Privacy Policy

1. Introduction

FlowDesk is an independently operated software platform built for freelancers and creative studios. We respect your privacy and are committed to handling your personal information transparently, honestly, and responsibly.

This policy applies to information collected through the FlowDesk web application, freelancer workspaces, client portals, and related support channels.

2. Information We Collect

We collect only information that is necessary to provide, secure, and improve our services:

3. How We Use Information

We use the information we collect solely for legitimate product and operational purposes:

• Operating, maintaining, and delivering FlowDesk features and workspace tools.
• Authenticating your account and verifying authorized workspace access.
• Generating PDF invoices and managing client review portals.
• Dispatching transactional emails, including client invitation links, milestone notifications, and invoice payment reminders.
• Detecting, preventing, and addressing fraud, security threats, or unauthorized access attempts.
• Responding to your support requests, inquiries, and technical issues.

4. Payment Information

Subscription billing for paid FlowDesk tiers (Standard and Studio) is handled exclusively by Razorpay, an authorized and PCI-DSS Level 1 compliant payment aggregator.

When you subscribe, your payment details (credit card, debit card, UPI mandate, or net banking credentials) are entered directly into Razorpay's secure checkout interface. FlowDesk never receives, processes, or stores your full card details or banking credentials. Razorpay securely tokenizes your payment instrument and provides FlowDesk with an opaque subscription identifier for billing status management.

5. Information Sharing

FlowDesk does NOT sell, rent, or trade your personal information or your clients' information to any third party, advertiser, or data broker.

We share data only with trusted infrastructure providers strictly necessary to operate our service:

• Supabase: Provides managed database hosting, database encryption, and authentication services.
• Brevo: Provides transactional email delivery infrastructure for notifications, portal invitations, and payment reminders.
• Razorpay: Processes platform subscription checkout and recurring e-mandates.

In addition, client portal information (such as project milestones and invoices) is shared only with the specific clients you explicitly invite into that portal.

6. Data Storage and Security

FlowDesk implements industry-standard technical and operational safeguards to protect your personal data:

• Transport Security: All web traffic and API calls are encrypted in transit using modern HTTPS and TLS protocols.
• Database Encryption: Stored workspace metadata is protected by AES-256 encryption at rest.
• Multi-Tenant Isolation: We enforce Supabase Row Level Security (RLS) policies at the database layer to ensure that each workspace's data is strictly isolated from all other workspaces.
• Access Controls: Server-side authorization checks verify workspace ownership before any data read or mutation is processed.

Honest Security Disclosure: FlowDesk is operated as an independent software platform and does not claim unverified third-party certifications (such as ISO 27001 or SOC 2 Type II) that have not been formally audited by an accredited registrar. While we maintain rigorous, defense-in-depth security practices, no internet-transmitted or cloud-stored system can guarantee absolute 100% immunity from all potential vulnerabilities.

7. Data Retention and Deletion

We retain your account and workspace data for as long as your FlowDesk account remains active.

Account Deletion & 5-Day Grace Period: You can delete your account at any time from your settings (Settings > Security > Delete Account). Upon requesting deletion:

• Your account enters a 5-day recovery grace period during which public access is suspended, but you can cancel deletion simply by logging back in.
• If the deletion is not cancelled within 5 days, our automated deletion service permanently purges your account records, workspaces, clients, invoices, and uploaded branding assets from active databases.

8. Privacy Requests and Rights

You have direct control over your personal information:

• Access & Correction: You can review and update your name, email address, workspace settings, and invoice preferences directly in your FlowDesk dashboard.
• Data Export: You can export your clients, projects, and invoice records at any time.
• Account Deletion: You can initiate account deletion at any time from your settings or request manual assistance.

To submit a privacy inquiry, request data assistance, or withdraw consent, contact our support team at flowdesk11@gmail.com or use our support form at https://flowdesk-v1.vercel.app/contact?category=Privacy and Data Deletion. We acknowledge and process privacy requests within 2 business days.

9. Children’s Personal Data

FlowDesk is a business productivity tool intended for freelance professionals and creative service providers. We do not knowingly collect or solicit personal data from children under applicable statutory age limits.

If a parent or legal guardian discovers that their child has provided personal information to FlowDesk without appropriate parental consent, please contact us immediately at flowdesk11@gmail.com and we will take immediate steps to remove the information and terminate the account.

10. Cookies and Essential Technologies

FlowDesk uses only essential cookies and local storage technologies strictly required to operate the platform:

• Session & Auth Tokens: Secure HTTP cookies and local storage keys to maintain your authenticated login session.
• UI State: Local browser storage to remember your workspace interface preferences (such as collapsed sidebars or table filters).

We do not use third-party advertising cookies, cross-site behavior trackers, or programmatic ad pixels.

11. Policy Changes and Contact

We may update this Privacy Policy periodically to reflect improvements to our software or changes in legal standards. When changes occur, the updated policy will be published on this page with an updated "Last Updated" date.