Last updated: September 24, 2026
1. Summary
This Privacy Policy explains how Harbor Software LLC handles personal data in connection with Flowboard. The main points are these:
- We are the controller of the personal data we need to run our business: account, billing, website, support and marketing data, and records of how the Service is used and kept secure.
- The data our customers put into their workspaces, including information about their own clients, belongs to them. We process it on their instructions under our Data Processing Addendum.
- We do not sell personal data, share it for cross-context behavioral advertising, use it for advertising of any kind, or use it to train artificial intelligence models.
- The Flowboard database runs in the Netherlands, in the European Union, and uploaded files and exports are stored in Cloudflare's Asia-Pacific region. Some of our service providers process data in the United States, and our personnel and contractors work from Pakistan.
- You can ask us to access, correct, delete or export your personal data by emailing privacy@flowboardhq.com.
This summary is for convenience. The numbered sections below govern.
2. Who we are and how to contact us
Flowboard is operated by Harbor Software LLC, a Wyoming limited liability company, at 1309 Coffeen Avenue, STE 1200, Sheridan, Wyoming 82801, USA. In this policy, "Harbor", "we" and "us" mean Harbor Software LLC.
Our privacy contact is privacy@flowboardhq.com. Use it for questions about this policy and for the requests described in sections 13 to 15. For help with an account, write to support@flowboardhq.com. Legal notices go to legal@flowboardhq.com, and suspected vulnerabilities or security incidents go to security@flowboardhq.com.
3. Our two roles: controller and processor
3.1 Where we are the controller
We decide why and how the following personal data is processed, so we are its controller under the EU General Data Protection Regulation and the UK General Data Protection Regulation (together, "GDPR"), and a business under the US state privacy laws that apply to us:
- account data of team members, such as name, email address and workspace role;
- billing data for Flowboard subscriptions;
- data about visitors to our website, status page and feedback portal;
- support requests and other messages you send us;
- data we use to tell business customers and prospects about Flowboard; and
- records of how the Service is used, secured and performs, such as sign-in records, operational logs, error reports and product analytics.
3.2 Where we are a processor for our customers
A "Customer" is the business that holds a Flowboard subscription and accepted the Terms of Service. "Customer Content" means the data that a Customer, its team members and its client users put into the Service, including data collected through the client portal and through the forms, booking pages and proposal pages that a Customer publishes. Each Customer is the controller of the personal data in its Customer Content. We process that data as the Customer's processor, and as its service provider under US state privacy laws, only on its instructions and under the Data Processing Addendum (the "DPA"). The Customer's own privacy notice governs how the Customer uses that data.
For example, when an agency invites its client into the client portal, emails that client an invoice or receives a booking from a member of the public, the agency decides what data to collect and why. This policy still describes that data, so that the people it concerns can see what the Service does with it. Section 14 explains where to send a request about Customer Content.
4. What this policy covers
This policy applies to:
- the Flowboard application at app.flowboardhq.com, including the client portal;
- the public pages that workspaces publish through the application, such as forms, booking pages and proposal pages;
- our website at flowboardhq.com;
- our status page at status.flowboardhq.com and our feedback portal at feedback.flowboardhq.com, from the time we operate them; and
- the emails we send and the support we provide.
Together we call these the "Service". A "team member" is a user account inside a workspace. A "client user" is an external person whom a workspace invites into its client portal. This policy does not cover third-party websites or services that the Service links to or that a Customer connects to it. They have their own policies.
5. Personal data we collect and where it comes from
5.1 Data you give us
- Account details. When you sign up, or accept an invitation as a team member, we collect your name, email address and, if you add one, a profile image. Your sign-in credentials are held by our authentication provider, Clerk. Flowboard does not store team member passwords.
- Billing details. For a subscription we collect the billing contact, the plan, the number of paid team members and the billing period. You enter card details on payment forms provided by Stripe. We receive a Stripe customer reference, subscription and invoice records and payment status, and we never receive or store full card numbers.
- Messages. The content of emails you send to our support, privacy, legal, security or general addresses, and anything you attach.
- Feedback and status subscriptions. From the time we operate them, your name, email address and the posts, votes and comments you add in our feedback portal, and the email address you use to subscribe to status updates.
5.2 Data in workspaces
Customers and their team members put information into workspaces that can include personal data about the following people. This data is Customer Content.
- Team members: workspace role, billable and cost rates, time entries, and the tasks, comments, messages, documents and files they create.
