FlowSync PM ('we', 'us', 'our') is committed to protecting your personal information. This Privacy Policy describes how we collect, use, disclose, and safeguard information when you use our project management platform. This policy applies to all users worldwide and complies with GDPR (EU), CCPA (California), and applicable US federal and Puerto Rico privacy requirements.
We collect: (a) Account information — name, email address, password (hashed), organization name; (b) Project data — tasks, risks, documents, and other content you input; (c) Usage data — pages visited, features used, timestamps, IP address, browser type; (d) Payment information — processed by Stripe; we do not store card numbers; (e) Communication data — emails and support messages. We do not collect sensitive personal data beyond what you voluntarily enter into project records.
We use your information to: provide and improve the Service; authenticate users and maintain security; process payments; send transactional emails (receipts, password resets, security alerts); send product updates (you may opt out); generate aggregate, anonymized analytics to improve the platform; provide customer support; comply with legal obligations.
When you use AI features (report generation, content analysis), your project data is sent to Anthropic's API to generate responses. Anthropic processes this data under their privacy policy. We do not use your project data to train AI models. AI-processed data is not retained by Anthropic beyond the request. For organizations handling regulated or sensitive personal data, we recommend reviewing Anthropic's enterprise data handling policies before using AI features.
Your data is stored on Supabase-managed PostgreSQL databases hosted on AWS in the United States. Files are stored on Supabase Storage (AWS S3). We implement AES-256 encryption at rest, TLS 1.3 in transit, regular security audits, access controls and audit logs, and automated backups with 30-day retention. No system is 100% secure; we encourage strong passwords and MFA.
We retain your data for as long as your account is active. After account deletion, we retain data for 30 days for export purposes, then permanently delete it. Audit logs and billing records may be retained for up to 7 years for legal and compliance purposes. Backup copies may persist for up to 90 days after deletion.
You have the right to: Access your personal data (export available in Settings); Correct inaccurate data; Delete your account and data; Port your data in machine-readable format; Restrict or object to processing; Withdraw consent at any time. California residents have additional rights under CCPA including the right to know, delete, and opt-out of sale (we do not sell personal data). EU/EEA users may lodge complaints with their local Data Protection Authority.
We use necessary cookies for authentication and session management, optional analytics cookies, and — on public marketing pages only — an advertising measurement cookie set by the Meta Pixel (see Section 9a). See our Cookie Policy for details. You may disable cookies in your browser settings, though this may affect Service functionality.
We use: Supabase (database/storage — US), Anthropic (AI processing — US), Stripe (payments — US), Vercel (hosting — US/global CDN), and Meta Platforms for advertising measurement on public marketing pages only (Section 9a). These providers have their own privacy policies. We do not sell personal data, and we never share the content of your projects with advertising networks or data brokers.
Our public marketing pages (landing, pricing, legal, and template pages) load the Meta (Facebook) Pixel to measure whether visits and sign-ups follow our advertising. The Pixel is never loaded inside the FlowSync PM application: once you sign in, no Meta tracking runs and none of your project data is shared with Meta. What Meta receives from marketing pages is limited to standard web events (such as page views and sign-up completion) plus technical data like IP address and browser information, processed under Meta's own privacy policy. You can limit this through browser settings, ad blockers, or Meta's Ads Preferences.
Your data may be transferred to and processed in the United States. For EU/EEA users, we rely on Standard Contractual Clauses (SCCs) as the legal mechanism for international data transfers.
FlowSync PM is not directed to individuals under 16. We do not knowingly collect personal information from children. If you believe a child has provided personal information, contact us at privacy@flowsyncpm.com.
Data Controller: FlowSync PM. Privacy questions: privacy@flowsyncpm.com. DPA requests: legal@flowsyncpm.com.