Privacy policy

1. Our two roles

Firms’ data. Each firm that uses Flowtiv decides what it keeps about its clients, contacts, subcontractors and enquiries, and why. We handle that information on the firm’s behalf and on its instructions, to provide Flowtiv to it. The firm’s own privacy policy applies to it, and requests about it (to see it, correct it or remove it) go to the firm; we help the firm answer them.

Our own data. We decide how we handle the accounts of the people who sign in to Flowtiv, our billing of firms, messages people send us, and the technical records that keep Flowtiv secure. This policy applies to those directly.

2. The information we handle

• Accounts: name, email address, role, the firm someone works for, and sign-in records (times, devices, IP addresses, passkeys and second factors). Sign-in is by emailed link or passkey; we don’t keep passwords.
• Clients, contacts and subcontractors a firm records: names, email addresses, phone numbers, business details and ABNs, addresses and site addresses, and notes.
• Enquiries and bookings from firms’ websites, forms and booking pages, including files people attach and their marketing consent.
• Correspondence: messages in a record’s channels, email sent to a channel’s address, email filed from a connected mailbox, text messages, and call notes.
• Mailbox and calendar data, when a firm’s staff member connects their Microsoft 365 or Google account (see section 6).
• Work records: proposals, projects, tasks, time, rates, files and documents, and subcontractors’ compliance documents (such as licences and insurance).
• Signatures: the signed document, the name typed or signature drawn, and the time, IP address and device used, which make up the signing record.
• Invoices and payments: amounts, payment status and references, and firms’ bank details (stored encrypted). Card details are entered with the payment provider (such as Stripe or PayPal) and never reach Flowtiv.
• Texting: for firms with a texting number, a count of the texts sent (Twilio’s message id, segments and status, not their words) for Flowtiv’s monthly statement; the firm’s legal name, ABN, address and a contact person, sent to Twilio to register an Australian number; and who in the firm accepted the texting rules, when, and from which IP address and browser.
• Conversations with Orbi, Flowtiv’s assistant, and what it looked up to answer (see section 5).
• Activity and audit records: what changed, when and by whom, kept so firms can see the history of their work and so sensitive actions can be checked.
• Technical logs: requests to Flowtiv, with IP addresses and errors. They don’t contain message content or secrets.

3. How we collect it

• From the people who use Flowtiv, as they work in it.
• From the firm: staff enter it, invite clients and subcontractors, or import it from another system (such as Odoo, Xero, WorkflowMax or a spreadsheet).
• From people who fill in a firm’s forms, book a time, sign or pay.
• From services a firm or person connects, with their permission: mailboxes and calendars, accounting systems, payment providers and ad platforms.
• Automatically, when Flowtiv is used (sign-in records and technical logs).

4. How we use it

• To provide Flowtiv: showing each firm its own records, sending the email and text messages people ask it to send, filing replies, reminders and notifications, signing and payments.
• To keep it secure: checking sign-ins, limiting misuse, scanning uploaded files for malware, and investigating problems.
• To bill firms for Flowtiv and to tell them about their account and the service.
• To answer support requests and messages people send us.
• To meet our legal obligations.

We don’t sell personal information. We don’t use firms’ data for advertising, we don’t build advertising audiences from it, and we don’t share it with advertising platforms. We don’t look at a firm’s data except to keep Flowtiv working and secure, when the firm asks us to, or when the law requires it.

5. Orbi, the assistant

When someone asks Orbi a question or a task, their request and the records Orbi reads to answer it are sent to the AI provider that answers. Flowtiv uses xAI (Grok), in the United States, unless the firm has added its own key for Anthropic (Claude), OpenAI (ChatGPT) or xAI, in which case that provider answers under the firm’s own agreement with it. Orbi can only see what the person asking can see, and anything it would send to a client or subcontractor waits for a person to approve it. We don’t use firms’ data to train AI models.

6. Microsoft 365 and Google mailboxes and calendars

A staff member can connect their own Microsoft 365 or Google mailbox and calendar. Flowtiv then reads mail sent and received since connecting (it can’t send mail or change the mailbox), and keeps their calendar in step both ways: their events show in Flowtiv, and events they change in either place change in the other.

• An email is filed into Flowtiv only when it matches a client, contact or subcontractor on one of the firm’s records. Mail between staff alone is never imported.
• Mail that matches nothing is held for the mailbox’s owner to file, and deleted after 30 days if they don’t.
• From the calendar, Flowtiv keeps events from 90 days ago to 12 months ahead: the title, times, location, online meeting link, organiser, who’s invited and their answers, whether the time shows as busy, whether it’s private, and the first 500 characters of the description (never the full description or attachments). Older events are deleted each night.
• Only the person whose calendar it is sees their events in full. Colleagues see only when they’re busy, unless a meeting is filed on one of the firm’s records; private events are never shown to colleagues. Clients and subcontractors never see a synced calendar.
• A meeting with a client, contact or subcontractor on one of the firm’s records is noted on that record (for the firm’s staff), as filed email is. The person can take it off.
• The connection can be removed at any time in Flowtiv’s settings, or from the Microsoft or Google account. Access tokens are stored encrypted and deleted when it’s removed. Removing the calendar deletes its events that aren’t filed on a record; meetings filed on a record stay there as the firm’s history.

Flowtiv’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the features the person sees in Flowtiv. We don’t use it for advertising, don’t sell it, don’t use it to train AI models, and no person at Flexilay reads it unless the user asks us to, it’s needed for security, or the law requires it.

7. Who we share it with

Our service providers, who process information for us under contract and only to run Flowtiv: they’re listed, with where they process, on Who processes data for Flowtiv.

Services a firm connects, such as Microsoft 365, Google Workspace, Xero, MYOB, Stripe, PayPal or FlexiLay, receive what the connection needs (for example, invoices and payments sent to the firm’s accounting system), under the firm’s own agreements with them.

Others only when the law requires it, to protect people’s safety or Flowtiv’s security, or as part of selling the business, under the same protections.

8. Where it’s stored and processed

Flowtiv’s database and application servers are in Sydney, Australia. Some information is processed overseas:

• United States: email sending and receiving (Twilio SendGrid), text messages and calls for firms that turn them on (Twilio), the assistant (xAI, or the provider a firm chooses), and ad platform reports for firms that connect them (Google, LinkedIn, Meta).
• Files and backups are stored with Cloudflare R2, placed in Oceania where possible. That placement isn’t guaranteed, so they may be stored outside Australia.
• Cloudflare’s network carries traffic to Flowtiv through data centres around the world.

We choose providers with strong security and privacy commitments and limit what each one receives to what its job needs.

9. How we protect it

Encryption in transit everywhere and at rest; each firm’s data kept apart in the database itself; bank details, access tokens and second factors encrypted again with keys held apart from the data; multi-factor sign-in available to everyone and enforceable by each firm; a fresh check before sensitive actions; audit records; malware scanning of uploads; and nightly backups encrypted to a key kept offline. If you find a security problem, please see Reporting a security problem.

If a data breach is likely to cause serious harm, we follow the Notifiable Data Breaches scheme: we tell the affected firms (who tell their clients) and the Office of the Australian Information Commissioner.

10. How long we keep it

• A firm’s records are kept while its account is open, until the firm removes them. Firms set their own record-keeping periods to meet their obligations. Correspondence can’t be rewritten, but a firm can redact it for privacy.
• A firm can export all its data at any time; each export can be downloaded for 7 days.
• When a firm closes its account, its owners can still sign in for 30 days to export or reopen it. Then its data is deleted, and it’s gone from our backups within a further 35 days (90 days for files).
• Unfiled mailbox mail is deleted after 30 days (section 6).
• Calendar events filed on no record are deleted once they’re more than 90 days old, or when the calendar is disconnected (section 6).
• Data from a connected ad account, mailbox or calendar: Deleting your data explains how to stop Flowtiv’s access and have it deleted.

11. Seeing, correcting and complaining

If a firm holds information about you, ask the firm: it can see and correct everything it holds, and we help it. For your own Flowtiv account, or anything else in this policy, email us at [email protected]. We’ll reply within 30 days, and may need to confirm who you are first.

If you’re unhappy with how we’ve handled your information, tell us and we’ll look into it and respond in writing. If you’re still not satisfied, you can complain to the Office of the Australian Information Commissioner.

12. Marketing email

Firms can send marketing email and texts from Flowtiv only to people whose consent is recorded. Every message identifies the firm and has a working unsubscribe, and unsubscribes are honoured straight away and kept. We send our own product news only to people who’ve agreed to receive it.

13. Our website, flowtiv.app

Our website at flowtiv.app tells people about Flowtiv. When you ask for a demo there, we collect what you put in the form (your name, office, work email, phone, profession, team size, the tools you use and your message) and the campaign that brought you to the site, such as an ad’s tags. We email it to our team at [email protected] so we can arrange the demo, and don’t keep it in Flowtiv. Cloudflare Turnstile checks that a person sent it.

If you agree in the website’s cookie banner, it uses Google Analytics to see how people find and use the site, and Google Ads and Meta (Facebook and Instagram) to measure our ads; you can allow either on its own. Nothing from them loads until you agree, and you can change your choice at any time with Cookie settings at the bottom of every page. Google and Meta process this information in the United States, under their own privacy policies.

14. Cookies

Flowtiv uses only the cookies it needs to work, such as the one that keeps you signed in. Public forms and booking pages use Cloudflare Turnstile to tell people from bots. The Flowtiv app has no analytics or advertising cookies. Our own website uses them only if you agree (section 13). A firm’s website may add its own analytics; the firm’s policy covers those.

15. Changes and contact

We’ll update this policy when Flowtiv changes, with the date at the top, and tell firms about significant changes.

Using Flowtiv is covered by our Terms of service.

Flexilay Pty Ltd, 52 Wellington Street, Launceston TAS 7250, Australia. [email protected]