- A Customer's clients and prospects: client names, contact names and billing email addresses, and CRM records such as names, email addresses, phone numbers, job titles, notes and deal activity.
- Client users: name and email address, a portal password stored only as a one-way hash if the client user sets one, sign-in links and sessions, and when the client user last signed in.
- Form submitters: the answers and files submitted through a public form, the name and email address given, and the IP address of the submission.
- Booking invitees: name, email address, time zone, notes and answers given when booking, a link for cancelling the booking, and the IP address of the booking.
- Proposal signers: the signer's name and email address, the signature image and how it was made, the time of signing, the IP address and browser details at signing, and when the proposal was viewed.
- Invoice recipients: name, billing email address, and the invoice details a workspace sends by email, such as line items, amounts and due dates.
- Anyone named in workspace content: the names and details that a workspace writes into tasks, documents, messages, comments and files.
The Service also keeps records that go with this content: a workspace audit log of changes to certain records, in-app notifications, a record of each email sent (recipient, template and subject), and the browser push subscriptions of team members who turn on push notifications.
5.3 Data collected automatically
- Request and device data. Our hosting and network providers record the IP address, browser type and version, the pages or endpoints requested and the time of each request. Our own operational logs record the method, path, status and duration of each API request, and some log lines record an email address, for example when an email is sent.
- Error reports. When the API or its background jobs fail, an error report goes to Sentry. It can include request details, user identifiers and an IP address.
- Product analytics. In the application, PostHog records the pages you view, named product events and performance measurements. For a signed-in team member, these records are linked to your account identifier and email address. Product analytics does not run on client portal pages or on the forms, booking pages and proposal pages that workspaces publish. For team members in the European Economic Area and the United Kingdom, it runs only after they consent, as section 12 describes.
- Bot protection. At sign-up and sign-in, Clerk uses Cloudflare Turnstile to check whether a request comes from a person or an automated tool.
- Browser storage. The application and the website store some items in your browser, as section 12 and our Cookie and Similar Technologies Notice describe.
5.4 Data from third parties
- Clerk provides your account and session details, including your name, email address and profile image if you sign in with a Google account.
- Stripe tells us the status of subscriptions and payments.
- Google Calendar, if a team member connects it, provides the email address of the connected account and the free and busy times on that calendar.
- Import sources. When a Customer imports from ClickUp, Asana or Trello, we read the data it chooses to import, using the token or file it provides.
- Your workspace. An Owner or Admin who invites you provides your name, email address and role. A workspace that invites a client user provides that person's name and email address.
5.5 What you must provide
You must give us account details to use the Service, and billing details to hold a paid subscription. We cannot provide the Service without them. Everything else is optional or depends on how your workspace uses the Service.
6. How we use personal data and our legal bases
The table below covers the personal data we control. For Customer Content, we process personal data only to provide the Service to the Customer and on its instructions, and the Customer determines the legal basis for that processing.
| Purpose | Personal data used | Legal basis under GDPR Art. 6(1) | Legitimate interest, where relied on |
|---|---|---|---|
| Create and run accounts and workspaces, and sign you in | Account details, sign-in and session data | Contract (b) where you are the Customer; legitimate interests (f) otherwise | Providing the accounts a Customer asks for to its team members |
| Send the emails the Service needs, such as invitations, notifications, sign-in links and export notices | Name, email address, message content | Contract (b); legitimate interests (f) | Operating the features our Customers use |
| Bill subscriptions, take payment, and send reminders before a first charge and before an annual renewal | Billing details, subscription and payment records | Contract (b); legal obligation (c) for tax and accounting records | Not relied on |
| Answer support requests, feedback and other messages | Messages, account details | Contract (b) where the message concerns your account; legitimate interests (f) otherwise | Responding to people who contact us |
| Keep the Service secure, prevent fraud and abuse, and enforce our Terms of Service and Acceptable Use Policy | Request and device data, sign-in records, logs, bot protection results | Legitimate interests (f); legal obligation (c) where the law requires it | Protecting the Service, our Customers and their users |
| Find and fix errors | Error reports, operational logs | Legitimate interests (f) | Keeping the Service working |
| Understand how the application is used, so we can improve it | Product analytics | Consent (a) for team members in the European Economic Area and the United Kingdom; legitimate interests (f) elsewhere | Improving the Service based on how it is used |
| Run the website and count visits without cookies | Request data | Legitimate interests (f) | Operating our website and learning which pages are useful |
| Tell Customers and prospects about Flowboard | Name, email address, workspace or company name | Legitimate interests (f) for existing Customers; consent (a) where the law requires it | Informing business customers about the Service they use |
| Create aggregated or deidentified statistics about use of the Service | Product analytics, operational logs | Legitimate interests (f) | Measuring and improving the Service |
| Comply with the law, respond to lawful requests, and establish, exercise or defend legal claims | Any personal data relevant to the matter | Legal obligation (c); legitimate interests (f) | Protecting our legal rights and those of others |
| Prepare for and complete a merger, acquisition, financing or sale of assets | Any personal data relevant to the transaction | Legitimate interests (f) | Continuing the Service under new ownership |
Where we rely on legitimate interests, we have weighed them against your interests and rights, and you can object as section 13 describes. Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing that took place before it. Every marketing email includes a way to unsubscribe.
