Privacy Policy

1. Who we are

Flowboard is operated by Harbor Software LLC, a Wyoming limited liability company. The registered address is 1309 Coffeen Avenue, STE 1200, Sheridan, Wyoming 82801, USA. Harbor Software LLC is the data controller for the personal data described in this policy. In this policy, "we" and "us" mean Harbor Software LLC. Privacy questions go to privacy@flowboardhq.com.

2. Scope

This policy covers the Flowboard website at flowboardhq.com and the Flowboard application at app.flowboardhq.com. It applies to two kinds of account. A team member is a paid internal account inside a workspace. A client user is an external account that a workspace invites into its client portal. The policy also applies to visitors who browse the website without signing in.

3. Information we collect

Account details. Name, email address, workspace name, and role, provided when a team member signs up.

Client user accounts. When a workspace invites a client user, we store that name and email address together with the sign-in credentials for the portal. A client user signs in with a magic link sent by email, or with a password. Client logins are stored separately from team member accounts.

Workspace content. Projects, tasks, time entries, invoices, client records, documents, comments, and uploaded files that a workspace puts into Flowboard. That content belongs to the workspace.

Billing. Payments are processed by Stripe. Card details are entered on a Stripe hosted payment page. We store a Stripe customer reference, invoice records, and payment status. We do not receive or store card numbers.

Server logs. Our hosting and storage providers record standard request logs. Those logs contain IP address, browser type and version, the pages or endpoints requested, and timestamps.

Connected accounts. If a team member connects a Google Calendar, we store the access token for that connection.

Support correspondence. The emails you send us and the contents of those emails.

4. How we use information

Account details are used to create workspaces and to authenticate sign-ins. Workspace content is used to provide the features a workspace asks for. Billing data is used to charge for subscriptions and to issue invoices. Email addresses are used for transactional messages such as invoices, password resets, and magic-link sign-in emails. Server logs are used to operate the service, to diagnose faults, to investigate abuse, and to improve the service. Support correspondence is used to answer the request it relates to.

We analyze how the service is used and how it performs, in order to maintain and improve it. Anything we publish or share from that analysis is aggregated and does not identify you, your team members, your client users, or your clients. The corresponding contractual right is stated in section 4.3 of the terms of service.

We do not sell personal data. We do not share it with advertisers. We do not use it to train AI models. We do not sell workspace content, use it for advertising of any kind, train AI models on it, or monetize it in any way.

5. Cookies

The application sets first-party cookies for authentication and session management. Signing in does not work without them.

The website sets first-party interface preference cookies. One example is the announcement bar. Dismissing it stores a cookie named flowboard-announcement-dismissed for 30 days, with SameSite set to Lax, so the bar stays dismissed on your next visit.

We set no advertising cookies and no cross-site tracking cookies.

6. Who we share it with

We use a small set of subprocessors, each of which receives only the data needed for its role and processes it on our instructions: Clerk for team member authentication, Stripe for payments and invoicing, Vercel for application and website hosting, and Cloudflare for file storage.

This page holds the current list. It is updated here when the list changes. We also disclose data where the law requires it.

7. How we protect it

Traffic between your browser and Flowboard is encrypted in transit over HTTPS, with TLS 1.3 supported.

Team member accounts and client logins are separate identities. Client logins live in their own store, keyed to the client record, not in the workspace member table.

The client portal shows only tasks that a workspace marks as client-visible or client-editable, and only comments marked client-visible. Cost rates are returned to Owner and Admin roles only.

Google Calendar tokens are stored encrypted at rest with Fernet symmetric encryption, not in plaintext. Backups are retained for up to 30 days.

A workspace audit log records created, updated, deleted, status-changed, and visibility-changed events, and is readable by Owner and Admin roles.

No service is perfectly secure, and we hold no security certifications. Our security page states what Flowboard does not have.

8. Data retention

We keep workspace data for as long as the account is active. When an account is deleted, the associated data is permanently deleted within 30 days. Backups are retained for up to 30 days, so data can persist in a backup during that window before it ages out.

9. Your rights

You can request access to the personal data we hold, an export of your data, correction of inaccurate data, and deletion of your data. A team member can also run an export from inside the application. The export runs as a job and produces a download link that is valid for 24 hours.

Send requests to privacy@flowboardhq.com. A client user should contact the workspace that issued the portal login first, because that workspace controls the content shown there. You can write to us as well.

10. Where data is processed

Flowboard is operated from the United States, and the subprocessors listed above process data there. If you use Flowboard from another country, your data is transferred to the United States for processing.

11. Children

Flowboard is not directed to anyone under the age of 16. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this policy. The date at the top of this page changes when we do. We notify team members by email of material changes. Continued use of the service after a change constitutes acceptance.

13. Contact

Harbor Software LLC, 1309 Coffeen Avenue, STE 1200, Sheridan, Wyoming 82801, USA. Email privacy@flowboardhq.com.