Privacy policy
PadFlow is project-management software for land development — residential and commercial — used by developers and the people who work with them to keep schedules, budgets, draws and documents in one place. This page says what PadFlow collects, why, who else touches it, and what you can do about it. It is written to be read.
“PadFlow”, “we” and “us” mean PadFlow LLC, a Georgia limited liability company, which operates padflow.io. “You” means anyone with a PadFlow account, and anyone whose information a PadFlow customer puts into their workspace.
What we collect
Account information.
Your email address and a password, of which we keep only a hash — or, if you sign in with Microsoft or Google, the name, email address and profile picture your account provider sends us. Nothing else from that provider.
Workspace content.
What you and your colleagues put into your workspace: projects, schedules and critical dates, budgets, draws, invoices, lien waivers, notes, the names and email addresses of the people you invite, and documents you upload. This is your data; you decide what goes in.
Documents from your storage.
If a workspace admin connects Microsoft 365, PadFlow reads the SharePoint library they choose — file names, folder structure, and the contents of documents — and records what it finds: which document is which, and the dates, amounts and parties it mentions. It touches nothing outside that library.
Usage and log data.
Ordinary server logs: IP address, browser, the pages requested and when, kept for operating and securing the service. We do not run advertising or analytics trackers. PadFlow uses essential cookies only: to keep you signed in, to remember the active workspace and display preferences, and to safely operate a support session.
How we use it
To provide the service: showing you your workspace, computing schedules, sending the weekly digest you opted into, sending invitations you asked us to send, filing documents where you asked. To keep the service secure and running. To answer when you write to us. That is the list. We do not sell personal information, and we do not use your data for advertising.
Signing in with Microsoft or Google
When you use “Continue with Microsoft” or “Continue with Google”, the provider tells us who you are — name, email address, profile picture — and nothing else. We do not read your mail, calendar or files through that sign-in. Signing in with a provider does not connect your storage; that is a separate step a workspace admin takes in Settings.
PadFlow’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Your Microsoft 365 connection
A workspace admin can connect a Microsoft 365 account so PadFlow reads documents where they already live. The grant asks Microsoft for permission to read and write files (Files.ReadWrite.All), for a refresh token so scheduled reads can run when nobody is signed in, and for the connecting person’s basic profile. In practice PadFlow reads the one library you pick, and the only writing it does is filing a document that a member uploads through PadFlow into that library. It never deletes or moves your files. The admin can disconnect at any time in Settings, or revoke PadFlow in Microsoft 365, and reading stops.
Mail you send to a project
Every project has an intake address, and a member can send a message to a project from Outlook with the PadFlow add-in or by forwarding it to that address. PadFlow first checks that the sender is a member allowed to file there; mail from anyone else is dropped and not kept. A message that passes leaves three things behind, all of them workspace data: its attachments, filed as documents into your Microsoft 365 library; the text of the message, kept in the register as correspondence so it can be read and searched; and a record of the sender, the subject and the message’s own identifier, so the same message forwarded twice files once. The raw message is not kept. The sender gets a receipt saying what was filed.
Reading documents with AI
To tell what a document is and to pull out the dates, amounts and parties it mentions, PadFlow sends the document’s contents to an AI model — through OpenRouter, an API gateway, to a model provider such as Google or OpenAI. Only the document being read is sent, only for that purpose, and what comes back is a set of proposals a person accepts or rejects; nothing is filed or scheduled on the model’s word alone. Every request carries an instruction to route only to providers whose terms forbid retaining your content or training on it; where no such provider serves a model, the request is refused and PadFlow falls back to what it can tell from the filename rather than sending your document anywhere else. We send nothing that identifies your workspace beyond what is in the document itself.
A spreadsheet you import is read differently: your browser reads it, and nothing about it leaves your browser on its own. If a sheet cannot be placed, you can ask the assistant to read that sheet — and only then are its values sent, never its formulas and never a sheet that was already understood. A file that arrives by email has no browser to be read in, so PadFlow reads it the way it reads any other document, and the review it prepares waits for a person.
A scan or a photograph you import has no rows in it to read, so your browser finds its pages and draws them for you, still without sending anything. You pick the pages you want read; an image of exactly those pages is then sent to a model to be transcribed, under the same routing instruction as everything above. Pages you did not pick are not sent, and a photograph that arrives by email is filed and waits for somebody to ask rather than being read on arrival. What comes back is a table you review; the reader records how sure it was of each cell, and a cell it was unsure of is shown to you as a question rather than written.
Who else sees your data
PadFlow runs on services that store or move data on our behalf, and only for that purpose. Data is hosted in the United States.
- Supabasethe database and sign-in service
- Amazon Web Servicesthe servers the application runs on
- Cloudflarethe network in front of them — DNS, TLS, protection from abuse — and the mail exchanger that receives messages sent to a project address
- Microsoftwhen a workspace connects Microsoft 365, or a person signs in with Microsoft
- Intuitwhen a workspace connects QuickBooks Online, so that actuals read back from the books it already keeps
- Googlewhen a person signs in with Google, and as an AI model provider for reading documents
- OpenAIas an AI model provider for reading documents, reached through OpenRouter with data retention disabled; those requests are routed to providers in the United States
- OpenRouterthe API gateway through which AI model providers are reached
- Resendsending email — invitations, sign-in links, the weekly digest
- Stripetaking payment for a workspace’s subscription. Card details are entered on Stripe’s own pages and never reach PadFlow; PadFlow holds Stripe’s identifiers for the customer and the subscription
- Sentryerror reporting — when something fails, the diagnostics that say where, with known secrets stripped before they are sent
We share personal information with no one else, except when the law requires it, to protect PadFlow or its users from fraud or abuse, or if PadFlow changes hands — in which case this policy travels with the data.
Members of your workspace see what your workspace contains, according to the roles your admin sets. Other workspaces cannot see yours: access is enforced per workspace at the database, so one customer’s queries cannot reach another’s rows.
Statistics across workspaces
We may compute de-identified statistics across all workspaces — how long a plat approval typically takes in a given county, say — to improve PadFlow and to show benchmarks. These never identify a workspace, a project, a person or a document, and no customer’s content is ever shown to another.
How long we keep it
Your account and workspace data are kept while the account or workspace exists. When a workspace is deleted, or you ask us to delete your account, we delete the data within 30 days, and it leaves our backups within a further 30 days. Documents in your Microsoft 365 library are yours and stay where they are; PadFlow’s records about them, and the correspondence and intake records from mail sent to a project, go when the workspace does. Server logs are kept for up to 90 days.
Security
Data is encrypted in transit and at rest. Stored Microsoft 365 credentials are encrypted separately. Access is controlled per workspace at the database. No system is perfectly secure; if we learn of a breach affecting your data, we will tell you promptly.
Your choices
The weekly digest is opt-in only, and Settings turns it off. A workspace admin can disconnect Microsoft 365 in Settings, or revoke PadFlow from Microsoft 365. To see, correct, export or delete the personal information we hold about you, write to us and we will act within 30 days. If your local law gives you further rights — under the GDPR or the CCPA, say — you exercise them the same way. We do not sell personal information, and we do not share it for cross-context behavioural advertising.
Children
PadFlow is a tool for businesses and is not for anyone under 18. We do not knowingly collect information from children.
Changes
When this policy changes, the new version is posted here with a new effective date. If a change is material, we tell workspace admins by email first.
Contact
Questions, requests, or a concern about how your data is handled: [email protected].