We do not make decisions about anyone based solely on automated processing that produce legal or similarly significant effects.
Section 4.3 of the Terms of Service allows us to analyze how the Service is used. Where we create aggregated or deidentified information from that analysis, we keep it in that form and do not attempt to reidentify it, and anything we publish or share from it does not identify you, your team members, your client users or your clients.
7. AI features
Flowboard offers optional AI search and compose features. They are off in every workspace until an Owner or Admin saves an API key for the workspace's own OpenRouter account. Once a key is saved, any team member who can use search or compose can use them, and Flowboard sends the following to OpenRouter:
- for AI search, the search query;
- for compose parsing, the typed text plus the name and internal identifier of every client and every active project in the workspace; and
- for compose drafts, the typed description plus the names and internal identifiers of up to 100 active team members.
OpenRouter passes each request to the model that Flowboard requests, currently Google Gemini 2.0 Flash. Flowboard writes each request: it adds its own fixed instructions and the workspace names listed above, and it chooses the model. The Customer decides whether any request is sent, by saving or removing its key, and the requests run on the Customer's own OpenRouter account, so the terms of OpenRouter and of the model provider govern what happens to the data after it leaves Flowboard. For that reason we treat them as third parties that the Customer engages directly, not as our sub-processors. Flowboard does not write the text it sends to its database or to its logs. We do not use Customer Content, or anything sent to or returned by these features, to train artificial intelligence models. The AI Features Addendum sets out the full terms.
8. How we share personal data
8.1 Service providers
We use service providers for hosting, network delivery, file storage, authentication, payments, email, error monitoring, product analytics, our status page and feedback portal, and our own email accounts, and an affiliated company in Pakistan provides contractors who help us operate and support the Service. Each receives only the personal data it needs for its function, processes it on our instructions under a written agreement that includes data protection terms, and may not use it for its own purposes. The providers that process Customer Content are our sub-processors. The sub-processor page lists each one with its purpose, the data it receives and its location. We give Customers at least 30 days' notice before a new sub-processor processes their personal data, as that page explains. We also share data with our professional advisers, such as lawyers and accountants, where they need it to advise us and under a duty of confidentiality.
8.2 Integrations a Customer turns on
Some data leaves the Service because a Customer or one of its team members directs it:
- the AI features, through the Customer's own OpenRouter account, as section 7 describes;
- Google Calendar, which checks a team member's availability and receives booking invitees' names, email addresses and notes as event details on that team member's calendar;
- webhook endpoints that a workspace configures, which receive the event data the workspace subscribes to;
- import sources such as ClickUp, Asana and Trello, from which we read data using the Customer's own token or file; and
- browser push services run by browser vendors such as Google, Mozilla, Apple and Microsoft, which deliver the notifications a team member turns on.
These recipients process data under their own terms. The sub-processor page lists the AI features, browser push services and webhook endpoints separately from our sub-processors. When a team member connects Google Calendar, Flowboard's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
8.3 Inside a workspace and on public pages
Data in a workspace is visible to its team members according to their roles and permissions, and a workspace's Owners and Admins can see its members' account details and activity in it. Client users see only what the workspace marks as visible to them. Anyone who has the link to a public form, booking page or proposal page can open it.
8.4 Legal requests
We disclose personal data to a law enforcement agency, court, regulator or other government body only where the law requires it and in response to valid legal process, or where we believe in good faith that disclosure is needed to prevent death or serious physical harm. Our Government Data Requests policy explains how we respond, including when we notify the Customer concerned. We may also use or disclose personal data where that is needed to establish, exercise or defend legal claims, or to enforce our Terms of Service.
8.5 Business transfers
If Harbor is involved in a merger, acquisition, financing, reorganization or sale of all or part of its business, personal data may pass to the other party as part of that transaction, subject to this policy or to protections at least as strong. We will tell affected Customers before their data becomes subject to a different privacy policy.
