Privacy Policy
Last updated: 17 July 2026
Placeholder: This is a draft version. Replace with text reviewed by a lawyer and aligned with Privacy Act 1988 (AU) and GDPR before publishing.
1. Information We Collect
We collect: (a) account information (name, email, company); (b) operational data (shifts, time entries, invoices); (c) GPS location data only during active shifts with explicit consent; (d) technical data (IP, browser, device).
2. How We Use the Information
We use the information to: (a) operate and improve the service; (b) generate weekly invoices; (c) send operational notifications; (d) comply with legal obligations; (e) respond to support inquiries.
3. Legal Basis for Processing (GDPR)
We process personal data under the following bases: (a) contract performance (shift management and invoicing); (b) consent (active GPS and non-essential cookies); (c) legitimate interest (service improvement); (d) legal obligation (invoicing and accounting).
4. Storage and Transfer
Data is stored in Supabase (Postgres) with encryption in transit (TLS) and at rest. Primary servers are in Australia and Singapore. We apply adequate safeguards for international transfers.
5. Sharing with Third Parties
We do not sell personal data. We share limited information with: (a) Supabase (hosting); (b) Vercel (frontend); (c) Resend (transactional emails); (d) authorities when legally required.
6. Your Rights
You have the right to: (a) access your data; (b) rectify incorrect information; (c) request deletion; (d) restrict processing; (e) data portability; (f) object to processing. To exercise them, write to hello@flowtask.app.
7. Data Retention
We retain account data as long as the account is active. After account deletion, data is deleted within 30 days, except data we must retain for legal obligations (e.g., accounting records, 7 years in Australia).
8. Security
We implement technical and organizational measures: encryption, authentication, role-based access control, multi-tenancy by company_id, audit logs, and regular backups.
9. Minors
FlowTask is not directed at minors under 16. We do not knowingly collect data from minors.
10. Changes to this Policy
We will notify material changes by email at least 30 days in advance. Continued use of the service indicates acceptance.
11. Contact
For questions or requests related to privacy, email us at hello@flowtask.app.