Privacy Policy

1. Who we are

Flow Through Logic Pty Ltd (ABN 15 697 017 842, ACN 697 017 842) operates FlowSpec, the voice-to-Xero quoting service at flowspec.com.au. Our office is in Canberra, ACT.

Our Privacy Officer is Blake Rowlands-Mowle, Director. For any privacy question or request, reach us at [email protected].

2. What we collect

We collect what the Service needs to run your account and build your quotes:

• Account details: your email and profile information, held in Supabase.
• Xero connection: OAuth tokens that let FlowSpec sync contacts and quotes with your Xero. Your Xero password stays with Xero.
• Billing details: handled by Stripe. Card numbers stay with Stripe.
• Voice recordings: audio from the microphone feature, handled in memory while we transcribe it (see clause 4).
• Job notes: the descriptions of jobs you speak or type.
• Quote data: client names, site addresses, materials and pricing drawn from your inputs.
• Price lists: supplier pricing synced from your Xero for automatic matching.
• Usage data: basic operational records such as request timestamps and response times, which we use to keep the Service healthy.

3. Your clients' personal information

Your quotes often include other people's details, such as a client's name, address, email or phone number. You decide what goes in. By entering those details you confirm you have the right to share them with us, and we process them on your behalf to run the Service. Our Terms cover this in clause 5.

4. Voice recordings

Voice gets careful handling:

• In memory on our servers: recordings stay in temporary memory while we work with them and are never written to disk on our side.
• Sent to OpenAI for transcription: to turn speech into text, the audio is sent to OpenAI (see clause 5). Once the text comes back, the audio is released.
• Text only is kept: only the transcribed text is saved to your account, so it can become a quote.

5. Artificial intelligence and OpenAI

We use OpenAI's API (Whisper for transcription and GPT models for structuring your quote) to process your inputs. Here is exactly how that data is treated:

• Training: your inputs stay out of OpenAI's model training. We keep model-training sharing switched off on our OpenAI account.
• Logging: we keep API logging switched off, so OpenAI holds your inputs and outputs only as its standard policy allows, rather than for our review.
• Retention: under OpenAI's standard API policy, inputs and outputs may be held for a short period (up to 30 days) for abuse monitoring, then deleted.

6. Who we share your data with

We add no advertising trackers or analytics products, and we record no sessions. Your data reaches only the providers that run the Service:

• Supabase (cloud): database, sign-in, and account emails such as confirmation and password reset.
• OpenAI (USA): transcription and quote structuring. Training and logging switched off (see clause 5).
• Xero (NZ/AU): your accounting and invoicing destination, active once you connect your Xero account.
• Stripe (USA): subscription payments. Card details stay with Stripe.
• Resend (USA): delivery of transactional email such as receipts and notifications. Receives your email address.
• Google Workspace (USA): stores the tester-application and feedback entries you submit through our demo and forms (see clause 7).
• Cloudflare and Railway (global): network routing and hosting.
• Google Fonts (USA): typography. Google receives your IP address when fonts load.

Overseas disclosure (APP 8): by using FlowSpec you consent to your personal information being disclosed to the overseas recipients above, in the United States and global cloud regions. Where information goes outside Australia, we take reasonable steps to see it is handled consistently with the Australian Privacy Principles. Some recipients are subject to laws that differ from Australian privacy law.

7. Demo, application and contact forms

You can use parts of FlowSpec without an account, such as the demo, the tester-application form, and the contact form. When you submit one of these, we collect what you provide, such as your name, email, phone number and trade, and we use it to respond to you and to consider your application. These entries are stored in Google Workspace (see clause 6) and emailed to us through Resend.

8. Data storage and security

Your data lives in Supabase's cloud database with Row Level Security, so each account reaches only its own data. Connections use HTTPS/TLS encryption. Sign-in tokens are managed by Supabase Auth and held in your browser's local storage.

9. How long we keep your data

• Voice recordings: released right after transcription.
• Quotes and job data: kept while your account is active.
• Price lists: refreshed from Xero on each sync.
• Account data: kept until you ask us to delete it.

Where the law requires us to keep certain records for longer, such as financial and billing records, we retain those for the required period.

10. Cookies

FlowSpec uses no tracking cookies. Sign-in runs on bearer tokens held in your browser's local storage.

11. Your rights

Under the Privacy Act 1988 (Cth), you can:

• Access the personal information we hold about you
• Correct information that is wrong
• Ask us to delete your account and its data
• Raise a concern with the Office of the Australian Information Commissioner (OAIC)

To make a request, email [email protected]. We aim to respond within 30 days.

12. Notifiable data breaches

If we become aware of a data breach likely to cause serious harm, we notify the affected people and the OAIC within 30 days, under Part IIIC of the Privacy Act 1988 (Cth).

13. Marketing communications

When you opt in to marketing (through signup or our contact form), Flow Through Logic Pty Ltd is the sender of any commercial message. Every message names us as the sender with our ABN and carries a working unsubscribe link. We keep your consent record for as long as we hold your account, in line with the Spam Act 2003 (Cth).

14. Changes

We may update this policy over time. For a significant change, we tell you by email or in the app.