8.6 No sale and no advertising
We do not sell personal data, and we do not share it for cross-context behavioral advertising. We do not disclose personal data to third parties for their own direct marketing.
9. International transfers
The Flowboard database, the background jobs that work on it and the cache run on Railway in the Netherlands, in the European Union. Requests to the API pass through Cloudflare's global network, and Cloudflare stores uploaded files and export archives in its Asia-Pacific region. Harbor is a United States company, and several of our service providers are established in the United States and process personal data there, as the sub-processor page shows. Our personnel and contractors who operate and support the Service work from Pakistan, and can access personal data from there where their role requires it, under confidentiality obligations.
Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country that has not been found to provide an adequate level of protection, we use the Standard Contractual Clauses approved by the European Commission, together with the UK International Data Transfer Addendum for data from the United Kingdom and the changes Swiss law requires for data from Switzerland. For Customer Content, these safeguards are part of the DPA and of our agreements with our sub-processors. For the personal data we control, we put the same safeguards in place with the providers that receive it. You can ask for a copy of the relevant safeguards at privacy@flowboardhq.com.
10. How long we keep personal data
We keep personal data only for as long as we need it for the purposes in section 6 or as the law requires, and then we delete it or make it anonymous.
| Data | How long we keep it |
|---|---|
| Team member account details | While you are a member of a workspace and the workspace exists. When you delete your Flowboard sign-in account, we remove or anonymize your user record and your memberships. Content you created in a workspace stays with that workspace, because it is the Customer's. |
| Customer Content in an active workspace | Until the Customer deletes it. Most records deleted in the application, including tasks, projects, clients, invoices, comments, messages, file records and CRM records, stay recoverable for 30 days and are then permanently deleted by a daily job. Deleting a file directly also deletes its stored contents. |
| Customer Content after a subscription ends | After a subscription is cancelled or ends for non-payment, the Owner has 30 days to request an export. Within the following 30 days, we permanently delete the workspace's database records, its stored files and its exports. |
| A workspace deleted by its Owner | Deleted immediately and permanently when the Owner confirms. It cannot be restored, so export it first. |
| Workspace exports | Download links are valid for 7 days. Export files are deleted 8 days after they are created. |
| Client portal sign-in data | Sign-in links expire after 24 hours, portal sessions after 30 days and portal invitations after 7 days. Client user accounts are deleted with the workspace. |
| Tokens provided for an import | Up to 2 hours. |
| Database backups | Daily backups are kept for 7 days and weekly backups for 28 days. Every backup ages out within 30 days of being taken, so deleted data leaves our backups within 30 days of its deletion. |
| Billing records | For as long as tax and accounting laws require after the subscription or payment they relate to. |
| Support, privacy and legal correspondence | For as long as we need to handle the matter and any follow-up, and, for privacy requests and legal matters, for as long as we need a record of how we handled them. |
| Operational logs, request logs and error reports | For the limited periods set in our hosting, network and error monitoring providers' settings, after which they are deleted automatically. |
| Product analytics | For the period set in our analytics provider's settings, after which it is deleted automatically. |
| Website browser storage | One item, kept only until you close the browser tab. |
| Feedback portal content and status subscriptions | Until you delete your post or account, unsubscribe, or we close the portal. |
| Marketing contacts | Until you unsubscribe or ask us to delete your details. We then keep only your email address on a suppression list, so that we do not contact you again. |
We keep data longer than stated above only where a law requires it, or where it is needed for a legal claim or investigation, and then only for that purpose. For Customer Content, we keep data longer only where the law requires it, as section 14.5 of the DPA sets out.
11. Security
We protect personal data with technical and organizational measures suited to the Service. They include HTTPS for the web application with a Strict-Transport-Security header; team member sign-in through Clerk, with no team member passwords stored by Flowboard; a separate identity store for client users, with hashed passwords and session tokens; role-based permissions in each workspace; workspace isolation enforced in the application; encryption of the OpenRouter keys that workspaces save; a workspace audit log; error monitoring; scheduled database backups; and a written incident response process.
If we become aware of a personal data breach affecting a Customer's data, we will notify that Customer without undue delay and in any event no later than 72 hours after we become aware of it. Where the law requires, we will also notify the supervisory authority and the individuals affected.
Flowboard does not hold SOC 2 or ISO 27001 certification, and no system is perfectly secure. Our Data Security Standards describe each control in detail and name the controls we do not claim, and our security page summarizes them. Report a suspected vulnerability or incident to security@flowboardhq.com.
