Workflow & Automation · flowmanual.comFlowManual
Graded against 811 verified platforms, from its own policy text. Automated assessment against a published rubric — not legal advice.
No lens is bandable yet — banding requires fully verified documents with on-criteria findings. The gap is shown honestly, never estimated.
“When you run document analysis, extracted plain text from your documents is sent to Anthropic’s API. Anthropic operates under a zero-data-retention policy: prompts and responses are not stored and are not used to train models. Raw document files are never transmitted. See Anthropic’s Privacy Policy .”
Partially verified: Privacy Policy assessed · Terms of Service pending. Everything below comes only from what was read in full.
Lower concern: Privacy and data use
Start here. These are the highest-risk verified clauses AIRIN found in the platform's own policy text.
This segment prohibits selling user data, prohibits using document content for advertising, and restricts third-party data sharing to what is described in Section 3 — these are user-favorable restrictions limiting commercial and advertising use of personal data.
This segment identifies Anthropic as the analysis subprocessor, states that only extracted plain text (not raw files) is transmitted, and discloses that Anthropic operates under a zero-data-retention policy prohibiting storage of prompts/responses and prohibiting use of that data to train models — this restriction is user-favorable, preventing training use by the subprocessor.
This segment identifies Tavily as an optional web search subprocessor, explains what data is sent (search queries that may include conversation text), states that queries are not used to train models, and describes conditions under which the feature is available or disabled — the no-training commitment is user-favorable.
How to read this page: Overall risk rates what FlowManual's own policy terms mean for your prompts, outputs, and data. The benchmark bands below grade those same verified terms relative to peers — a platform in a risky-by-default category can rate HIGH risk and still grade STRONG against its peer set. Both trace to the cited findings.
Partially verified — Privacy Policy — Verified (read in full, 23 findings); Terms of Service — Capture pending. Findings below are from fully-read, verified documents only; remaining core documents are pending capture.
Held for review
A core policy document failed verification or contains contested evidence that must not be treated as fully verified.
- Privacy PolicyVerified - read in full - 23 citationsLast captured 2026-08-07
- Terms of ServiceCapture pending
Only citation-backed plan differences are shown here; absent cells mean AIRIN has not verified a tier-specific claim.
This segment identifies Anthropic as the analysis subprocessor, states that only extracted plain text (not raw files) is transmitted, and discloses that Anthropic operates under a zero-data-retention policy prohibiting storage of prompts/responses and prohibiting use of that data to train models — this restriction is user-favorable, preventing training use by the subprocessor.
" When you run document analysis, extracted plain text from your documents is sent to Anthropic’s API. Anthropic operates under a zero-data-retention policy: prompts and responses are not stored and are not used to train models. Raw document..."
This segment enumerates additional permitted purposes for data use: automated document analysis via the Anthropic API (extracted text only), storing and displaying user results, and sending service-related emails — limiting processing to these defined purposes.
" To perform automated document analysis using the Anthropic API (extracted text only) To store and display your annotations, comparisons, and analysis results To send service-related emails (account confirmation, material changes to this ..."
This segment identifies optional third-party import connector providers (Microsoft OneDrive/SharePoint, Google Drive, Procore, Dropbox, Egnyte, Docusign, Autodesk Construction Cloud), explains that connectors are off by default, that the service never sees or stores user passwords for those services, and that access tokens are stored encrypted with AES-256-GCM and used only to list and download user-selected files — establishing data minimization and security obligations regarding connector-based data sharing.
" You can connect accounts you already hold with third-party services (Microsoft OneDrive and SharePoint, Google Drive, Procore, Dropbox, Egnyte, Docusign, and Autodesk Construction Cloud) to import PDF documents into your projects. Connecto..."
Clause A states uploaded files are hosted on Microsoft Azure, while Clause B states files are stored on DigitalOcean, making opposing claims about the primary storage provider for the same data.
