flowscope procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Our infrastructure and the infrastructure of our subprocessors is located in the United States . If you access our Services from outside the United States, your personal information will be transferred to, stored in, and processed in the United States.” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Depending on where you live, you may have some or all of the following rights:” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Access — ask what personal information we hold about you.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ You can request deletion of your personal information at any time — see Section 9.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Website-visitor and demo-request data : retained until you request deletion, or until we no longer have a legitimate business need, whichever is earlier.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ We retain personal information for as long as we have a business need, as required to provide the Services, or as required by law.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Account-level and billing information : retained for the life of the account plus any period required by law (generally up to seven years for tax and accounting records).” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Backups : expire on a standard rolling cycle dictated by our infrastructure providers.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Workforce-captured data (data we process on behalf of an employer): retained for the duration of our contract with the employer. On contract termination or on documented request from the customer or a data subject, we delete or return the data.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We use a third-party B2B visitor identification service to identify the organization associated with visitors to our website, and (for visitors located in the United States, where the service supports it) the individual professional contact associated with the visit. Such services typically perform identification using IP-to-organization matching, first-party cookies, and the provider’s identity graph drawn from cookies and accounts on partner websites. For visitors located outside the United States, identification is generally restricted to organization-level information and excludes personal data.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Maverick Intelligence Inc. B2B visitor identification ” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We share personal information only as described below:” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Law enforcement, regulators, and other authorities , when we believe in good faith that disclosure is required by law, court order, or similar legal process.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ For data collected about website visitors and people who contact us directly, we act as a controller . For data captured from employees on behalf of their employer, we act as a processor — the employer is the controller, and the employer’s own privacy notice governs the employer-employee relationship.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Successors , in connection with a merger, acquisition, financing, reorganization, or sale of all or substantially all of our assets. If your personal information is affected, we will take reasonable steps to ensure it remains subject to protections substantially similar to this Privacy Policy.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Service providers (subprocessors) who operate parts of our infrastructure under written contracts that restrict their use of personal information. The subprocessors that support this website are:” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Our website uses Google Analytics 4 (provided by Google LLC) for more granular usage analytics. Google Analytics 4 sets first-party cookies and processes information that may include device identifiers, IP addresses (truncated by Google before storage), pages visited, session duration, referrer, device characteristics, and interaction events. Data is processed by Google in the United States and other countries. You can opt out of Google Analytics across all sites by installing the Google Analytics opt-out browser add-on .” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ We do not sell or rent personal information. We do not share personal information for third-party cross-context behavioral advertising. We have not done so in the preceding twelve months and have no current plan to do so. ” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Your employer , when we are acting as their processor and delivering analytics, reports, or other outputs derived from workforce-captured data.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ The subprocessors that process data captured through the flowscope product (cloud hosting, managed database, PII redaction, document text extraction, LLM inference, and transactional email) are maintained as a single, current list at trust.flowscope.com/subprocessors , which we update whenever those subprocessors change. Material additions will also be reflected in this Privacy Policy.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Our website also uses Maverick Intelligence Inc. for B2B visitor identification, which helps us identify organizations associated with website visitors (see Section 2.4 for more details).” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ The current provider is named in the subprocessor list in Section 5. This service runs only after you accept analytics and identification cookies via our cookie banner. To withdraw consent, use the “Manage cookie preferences” control in our footer and choose Decline. To request a current opt-out URL, contact us at founders@flowscope.com .” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We may add, remove, or change analytics, visitor-identification, or website-operations tools over time. When we make such a change, we will update this Privacy Policy.” | Captured 2026-07-20Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.