12. Cookies and similar technologies
Our website at flowboardhq.com sets no cookies. It stores one item in your browser's session storage to remember that you closed the annual offer banner, and that item is cleared when you close the tab. The website uses Vercel Web Analytics to count page views, without cookies or a persistent identifier.
The application uses cookies set by Clerk to keep you signed in, Cloudflare Turnstile at sign-up and sign-in, and browser storage for the client portal session, a short-lived cache of workspace data, your display preferences and recent searches, and PostHog product analytics. Product analytics does not run on client portal pages or on the public pages that workspaces publish. For team members in the European Economic Area and the United Kingdom, the application stores and reads analytics data only after they consent, and they can change that choice in the application at any time. We use no advertising cookies and no cross-site tracking, and the emails we send do not track whether they are opened or which links are clicked.
Our Cookie and Similar Technologies Notice lists each item, its purpose and how long it lasts, and explains how to control them.
13. Your rights
13.1 Rights under the GDPR
If the GDPR applies to our processing of your personal data, you have the right to:
- access your personal data and receive a copy of it;
- have inaccurate or incomplete personal data corrected;
- have your personal data deleted;
- restrict our processing of your personal data;
- object to processing based on our legitimate interests, and object at any time to the use of your personal data for direct marketing;
- receive the personal data you gave us in a structured, machine-readable format and have it transmitted to another controller, where the processing is based on consent or contract and is carried out by automated means; and
- withdraw consent at any time, where we rely on consent.
These rights have limits set by law. For example, we may keep data that we must retain under a legal obligation or that we need for a legal claim. Team members can update their name, email address and profile image in their account settings, and the Owner of a workspace can export or delete the workspace in Settings.
13.2 How to make a request
Email privacy@flowboardhq.com, from the email address on your account if you have one, and tell us what you are asking for. We may need to confirm your identity before we act, for example by asking you to reply from your account email address or to confirm details we already hold. We only use the information you give us for verification to handle your request.
We respond within one month of receiving your request. Where a request is complex, or you make several, we may extend that period by up to two further months, and we will tell you within the first month if we do. We do not charge for requests, unless a request is manifestly unfounded or excessive, in which case the law allows us to charge a reasonable fee or to refuse it.
13.3 Complaints
You have the right to complain to a data protection supervisory authority. In the European Economic Area, that is the authority in the Member State where you live, where you work or where you believe the infringement took place. In the United Kingdom, it is the Information Commissioner's Office. We would welcome the chance to address your concern first at privacy@flowboardhq.com, but you do not have to contact us before you complain.
14. Requests about Customer Content
If your personal data is in a Customer's workspace, for example because you are a client user, a form submitter, a booking invitee, a proposal signer, an invoice recipient or a contact in a Customer's records, that Customer is the controller of it. Please send your request to that Customer, which can access, correct, export and delete the data in its workspace.
If you send the request to us instead, we will pass it to the Customer concerned without undue delay where we can identify it, and help the Customer respond as the DPA requires. We do not answer the substance of a request about Customer Content ourselves unless the Customer instructs us to or the law requires us to.
If you are a team member, your account details are our data and section 13 applies to them. The content you create in a workspace belongs to the Customer that runs it.
15. US state privacy rights
This section applies to residents of California and of other US states with comprehensive consumer privacy laws, to the extent those laws apply to us. It supplements the rest of this policy and covers the personal information we handle as a business. For Customer Content, we act as a service provider or processor for the Customer, and section 14 applies.
15.1 Notice at collection
The table below lists the categories of personal information we collect, where they come from, why we use them, whom we disclose them to and how long we keep them. We collected each category in the 12 months before the date of this policy and disclosed it for a business purpose to the recipients shown.
