Privacy Policy

We collect the following categories of information:

• To provide, operate, maintain, and improve the Service
• To process payments and manage subscriptions via Stripe
• To authenticate your identity and manage your account
• To send transactional emails (account confirmation, password reset, billing receipts, team invitations)
• To measure product usage and improve the Service through analytics
• To detect and prevent fraud, abuse, and security threats
• To enforce our Terms of Service
• To comply with legal obligations

We use the following third-party services that may process your data as part of providing the Service:

We are not responsible for the privacy practices or security of these third-party services. We encourage you to review their respective privacy policies.

We may share your information only in these circumstances:

• Service providers: With the sub-processors listed above, solely to provide the Service.
• Legal compliance: When required by law, subpoena, court order, or governmental request.
• Safety: To protect the rights, property, or safety of QodFlow, our users, or the public.
• Business transfers: In connection with a merger, acquisition, or sale of assets. You will be notified via email before your data is transferred to a new entity.
• With your consent: In any other case, only with your explicit consent.

• Your data is stored on servers in the United States (AWS infrastructure via Neon and Vercel).
• We implement industry-standard security measures including: HTTPS/TLS encryption in transit, bcrypt password hashing, secure JWT session management, and role-based access controls.

• Active accounts: Data is retained as long as your account is active.
• Deleted accounts: All personal data and workspace content is permanently and irreversibly deleted, except as listed below. We cannot recover deleted data.
• Billing records: May be retained for up to 7 years to comply with financial and tax regulations.
• Free-trial abuse prevention: If you start a free trial, we keep a one-way cryptographic hash of your email address for 12 months, then delete it automatically. We do not keep the address itself, and the hash cannot be reversed to recover it. Its only use is to check whether an address has already used its one free trial, so that deleting and re-creating an account cannot be used to claim unlimited trials.
• Server logs: Retained for up to 90 days for security and debugging purposes.
• Anonymized data: Aggregated, non-personally-identifiable usage data may be retained indefinitely for analytics and product improvement.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Update or correct inaccurate data via your account settings.
• Deletion: Delete your account and all associated data from account settings.
• Portability: Download a JSON export of your profile and the workspaces you own (stages, tags, jobs) yourself from Settings → Profile → “Export my data (JSON)”. For any other request, email hello@qodflow.com.
• Opt-out of analytics: Disable analytics cookies via your browser settings or a cookie-blocking extension.
• Non-discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, contact us at hello@qodflow.com. We will respond within 30 days (or sooner if required by applicable law).

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (as amended by the CPRA):

• Right to know: What personal information we collect, use, and disclose.
• Right to delete: Request deletion of your personal information.
• Right to opt-out of sale/sharing: We do not sell personal information for cash. We do use Google Analytics and the Meta Pixel for measurement and ad attribution, which may qualify as “sharing for cross-context behavioral advertising” under CPRA. To opt out: enable the Global Privacy Control (GPC) signal in your browser, or email hello@qodflow.com with subject “Opt out of sharing.”
• Right to non-discrimination: We will not deny you services or charge different prices for exercising your CCPA rights.

To submit a verifiable consumer request, email hello@qodflow.com.

If you are located in the European Economic Area (EEA) or United Kingdom:

• Legal basis: We process your data based on: contract performance (providing the Service), legitimate interest (security, fraud prevention, analytics), and your consent (marketing cookies).
• Additional rights: You have the right to restriction of processing, objection to processing, and the right to lodge a complaint with your local supervisory authority.
• Data transfers: Your data is transferred to and processed in the United States. By using the Service, you consent to this transfer. We rely on Standard Contractual Clauses (SCCs) where applicable.
• Data Processing Agreement: If your organization requires a DPA, contact us at hello@qodflow.com.

The Service is operated from the United States. If you access the Service from outside the US, your data will be transferred to and processed in the United States, which may have different data protection laws than your country of residence. By using the Service, you consent to this transfer.

QodFlow is not directed at children under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that a child under 18 has provided us with personal data, we will take steps to delete such information promptly. If you believe a child has provided us with data, please contact us.

In the event of a confirmed security incident that affects your personal information, we will notify affected account-owner emails on file without undue delay and in any event within seventy-two (72) hours of confirmation, as required by California Civil Code §1798.82 (CCPA), GDPR Article 33, UK GDPR, and other applicable laws. Where required by law, we will also notify the appropriate regulator within the timeframe that law specifies.

The notification will include: the nature of the incident, the categories and approximate number of data records affected, the steps we are taking to mitigate the incident, and recommended actions for you. We will publish updates on our status page as remediation progresses.

This commitment mirrors and is consistent with QodFlow’s Terms of Service §16 (Data Loss and Backups). In the event of any inconsistency between this Privacy Policy and the Terms of Service on breach notification, the longer protection applies.

We honor the Global Privacy Control (GPC) signal: when your browser sends it, or when you opt out, Google Analytics, Google Ads and Meta Pixel scripts are not loaded, advertising click identifiers are not stored, and no pixels or server-side conversion events are sent. Outside the EEA, UK and Switzerland, the first-party campaign-source cookie (qodflow_src) may still be set; it contains no advertising identifiers and is never shared with advertising platforms. Vercel's cookieless performance metrics (Vercel Analytics and Speed Insights), which store no personal data and set no cookies, continue to run. We do not respond to the older “Do Not Track” (DNT) header. You can also opt out through the cookie banner, the control in Section 1, or by disabling cookies in your browser.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notice at least 14 days before they take effect. The “Last updated” date at the top of this page reflects the most recent revision. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

For privacy-related questions or to exercise your data rights, contact us at: