Privacy Policy

We collect information you provide directly to us when you create an account, set up a workspace, and use BusinessFlow AI.

• Account information: Name, email address, and authentication credentials (handled by Supabase Auth).
• Workspace data: Organization name, business type, and workspace settings.
• Operational data: Leads, clients, projects, briefs, tasks, documents, and activity you create in the workspace.
• AI interaction data: Briefs and documents you submit for AI analysis, and the AI-generated responses.
• Usage data: Interaction with the application for product improvement and debugging.

• Provide and maintain the BusinessFlow AI service
• Process authentication and authorize access to your workspace
• Enable AI Project Intelligence features using your project context
• Send service-related communications (security updates, account changes)
• Improve product functionality and fix issues
• Comply with legal obligations

• Database: PostgreSQL hosted on Supabase with row-level security enforcing workspace isolation.
• Documents: Private Supabase storage buckets with signed, time-limited URLs.
• Authentication: Supabase Auth with email confirmation, secure password reset, and HttpOnly session cookies.
• AI processing: Project context sent to Google Gemini API for analysis; data not used for model training.
• Encryption: TLS in transit; encryption at rest provided by Supabase infrastructure.

When you use AI Project Intelligence, your project briefs and documents are sent to Google's Gemini API for analysis.

• Only the specific project content you choose to analyze is sent.
• No workspace-wide data, other projects, or authentication credentials are shared.
• Google's API terms apply; data is not used to train Google's models.
• You control when AI analysis runs — it is not automatic.

• Account and workspace data retained while your account is active.
• Deleted workspaces: data removed within 30 days of deletion request.
• Authentication logs retained per Supabase retention policies.
• AI interaction logs retained for debugging and product improvement (maximum 90 days).

• Access and export your workspace data.
• Request deletion of your account and all associated data.
• Update your profile and notification preferences.
• Revoke AI analysis permissions per project.

To exercise these rights, use the account settings in the application or contact support.

BusinessFlow AI uses the following third-party services:

• Supabase: Database, authentication, storage, and edge functions.
• Google Gemini API: AI Project Intelligence analysis.
• Vercel: Hosting and edge network.

Each provider has its own privacy policy governing their processing of data.

We may update this Privacy Policy as the product evolves. Material changes will be communicated via email or in-app notification. The "Last updated" date at the top of this page reflects the most recent revision.

Questions about this Privacy Policy or your data? Contact us at privacy@businessflow.ai.