Privacy Policy

ProjectFlow is a multi-tenant platform. Understanding our role with respect to your data matters:

• When you register directly with ProjectFlow (for example, as an engineering firm subscribing to the platform), ProjectFlow acts as the data controller of your account and billing information.
• When an engineering firm (our “Tenant”) uses ProjectFlow to manage its own clients, projects, estimates, and invoices, that firm is the data controller of its clients’ information, and ProjectFlow acts as a data processor (or “service provider” under California law) on the firm’s behalf. We process that information only according to our Tenants’ instructions and our agreements with them.

If you are a client of an engineering firm that uses ProjectFlow, questions about how your information is handled should first be directed to that firm.

Information you provide to us:

• Account information: name, email address, company name, phone number, password, and role (e.g., administrator, team member, client).
• Business and project data: project details, estimates, invoices, milestone and phase billing records, uploaded documents, and communications entered into the platform by you or your firm.
• Digital signatures: signature data and associated timestamps when you approve estimates or invoices through the platform.
• Payment information: when you pay a subscription or an invoice through the platform, payment is processed by our payment processor, Stripe, Inc. For ACH (bank account) payments, your bank account and routing numbers are collected and stored directly by Stripe — ProjectFlow never stores your full bank account or card numbers on our servers. We receive limited information from Stripe such as payment status, the last four digits of the account, and transaction identifiers. Stripe’s privacy policy is available at https://stripe.com/privacy.
• ACH authorization records: when you authorize an ACH debit, we and Stripe retain records of your authorization (including date, amount, and consent) as required by the Nacha Operating Rules, for at least two (2) years following the final payment under that authorization.
• Communications: information you provide when you contact support or respond to surveys.

Information collected automatically:

• Usage and device data: IP address, browser type, operating system, device identifiers, pages viewed, features used, and timestamps.
• Cookies and similar technologies: we use cookies necessary for authentication, security, and session management, and analytics cookies to understand how the Services are used. See Section 8 (Cookies and Tracking).

Information from third-party integrations:

• Google Calendar: if you choose to connect your Google account, we access your Google Calendar data (with your consent via Google OAuth) solely to display and sync scheduling information within the platform. You may disconnect this integration at any time in your account settings or via your Google account permissions. ProjectFlow’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, and we do not sell it or transfer it to third parties except as necessary to provide the calendar features you request.

We use personal information to:

• Provide, operate, maintain, and improve the Services;
• Create and manage accounts, tenants, and team member invitations;
• Process subscription payments, invoices, and ACH/card transactions through Stripe;
• Facilitate estimate approvals, digital signatures, and milestone/phase billing;
• Sync calendar events when you enable the Google Calendar integration;
• Send transactional communications (receipts, payment confirmations, account notices, security alerts);
• Provide customer support;
• Monitor for fraud, abuse, and security threats, and comply with the Nacha Operating Rules and other payment network requirements;
• Comply with legal obligations; and
• Analyze usage to improve platform performance and features.

AI and model training disclosure: ProjectFlow does not collect, use, or sell your personal information to train large language models (LLMs) or other artificial intelligence models.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We disclose personal information only in the following circumstances:

• Service providers / subprocessors: companies that help us operate the Services, including Stripe (payment processing and ACH transactions), Base44 (application hosting and infrastructure), Google (calendar integration, only when you enable it), and email delivery providers. These providers are contractually limited to using your information only to provide services to us.
• Within your organization: account information and project data are visible to other authorized users within your firm’s tenant (for example, administrators and invited team members), according to permission settings.
• Between Tenants and their clients: if you are a client of a firm using ProjectFlow, your project information is shared with that firm as the controller of your data.
• Legal compliance: when required by law, subpoena, or legal process, or to protect the rights, safety, or property of ProjectFlow, our users, or others.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy.

Depending on your state of residence (including California, Colorado, Connecticut, Texas, Virginia, and other states with comprehensive privacy laws), you may have the right to:

• Know / Access: request confirmation of whether we process your personal information and obtain a copy of it;
• Correct: request correction of inaccurate personal information;
• Delete: request deletion of your personal information, subject to legal retention requirements (for example, ACH authorization records we must retain under Nacha rules and tax/accounting records);
• Portability: obtain your personal information in a portable, machine-readable format;
• Opt out: opt out of the sale of personal information, sharing for targeted advertising, and certain profiling. (Note: ProjectFlow does not sell personal information or engage in targeted advertising.)
• Non-discrimination: exercise these rights without discriminatory treatment;
• Appeal: if we decline a request, appeal that decision by replying to our response.

How to exercise your rights: email us at s.customer78@yahoo.com with the subject line “Privacy Request.” We will verify your identity (typically by confirming control of the email address associated with your account) and respond within 45 days, with a possible 45-day extension where permitted by law.

If your data was submitted to ProjectFlow by an engineering firm (our Tenant), we may direct your request to that firm, or notify them of your request, as they are the controller of that information.

California residents: you have the rights described above under the California Consumer Privacy Act (CCPA/CPRA). We do not sell or share personal information as defined by the CCPA, and we have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for purposes requiring a right to limit.

Our website recognizes the Global Privacy Control browser signal. Because we do not sell personal information or share it for targeted advertising, a GPC signal does not change our data practices; however, we treat GPC signals as a valid opt-out of any sale or sharing of personal information as required by applicable state laws.

We retain personal information for as long as your account is active or as needed to provide the Services, and afterward as necessary to:

• Comply with legal, tax, and accounting obligations;
• Retain ACH authorization records for at least two (2) years after the final payment, as required by the Nacha Operating Rules;
• Resolve disputes and enforce our agreements.

When information is no longer needed, we delete or de-identify it. Tenants may request deletion of their tenant data upon account termination, subject to the retention requirements above.

We use:

• Strictly necessary cookies for login sessions, authentication, and security (these cannot be disabled);
• Functional cookies to remember your preferences;
• Analytics cookies to understand aggregate usage of the Services.

You can manage cookies through your browser settings. We do not use third-party advertising cookies and do not respond to “Do Not Track” signals other than the Global Privacy Control as described in Section 6.

We use reasonable administrative, technical, and physical safeguards to protect personal information, including encryption in transit (TLS/HTTPS), access controls, and role-based permissions within tenants. Bank account numbers used for ACH payments are collected, tokenized, and stored by Stripe — not by ProjectFlow — consistent with the Nacha data security requirements for protecting account information. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at s.customer78@yahoo.com.

The Services are intended for business use by adults. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, contact us and we will delete it.

The Services are operated from the United States and are intended for users in the United States. If you access the Services from outside the U.S., you understand that your information will be transferred to and processed in the United States.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a prominent notice within the Services before the changes take effect, and we will update the “Last Updated” date above. Your continued use of the Services after changes take effect constitutes acceptance of the updated policy.

For privacy questions or to exercise your rights:

ProjectFlow — Privacy
Email: s.customer78@yahoo.com
Subject line: “Privacy Request”