| Category | Examples | Sources | Purposes | Disclosed to | Sold or shared | Retention |
|---|---|---|---|---|---|---|
| Identifiers | Name, email address, account identifiers, IP address, analytics identifier | You; your workspace; your browser or device; Clerk | Accounts and sign-in, service emails, billing, support, security, analytics, marketing to business customers | Hosting, network and storage providers; authentication, email, error monitoring, analytics and payment providers | No | While your account is active, then as section 10 sets out |
| Customer records | Name, billing contact details, billing email address | You; Stripe | Billing and account administration | Payment, hosting and email providers | No | As tax and accounting laws require |
| Commercial information | Plan, number of paid team members, subscription, invoice and payment records | You; Stripe | Billing, payment reminders, account administration | Payment, hosting and email providers | No | As tax and accounting laws require |
| Internet or other electronic network activity | Pages viewed, product events, request logs, browser and device details, error reports | Your browser or device | Security, fixing errors, improving the Service | Hosting and network providers; error monitoring and analytics providers | No | For the periods set in those providers' settings |
| Audio, electronic, visual or similar information | Profile image | You; Clerk | Showing who you are in the Service | Hosting and authentication providers | No | While your account is active |
| Professional or employment-related information | Workspace name, role and permissions in the workspace | You; your workspace | Accounts, support, marketing to business customers | Hosting and email providers | No | While your account is active, then as section 10 sets out |
| Sensitive personal information | Account sign-in credentials | You | Signing you in and securing your account, and no other purpose | Authentication provider | No | While your account is active |
We do not collect precise geolocation, biometric information or government identification numbers, and we do not create inferences to build a profile about you.
15.2 Sale, sharing and sensitive personal information
We have not sold or shared personal information in the 12 months before the date of this policy, and we do not sell or share it, including the personal information of consumers under 16. Because we do not sell or share personal information, we do not offer an opt-out link. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of sale and sharing. Because we do neither, the signal does not change how we handle your data. We use sensitive personal information only to sign you in and secure your account, which the law permits without a right to limit its use. We do not disclose personal information to third parties for their own direct marketing.
15.3 Your rights
Depending on the state where you live, you have the right to:
- know what personal information we collect, use and disclose, including the categories, sources, purposes and recipients, and receive the specific pieces of personal information we hold about you in a portable format;
- have us delete the personal information we collected from you;
- have inaccurate personal information corrected;
- opt out of the sale or sharing of personal information, targeted advertising and profiling that produces legal or similarly significant effects, none of which we do; and
- not receive discriminatory treatment for exercising these rights.
15.4 How to exercise your rights
Email privacy@flowboardhq.com with the subject "US privacy request" and tell us what you are asking for. We confirm receipt within 10 business days and respond within 45 calendar days. If we need longer, we may extend that period once by up to 45 more days, and we will tell you before the first period ends.
We verify requests by matching information you give us with information we already hold, for example by asking you to write from the email address on your account. A request for specific pieces of personal information, or to delete or correct it, requires a closer match. You do not need an account to make a request, and we use the information you give us for verification only for that purpose.
You can use an authorized agent. The agent must give us written permission signed by you, or a valid power of attorney. Unless the agent holds a power of attorney, we may also ask you to verify your identity directly and to confirm that you gave the agent permission.
15.5 Appeals
If we decline your request in whole or in part, we will explain why. You can appeal by replying to our decision, or by emailing privacy@flowboardhq.com with the subject "Privacy appeal". We will respond in writing within 45 days, explaining what we did and why. If we deny your appeal, you can contact the Attorney General of your state.
15.6 Non-discrimination
We will not deny you the Service, charge you a different price, provide a different level of service or otherwise treat you differently because you exercised a privacy right.
16. Children
The Service is for business use by people aged 18 or over. It is not directed to anyone under 18, and we do not knowingly collect personal data from anyone under 18. If you believe that a person under 18 has given us personal data, email privacy@flowboardhq.com and we will delete it.
17. Changes to this policy
We update this policy when our practices, our service providers or the law change. The date at the top of this page shows when it was last updated. If a change is material, we will email the Owners of every workspace before it takes effect and post the updated version on this page. Where the law requires your consent to a change, we will ask for it.
This version replaces the policy dated July 30, 2026. When we publish it, we email the Owners of every workspace that existed before then to tell them about it. The main changes are that it:
- explains when we act as a controller and when we act as a processor for our Customers;
- lists every category of data subject whose data the Service handles, including client users, form submitters, booking invitees, proposal signers and invoice recipients;
- adds our legal bases, a US state privacy notice, a retention table and a section on international transfers;
- describes the AI features, product analytics, error monitoring and every service provider, with the full list on the sub-processor page;
- moves cookie details to a separate notice and describes the current website accurately; and
- sets the age threshold at 18, in line with the Terms of Service.
18. Previous versions
Earlier versions of this policy stay available, unchanged, in our legal archive. The version that applied from July 30, 2026 is at Privacy Policy, July 30, 2026 version.
19. Contact
Harbor Software LLC
1309 Coffeen Avenue, STE 1200
Sheridan, Wyoming 82801, USA
privacy@flowboardhq.com