" For accounts on flowmanual.com, the application, the database, and uploaded files are hosted on Microsoft Azure in the United States. Files are kept on an encrypted volume. Microsoft processes this data on our behalf under a data processing agreement."
" FlowManual processes PDF documents you upload. Files are stored on DigitalOcean, on an encrypted volume, and are encrypted in transit (HTTPS). File bytes are also encrypted at the application layer with AES-256-GCM before they are written to disk. FlowManual staff do not access your document contents."
Within one documentClause A states uploaded files are stored on DigitalOcean, while Clause B states they are hosted on Microsoft Azure, presenting opposing claims about the primary storage provider.
" FlowManual processes PDF documents you upload. Files are stored on DigitalOcean, on an encrypted volume, and are encrypted in transit (HTTPS). File bytes are also encrypted at the application layer with AES-256-GCM before they are written to disk. FlowManual staff do not access your document contents."
" For accounts on flowmanual.com, the application, the database, and uploaded files are hosted on Microsoft Azure in the United States. Files are kept on an encrypted volume. Microsoft processes this data on our behalf under a data processing agreement."
Within one document
Evidence appendix
Showing priority citations first. The full appendix is available for audit trails; not every citation is a severe risk.
" When you run document analysis, extracted plain text from your documents is sent to Anthropic’s API. Anthropic operates under a zero-data-retention policy: prompts and responses are not stored and are not used to train models. Raw document files are never transmitted. See Anthropic’s Privacy Policy ."
This segment identifies Anthropic as the analysis subprocessor, states that only extracted plain text (not raw files) is transmitted, and discloses that Anthropic operates under a zero-data-retention policy prohibiting storage of prompts/responses and prohibiting use of that data to train models — this restriction is user-favorable, preventing training use by the subprocessor.
AI-generated interpretation, not legal advice.
" Web search inside project chat is off by default and only available when we enable it on the hosted service. When you use it, the search query (which can include text from your conversation) is sent to Tavily to retrieve results. Queries are not used to train models. Web search stays off unless we enable it for the hosted service, and it is always off when redaction is active. See Tavily’s Privacy Policy ."
This segment identifies Tavily as an optional web search subprocessor, explains what data is sent (search queries that may include conversation text), states that queries are not used to train models, and describes conditions under which the feature is available or disabled — the no-training commitment is user-favorable.
AI-generated interpretation, not legal advice.
" We do not sell your data. We do not use your document content for advertising. We do not share your data with third parties except as described in Section 3."
This segment prohibits selling user data, prohibits using document content for advertising, and restricts third-party data sharing to what is described in Section 3 — these are user-favorable restrictions limiting commercial and advertising use of personal data.
AI-generated interpretation, not legal advice.
" FlowManual uses strictly necessary session cookies to keep you authenticated. We do not use tracking, advertising, or analytics cookies. No cookie consent banner is required because we do not place any non-essential cookies."
Restricts cookie use to strictly necessary session cookies only, prohibiting tracking, advertising, and analytics cookies — user-favorable limitation on data collection practices.
AI-generated interpretation, not legal advice.
" FlowManual is intended for professional use by adults. We do not knowingly collect personal data from anyone under 18. If we learn we have collected data from a minor, we will delete it promptly."
Restricts collection of personal data from individuals under 18 and obligates the platform to promptly delete any such data inadvertently collected — user-favorable protection prohibiting collection from minors.
AI-generated interpretation, not legal advice.
" Your data is retained until you delete it or request account deletion. Deleted data is removed within 30 days."
Obligates the platform to retain data only until user deletion or account deletion request, and to complete removal of deleted data within 30 days.
AI-generated interpretation, not legal advice.
" We share data with the following processors only as necessary to provide the service:"
This segment states that data is shared with processors only as necessary to provide the service, establishing a data-minimization restriction on the scope of subprocessor data sharing.
AI-generated interpretation, not legal advice.
" We have no marketing or advertising vendors. The hosted service at flowmanual.com uses one privacy-preserving analytics provider (PostHog) to understand product usage: which features are used, how far new accounts get in setup, and where errors happen. These are server-side event counts tied to an account identifier. They never include document content, filenames, or client and vendor names, and we do not use analytics cookies or session recording (see Cookies below)."
This segment states that the service has no marketing or advertising vendors, identifies PostHog as a privacy-preserving analytics subprocessor, describes what analytics data is collected (server-side event counts tied to account identifiers), and explicitly restricts that data from including document content, filenames, or client/vendor names, and prohibits analytics cookies or session recording — these restrictions are user-favorable limitations on the scope of analytics data sharing.
AI-generated interpretation, not legal advice.
" You can choose to let FlowManual use the documents you upload and the corrections you make to improve extraction quality for all customers. This is off by default and applies only if you turn it on from your account settings. You can turn it off at any time from the same setting, which immediately stops any future use of your data for this purpose; it does not undo improvements already made. Data used this way is never sold and never shared with third parties."
This segment creates an opt-in permission allowing the service to use uploaded documents and user corrections to improve extraction quality for all customers; it is off by default, user-controlled, can be withdrawn at any time (stopping future use), and explicitly prohibits selling or sharing such data with third parties — the permission is user-initiated and user-favorable in its default and opt-out structure.
AI-generated interpretation, not legal advice.
" FlowManual (“FlowManual,” “we,” “us,” or “our”) provides a document analysis platform for construction contractors. This Privacy Policy explains what data we collect, how we use it, and your rights regarding that data. By creating an account or using FlowManual, you agree to this Privacy Policy. If you are using FlowManual on behalf of an employer or other organization, you represent that you have authority to bind that organization to this policy."
This segment defines the entity ('FlowManual'), describes the platform's purpose, states that the Privacy Policy governs data collection and use, and incorporates the policy by reference as a binding agreement upon account creation or use; it also extends that binding obligation to organizational representatives.
AI-generated interpretation, not legal advice.
" When you register, we collect your name, email address, and a hashed (one-way encrypted) password. We never store your password in plaintext."
This segment defines what account registration data is collected (name, email, hashed password) and imposes an obligation on the service never to store passwords in plaintext, establishing a security commitment regarding personal data handling.
AI-generated interpretation, not legal advice.
" FlowManual processes PDF documents you upload. Files are stored on DigitalOcean, on an encrypted volume, and are encrypted in transit (HTTPS). File bytes are also encrypted at the application layer with AES-256-GCM before they are written to disk. FlowManual staff do not access your document contents."
This segment describes how uploaded PDF files are stored and secured (encrypted volume, HTTPS, AES-256-GCM encryption), names the hosting provider (DigitalOcean), and states that staff do not access document contents — imposing confidentiality and security obligations on the service with respect to uploaded user documents.
AI-generated interpretation, not legal advice.
" FlowManual extracts plain text from your uploaded documents. This text is stored encrypted in our database and is used to power document analysis features. Raw document files are never transmitted to the analysis provider. Only the extracted plain text is sent."
This segment describes how extracted text is stored (encrypted in the database) and used (to power analysis features), and imposes a restriction that raw document files are never transmitted to the analysis provider — only extracted plain text — limiting the scope of third-party data sharing in a user-favorable way.
AI-generated interpretation, not legal advice.
" Annotations, comparison discrepancies, scope gaps, cost estimates, RFI entries, equipment schedules, vendor price history, and GC pattern observations you generate are stored in our database, encrypted at the field level."
This segment enumerates the types of analysis results stored (annotations, comparisons, cost estimates, etc.) and specifies that they are encrypted at the field level in the database, establishing a data security obligation regarding user-generated output data.
AI-generated interpretation, not legal advice.
" To perform automated document analysis using the Anthropic API (extracted text only) To store and display your annotations, comparisons, and analysis results To send service-related emails (account confirmation, material changes to this policy)"
This segment enumerates additional permitted purposes for data use: automated document analysis via the Anthropic API (extracted text only), storing and displaying user results, and sending service-related emails — limiting processing to these defined purposes.
AI-generated interpretation, not legal advice.
" We implement industry-standard safeguards including AES-256-GCM encryption for sensitive data, HTTPS-only transport, hashed passwords (scrypt, memory-hard), and no plaintext storage of credentials. No security measure is perfect; please notify us immediately if you suspect unauthorized access to your account. For a technical overview of how we protect your data, see our Security page ."
Obligates the platform to implement specified technical safeguards (encryption, HTTPS, hashed passwords, no plaintext credential storage) and disclaims perfection of security measures while requiring users to report suspected unauthorized access.
AI-generated interpretation, not legal advice.
" You have the right to: Access: Request a copy of the data we hold about you. Correction: Request correction of inaccurate data. Deletion: Request deletion of your account and associated data. We will complete the deletion within 30 days. Portability: Request an export of your data in a machine-readable format. To exercise any of these rights, email us at legal@flowmanual.com ."
Grants users enumerated rights including access to, correction of, deletion of, and portability of their personal data in machine-readable format, and specifies the procedure for exercising those rights via email, with a 30-day deletion completion obligation.
AI-generated interpretation, not legal advice.
" We may update this Privacy Policy from time to time. For material changes, we will notify you by email at least 30 days before the new policy takes effect. Continued use of FlowManual after the effective date constitutes acceptance of the updated policy."
Establishes the procedure for policy updates, requiring at least 30 days advance email notice for material changes and deeming continued use after the effective date as acceptance of the updated policy.
AI-generated interpretation, not legal advice.
Common questions about FlowManual's policies
- Does FlowManual train its AI models on your data?
- No training on your content by default — based on 3 verified findings from FlowManual's published policy. Informational only, not legal advice.
Clause detail — protections, your obligations, and coverage
Every clause below is a verbatim quote from FlowManual's own published policy, read in full and linked to its exact location. Protections and user obligations are reported separately from risk because they are different kinds of clause — an obligation on you is not a risk to your data. Informational only, not legal advice.
✅ Protections found
0 verified clausesClauses in FlowManual's policies that work in your favour — commitments the platform made to you.
No protective clause has been verified in FlowManual's published policies yet. That means we did not find one in the documents we read — not that the platform offers nothing.
📋 Rules you must follow
0 verified clausesWhat FlowManual requires of YOU. These are your obligations, not risks to your data or IP, so they are cited here and excluded from this platform's risk rating.
No user-conduct rule has been verified in FlowManual's published policies yet.
What the policies actually cover
0 topicsNone of FlowManual's verified clauses has been assigned a topic yet. The clause-trust review has not reached this platform's findings.
Cross-clause notes
Two verified clauses intersect on the same subject matter: the Privacy Policy, Privacy Policy › “Usage Metadata” addresses how long content is retained, and the Privacy Policy, Privacy Policy › “Service improvement (optional)” addresses use of content in connection with model training or service improvement. Both clauses are in force at the same time — read them together.
Automated cross-reference against the published rubric — not legal advice.
Clause intelligence
Canonical clauses and stance patterns extracted from the same gate-verified citations shown on this page.
The clause provides a deletion or time-bounded retention path.
“Your data is retained until you delete it or request account deletion. Deleted data is removed within 30 days.”Open source citation
The clause provides a deletion or time-bounded retention path.
“Your data is retained until you delete it or request account deletion. Deleted data is removed within 30 days.”Open source citation
The clause provides a deletion or time-bounded retention path.
“Your data is retained until you delete it or request account deletion. Deleted data is removed within 30 days.”Open source citation
The clause permits sale of personal data or information.
“We do not sell your data. We do not use your document content for advertising. We do not share your data with third parties except as described in Section 3.”Open source citation
The clause permits sale of personal data or information.
“We do not sell your data. We do not use your document content for advertising. We do not share your data with third parties except as described in Section 3.”Open source citation
Tier matrix
Plan-level conditions detected from citation-backed clauses. Empty tiers mean AIRIN has not captured decisive tier language yet.
| Tier | Surface | Verdict | Risk | Citations |
|---|---|---|---|---|
| All applicable tiers | data retention | improves | LOW | 3 |
| All applicable tiers | privacy data use | worsens | HIGH | 2 |
| All applicable tiers | subprocessors data sharing | worsens | HIGH | 4 |
| All applicable tiers | training use | improves | LOW | 5 |
| Api | training use | improves | LOW | 3 |
Policy evolution
Open full timelineBefore/after stance changes across captured policy versions. When no material delta exists yet, AIRIN shows the latest citation-backed stance events instead.
Latest stance: third party or vendor sharing on subprocessors data sharing
“We do not sell your data. We do not use your document content for advertising. We do not share your data with third parties except as described in Section 3.”Open timeline citation
Latest stance: sale or sell on subprocessors data sharing
“We do not sell your data. We do not use your document content for advertising. We do not share your data with third parties except as described in Section 3.”Open timeline citation
Latest stance: no training claim on training use
“When you run document analysis, extracted plain text from your documents is sent to Anthropic’s API. Anthropic operates under a zero-data-retention policy: prompts and responses are not stored and are not used to train models. Raw document files are never transmitted. See Anthropic’s Privacy Policy .”Open timeline citation
Latest stance: no training claim on training use
“When you upload a document, the PDF may be sent to Microsoft Azure Document Intelligence (United States region) to read its layout, tables, and text. Azure processes the file for that purpose only: it does not use your documents to train models, and analysis data is deleted within 24 hours. You can ask us to turn this off for your account, in which case parsing runs only on our own servers. See Microsoft’s data and privacy documentation .”Open timeline citation
Latest stance: no training claim on training use
“Web search inside project chat is off by default and only available when we enable it on the hosted service. When you use it, the search query (which can include text from your conversation) is sent to Tavily to retrieve results. Queries are not used to train models. Web search stays off unless we enable it for the hosted service, and it is always off when redaction is active. See Tavily’s Privacy Policy .”Open timeline citation
Latest stance: deletion or time bound on data retention
“Your data is retained until you delete it or request account deletion. Deleted data is removed within 30 days.”Open timeline citation
Latest stance: deletion or time bound on data retention
“Your data is retained until you delete it or request account deletion. Deleted data is removed within 30 days.”Open timeline citation
Latest stance: sale or sell on subprocessors data sharing
“We do not sell your data. We do not use your document content for advertising. We do not share your data with third parties except as described in Section 3.”Open timeline citation
Capture recency
- Privacy Policy:Last captured 2026-08-07· verified 2026-08-07
- Terms of Service:Last captured 2026-07-28
Dates state when our pipeline captured and verified each document — not when the vendor last changed it. Documents are re-scanned on a recurring cadence; a document verified once says so until a re-scan confirms it again.
59 findings first captured First scan: July 2026.
Compare and stack are saved in your browser. Open compare · View your stack. A correction triggers an automated re-read of FlowManual's policies — no human edits the data.
Need this for procurement or legal diligence?
Free shows today's risk. A Stack Audit gives you a citable, verbatim-sourced PDF across your whole AI stack — and flags the moment a vendor's terms change.
Know where the missing document lives?
We haven't yet verified FlowManual's Terms of Service. Point us at the official page and our pipeline will attempt to capture and read it in full. Submissions are candidates only — nothing is published until it passes the same verification gates as every other document on this site.
Every finding above is a verbatim quote from FlowManual's own published policy, captured to an immutable snapshot and read in full through a two-gate verification pipeline. Confidence labels and any analysis are AI-generated and informational only — not legal advice.
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.