Last updated: April 15, 2026
We collect information you provide directly: your name, email address, and workspace data (clients, contacts, leads, proposals, projects, invoices, payments, expenses, and files). We also collect usage data such as login timestamps, feature usage events, and browser metadata for product improvement.
Your data is used to provide and improve the Service, including: authenticating your account, delivering workspace functionality, sending transactional emails (invoices, digests, password resets), tracking product adoption for feature improvement, and generating aggregated analytics visible only within your workspace.
Your data is stored on secure, managed infrastructure with row-level security ensuring strict tenant isolation — each workspace's data is accessible only to its members. Files are stored in encrypted cloud storage with scoped access controls. All connections use HTTPS/TLS encryption in transit.
The Service uses the following third-party providers to operate: cloud database and authentication infrastructure, and email delivery services for transactional notifications. Additional security services (such as bot protection) may be enabled over time. We do not sell your data to third parties.
We do not share your personal data or workspace data with third parties for marketing purposes. Data may be shared only: with your consent, to comply with legal obligations, or to protect the rights and safety of CoreFlow and its users.
When you share portal access with your clients via magic link tokens, the client can view only the data explicitly shared with them (invoices, proposals, project updates, and onboarding tasks for their company). Portal tokens expire automatically and can be revoked at any time.
Your workspace data is retained as long as your account is active. System logs, notifications, and audit records follow automated retention schedules and are periodically cleaned. You may export your data at any time using the built-in data export tools (CSV and XLSX formats).
CoreFlow uses essential cookies for authentication session management. We track product adoption events (feature usage) internally to improve the Service. We do not use third-party advertising trackers or cross-site tracking.
You have the right to access, correct, and export your data at any time. To request data deletion, contact us and we will process your request within a reasonable timeframe. Workspace admins can manage team member access and data within their workspace.
For privacy questions or data requests, contact us at hello@coreflow.app.