Privacy Policy

We collect the following categories of information:

• To provide, operate, maintain, and improve the Service
• To process payments and manage subscriptions via Stripe
• To authenticate your identity and manage your account
• To send transactional emails (account confirmation, password reset, billing receipts, team invitations)
• To measure product usage and improve the Service through analytics
• To detect and prevent fraud, abuse, and security threats
• To enforce our Terms of Service
• To comply with legal obligations

We use the following third-party services that may process your data as part of providing the Service:

We are not responsible for the privacy practices or security of these third-party services. We encourage you to review their respective privacy policies.

We may share your information only in these circumstances:

• Service providers: With the sub-processors listed above, solely to provide the Service.
• Legal compliance: When required by law, subpoena, court order, or governmental request.
• Safety: To protect the rights, property, or safety of QodFlow, our users, or the public.
• Business transfers: In connection with a merger, acquisition, or sale of assets. You will be notified via email before your data is transferred to a new entity.
• With your consent: In any other case, only with your explicit consent.

• Your data is stored on servers in the United States (AWS infrastructure via Neon and Vercel).
• We implement industry-standard security measures including: HTTPS/TLS encryption in transit, bcrypt password hashing, secure JWT session management, and role-based access controls.

• Active accounts: Data is retained as long as your account is active.
• Deleted accounts: All personal data and workspace content is permanently and irreversibly deleted. We cannot recover deleted data.
• Billing records: May be retained for up to 7 years to comply with financial and tax regulations.
• Server logs: Retained for up to 90 days for security and debugging purposes.
• Anonymized data: Aggregated, non-personally-identifiable usage data may be retained indefinitely for analytics and product improvement.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Update or correct inaccurate data via your account settings.
• Deletion: Delete your account and all associated data from account settings.
• Portability: Request your data in a machine-readable format.
• Opt-out of analytics: Disable analytics cookies via your browser settings or a cookie-blocking extension.
• Non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, contact us at support@qodflow.com. We will respond within 30 days (or sooner if required by applicable law).

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (as amended by the CPRA):

• Right to know: What personal information we collect, use, and disclose.
• Right to delete: Request deletion of your personal information.
• Right to opt-out of sale: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.
• Right to non-discrimination: We will not deny you services or charge different prices for exercising your CCPA rights.

To submit a verifiable consumer request, email support@qodflow.com.

If you are located in the European Economic Area (EEA) or United Kingdom:

• Legal basis: We process your data based on: contract performance (providing the Service), legitimate interest (security, fraud prevention, analytics), and your consent (marketing cookies).
• Additional rights: You have the right to restriction of processing, objection to processing, and the right to lodge a complaint with your local supervisory authority.
• Data transfers: Your data is transferred to and processed in the United States. By using the Service, you consent to this transfer. We rely on Standard Contractual Clauses (SCCs) where applicable.
• Data Processing Agreement: If your organization requires a DPA, contact us at support@qodflow.com.

The Service is operated from the United States. If you access the Service from outside the US, your data will be transferred to and processed in the United States, which may have different data protection laws than your country of residence. By using the Service, you consent to this transfer.

QodFlow is not directed at children under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that a child under 16 has provided us with personal data, we will take steps to delete such information promptly. If you believe a child has provided us with data, please contact us.

In the event of a confirmed security incident that affects your personal information, we will notify affected account-owner emails on file without undue delay and in any event within seventy-two (72) hours of confirmation, as required by California Civil Code §1798.82 (CCPA), GDPR Article 33, UK GDPR, and other applicable laws. Where required by law, we will also notify the appropriate regulator within the timeframe that law specifies.

The notification will include: the nature of the incident, the categories and approximate number of data records affected, the steps we are taking to mitigate the incident, and recommended actions for you. We will publish updates on our status page as remediation progresses.

This commitment mirrors and is consistent with QodFlow’s Terms of Service §16 (Data Loss and Backups). In the event of any inconsistency between this Privacy Policy and the Terms of Service on breach notification, the longer protection applies.

Some browsers transmit “Do Not Track” (DNT) signals. We currently do not respond to DNT signals. However, you can opt out of analytics tracking by disabling cookies in your browser settings.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notice at least 14 days before they take effect. The “Last updated” date at the top of this page reflects the most recent revision. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

For privacy-related questions or to exercise your data rights, contact us at: