POS records may track payment method and transaction status, but card processing is not currently enabled inside FlowPay. Transaction activity may be logged for audit purposes.

12.2 Payroll Processing

Employee payroll data is highly sensitive. Bank account information is encrypted. Only authorized admins can access payroll records. Tax data is retained per legal requirements (7 years). Direct deposit information is never displayed in full on screens.

12.3 Multi-Company Management

Data from different companies is completely segregated. Users can only access companies they have been granted access to. Admin controls prevent unauthorized cross-company data access.

12.4 Customer Portal

Customers can view invoices via secure links. Only relevant invoice information is displayed. No access to internal business data, employee data, or other customer information.

12.5 Connected Work Email & Quote Automation

Connected mailbox access requires explicit user authorization. FlowPay is designed to process only the mailbox data needed for enabled workflows. Customer email content used for quote automation is treated as untrusted input; AI-generated estimates remain drafts until a permitted user reviews and approves them. FlowPay does not automatically send an AI-generated quote to a customer before approval.

12.6 Activity Logs

FlowPay records selected security-sensitive and business events with timestamps and user attribution where available. Retention periods and the final audit-event catalog will be formalized before broad production rollout.

13. Compliance & Standards

• Privacy requirements: Applicable privacy-law obligations will be reviewed before expanding into regulated jurisdictions.
• California privacy: Applicable CCPA/CPRA obligations will be evaluated based on FlowPay's operations and thresholds.
• Payment security: Card processing features remain disabled until a verified processor integration is implemented.
• Security assurance: FlowPay uses security controls provided by its hosting platform and app-specific hardening; FlowPay itself does not currently claim independent SOC 2 certification.
• State privacy laws: Applicable state privacy requirements will be addressed as FlowPay's customer footprint grows.
• Data Processing Addendums: Available for enterprise customers requiring DPA agreements

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email notification and/or a prominent notice on our website. The "Last updated" date at the top indicates the most recent revision. Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy.

15. Contact Us & Data Requests

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us: