Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect your email address, organization name, and role within your organization. We use passwordless authentication via email magic links — we never store passwords.

Order Documents

Documents submitted for order processing (emails, PDFs, images, spreadsheets) are stored temporarily during processing and retained according to your plan's data retention policy. Documents may contain business information such as customer names, addresses, product details, and pricing.

Usage Data

We collect usage metrics including order volume, processing times, and feature usage to improve the Service and for billing purposes.

2. How We Use Your Information

• Service delivery: Processing documents, extracting orders, routing to your OMS
• Improvement: Improving extraction accuracy for your tenant (customer profiles, learned patterns)
• Communication: Sending transactional emails (magic links, order notifications, alerts)
• Billing: Tracking usage for subscription billing
• Security: Detecting and preventing unauthorized access

3. AI Processing

Documents are processed using AI language models (Anthropic Claude) to extract structured order data. Document content is sent to the AI provider solely for extraction purposes. We do not use your documents to train AI models. Each tenant's data is processed in isolation — no cross-tenant data sharing occurs.

4. Data Sharing

We share data only with:

• AI providers (Anthropic): For document understanding and extraction
• Cloud infrastructure (AWS): For hosting, storage, and processing
• Payment processors (Stripe): For billing and subscription management
• Your OMS: Extracted order data is submitted to your configured order management system

We do not sell your data to third parties.

5. Data Retention

• Processed documents: 90 days in hot storage, then archived per plan
• Extracted order data: Retained for the duration of your account
• Audit logs: 7-year retention for compliance
• Account data: Retained until account deletion, then purged within 30 days

6. Security

We implement industry-standard security measures including:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Tenant isolation at compute, storage, and network levels
• API key hashing (SHA-256) — raw keys are never stored
• Database row-level security enforcing tenant boundaries
• Immutable audit logging with hash chains

7. Your Rights

You have the right to:

• Access your data at any time via the API or dashboard
• Export your data in structured format
• Delete your account and associated data
• Opt out of non-essential communications

8. Cookies

We use session cookies for authentication. We do not use tracking cookies or third-party analytics on the application. Marketing pages may use minimal analytics.

9. Changes

We will notify you of material changes to this policy via email at least 30 days before they take effect.

10. Contact

For privacy inquiries, contact privacy@orderflow.ai.