Privacy Policy
FlowTrack Pro — flowtrackpro.net
Last updated: May 28, 2026
What changed since v1.0: data export endpoint, deletion-on-cancellation lifecycle, hosting region disclosure.
FlowTrack Pro LLC ("we," "us," or "our") operates the FlowTrack Pro platform at flowtrackpro.net (the "Service"). FlowTrack Pro is a software-as-a-service platform designed for backflow testing companies to manage devices, testing schedules, compliance records, customer communications, and work orders.
This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have regarding your data.
Our commitment: We do not sell your personal information. Your data is tenant-isolated, meaning each company's data is completely separated from other companies on the platform. We collect only what is necessary to provide and improve the Service.
1. Information We Collect
Account and Profile Information
- Name, email address, phone number
- Company name, address, and business details
- User role and login credentials
Customer and Device Records
- Customer names, addresses, phone numbers, and email addresses
- Backflow device information (serial numbers, locations, types, test results)
- Testing schedules, compliance dates, and work order history
- Documents and PDF test reports uploaded to the platform
Payment Information
- Billing name, address, and subscription plan details
- Payment card information is collected and processed exclusively by Stripe; we do not store credit card numbers on our servers
Usage and Technical Data
- Browser type, operating system, and device information
- IP address and approximate location
- Pages visited, features used, and actions taken within the platform
- Error logs and performance metrics
2. How We Use Your Information
- Provide, maintain, and improve the FlowTrack Pro platform
- Process backflow device records, test results, and compliance tracking
- Send transactional emails (account verification, password resets, test reminders)
- Send SMS notifications (test due reminders, appointment confirmations)
- Process subscription payments and manage billing
- Provide geocoding and map-based features for device locations
- Extract data from uploaded PDF test reports using AI
- Respond to support requests and communicate with users
- Detect, prevent, and address security issues and fraud
- Comply with legal obligations
3. Third-Party Service Providers
We work with trusted third-party providers to deliver the Service. Each provider only receives the minimum data necessary to perform its function.
| Provider | Purpose | Data Shared |
|---|---|---|
| Supabase | Database hosting (PostgreSQL) and authentication | All platform data (encrypted at rest) |
| Stripe | Payment processing | Billing name, email, payment card details |
| Resend | Transactional email delivery | Recipient email address, email content |
| Twilio | SMS message delivery | Recipient phone number, message content |
| Mapbox | Geocoding and map display | Addresses for geocoding lookups |
| Anthropic (Claude) | AI-powered PDF data extraction | Uploaded PDF content for text extraction |
We do not sell, rent, or trade your personal information to any third party for marketing purposes.
4. Data Isolation and Security
FlowTrack Pro uses a multi-tenant architecture with strict data isolation. Each company account is completely separated at the database level using row-level security policies. This means:
- Your company can only access its own customers, devices, and test records
- No other company on the platform can view or access your data
- Administrative staff at FlowTrack Pro LLC may access data only for support and troubleshooting purposes
We implement industry-standard security measures including encrypted data transmission (TLS/SSL), encrypted data at rest, secure authentication tokens, and regular security audits. Tenant isolation is enforced at two layers: an Express middleware attaches a per-request RLS-scoped Supabase client to every API call, and Postgres row-level security policies re-check company_id = auth_company_id() on every query.
5. Cookies and Local Storage
FlowTrack Pro uses only essential cookies and browser storage mechanisms required for the platform to function:
- Authentication tokens stored in localStorage to keep you signed in
- Session data necessary for the application to operate correctly
We do not use advertising cookies, tracking pixels, or third-party analytics cookies. There are no non-essential cookies to opt out of.
6. Data Retention
- Active accounts: We retain your data for as long as your account is active and the subscription is maintained
- Closed accounts: Upon cancellation, your account enters a 30-day read-only grace window during which you can still log in and run a full data export. After the grace clock expires, all personally identifying data — customers, devices, test records, scheduled jobs, team auth identities — is permanently and irreversibly deleted via a daily anonymization sweep. Tombstoned company records, invoices (with a frozen
customer_snapshot), and audit-log entries (with user identity stripped) survive so we can answer "what happened?" without disclosing "who did it." Full policy: docs/data-retention.md. - Backflow test records: Compliance records may be retained as required by local, state, or federal regulations governing backflow prevention
7. Your Rights
Depending on your location, you may have the following rights regarding your personal information:
- Access: Request a copy of the personal information we hold about you
- Correction: Request correction of inaccurate or incomplete data
- Deletion: Request deletion of your personal information
- Portability: Request your data in a portable, machine-readable format. Company admins can download a ZIP archive (JSON + per-table CSVs covering customers, locations, devices, test records, work orders, scheduled jobs, invoices, audit log, and team profiles, plus URL manifests for photos and district forms) at any time via Settings → Data Export, which calls
POST /api/account/export. - Opt-out: Opt out of non-essential communications at any time
To exercise any of these rights, contact us at support@flowtrackpro.net. We will respond to your request within 30 days.
8. California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):
- Right to Know: You may request the categories and specific pieces of personal information we have collected about you
- Right to Delete: You may request that we delete your personal information, subject to certain exceptions
- Right to Correct: You may request correction of inaccurate personal information
- Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights
- No Sale of Personal Information: We do not sell or share personal information for cross-context behavioral advertising
To submit a request, email support@flowtrackpro.net with the subject line "California Privacy Request." We will verify your identity before processing your request and respond within 45 days as required by law.
9. Children's Privacy
FlowTrack Pro is a business-to-business platform and is not directed at individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us and we will promptly delete it.
10. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify active users by email and update the "Last updated" date at the top of this page. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.
11. Contact Us
If you have questions or concerns about this Privacy Policy or our data practices, please contact us:
FlowTrack Pro LLC (FlowTrack Pro)
flowtrackpro.net
support@flowtrackpro.net