Privacy Policy

1. Who we are and how to reach us

FlowTasks is the data controller for personal data processed through BidCraft. For any privacy question, request, or complaint, contact support@flowtasks.io. We respond to verified requests within 30 days.

2. Data we collect

• Account data: your email address, and your name and profile image if you sign in with Google and grant access to them.
• Profile and settings data you enter: skills, minimum rates, preferred categories, portfolio items, and winning proposal snippets, including anything imported from a public Upwork profile at your request.
• Job content: the job posting text you paste or send from the browser extension, and the structured fields we parse from it.
• Usage records: analyses you run, applications and outcomes you log, and revenue figures you enter.
• Billing metadata from Stripe: customer identifier, subscription identifier, plan, and subscription status. Card numbers never touch our servers.
• Technical data: IP address and user agent as processed by our hosting provider for security, rate limiting, and abuse prevention, and aggregate, non-identifying product event counts (for example, number of analyses per day).

3. Data we do not collect

• Upwork passwords or login credentials.
• Upwork session cookies.
• Full Upwork account data.
• Payment card numbers (handled entirely by Stripe).

The browser extension only reads the visible content of job and profile pages you explicitly choose to analyze or sync. It never performs actions on your Upwork account.

4. Why we process your data

• To provide the service: scoring jobs against your settings, generating proposal hooks from your own material, and computing your history, pipeline, and ROI analytics (performance of our contract with you).
• To send transactional email: sign-in magic links, welcome emails, billing notices, and the weekly digest if you have enabled it (contract and legitimate interest).
• To process payments and manage subscriptions through Stripe (contract).
• To keep the service secure and fair: enforcing rate limits, preventing multiple-account abuse of the free plan, and blocking automated or fraudulent traffic (legitimate interest).
• To comply with legal obligations such as tax and accounting requirements (legal obligation).

We do not sell personal data, we do not use your data to train machine-learning models, and we do not use advertising trackers.

5. Cookies and similar technology

BidCraft uses only strictly necessary cookies: a session cookie that keeps you signed in and a CSRF token that protects sign-in forms. We use cookie-free, privacy-friendly analytics that do not identify individual visitors, so no consent banner is required. Local storage on your device holds interface preferences such as dismissed banners and completed product tours; this data never leaves your browser.

6. Who we share data with

• Stripe, Inc. — payment processing and subscription management. Stripe acts as an independent controller for card data; see the Stripe privacy policy.
• Cloudflare, Inc. — hosting, storage, content delivery, security, and transactional email delivery for our sending domain.
• Google LLC — only if you choose to sign in with Google, which shares your name, email, and profile image with us.

These providers process data on our behalf under their standard data processing terms. We may also disclose data where required by law or to protect our legal rights. If FlowTasks is involved in a merger or acquisition, user data may transfer to the successor under the same protections, and we will notify you before that happens.

7. International transfers

Our infrastructure runs on Cloudflare's global network, so data may be processed in data centers outside your country of residence. Where required, transfers rely on the providers' standard contractual clauses and equivalent safeguards.

8. Retention

• Free plan job history is visible on a 30-day rolling window.
• Pro plan job history is retained without limit while you remain subscribed and for 90 days after a downgrade, after which older records are permanently purged.
• Free-plan job records older than 90 days are permanently purged by an automated weekly job.
• When you delete your account, all of your data is hard-deleted within 7 days, including from routine backups as they rotate out (backups are kept for a maximum of 12 weeks).
• Billing records required by tax law are retained by Stripe for the legally mandated period.

9. Security

All traffic is encrypted in transit with TLS. Data is stored on Cloudflare's infrastructure with encryption at rest. Extension API tokens are stored only as salted hashes. Access to production systems is restricted and logged. No system is perfectly secure; if we become aware of a breach affecting your personal data, we will notify you without undue delay.

10. Your rights

• Access and portability: Pro users can export their jobs and applications as CSV from Settings at any time; any user can request a copy of their data by email.
• Correction: you can edit your profile, settings, portfolio, and logged outcomes directly in the app.
• Deletion: delete your account from Settings for an immediate, permanent hard delete, or request deletion by email.
• Objection and restriction: you can disable the weekly digest in Settings and object to any processing based on legitimate interest by contacting us.
• Complaint: you may lodge a complaint with your local data protection authority.

11. Children

BidCraft is a professional tool intended for adults. It is not directed at children under 16, and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.

12. Changes to this policy

We may update this policy as the product or the law changes. Material changes will be announced by email or an in-app notice at least 14 days before they take effect. The date at the top of this page always reflects the current version.