Privacy Policy
Last updated: 23 October 2026
Who is responsible
ApprovedFlow, operated from the State of Qatar, is responsible for the personal data described here. For the content an organization puts into the platform, that organization decides what is collected and why, and we process it on its behalf. Contact: [email protected].
What we collect
Account details (name, email address, organization); the content your organization puts into the platform (projects, tasks, documents, comments, timesheets); and the records needed to run and secure the service (sign-ins, device and log data). We do not collect card numbers: payments are handled by Paddle, our merchant of record.
Our website
Our website uses analytics cookies (Google Analytics and PostHog) only after you agree in the cookie bar. You can refuse them, and the website works the same. To find and fix problems, PostHog also records how our website, the registration and, during an organization's first month, the platform are used, with every typed value and every document hidden and each person known only by an anonymous number.
How we use it
To provide the service, keep it secure, bill subscriptions, answer support requests and send service messages (approvals, reminders, invoices). We do not sell personal data, and we do not use your organization's content for advertising. We use data on the basis of our contract with you, our legitimate interest in running a secure service, the law, and, for website analytics, your consent.
Who else receives data
Only the processors needed to run the service: cloud hosting (Google Cloud), email delivery, Paddle for payments (billing details only, never your platform content), and AI model providers when your people use AI features (only the text needed to answer the request). Each is bound by a data processing agreement. These providers may process data outside your country; where the law requires it, we rely on the safeguards it provides for such transfers.
How long we keep it
We keep your data while your organization has an account. If you close the account, we delete or anonymize its content within a reasonable period, except records we must keep by law, such as invoices, and backup copies, which expire on their own schedule.
Security
Encryption in transit, encrypted backups, role-based access inside the platform and an audit log. Access to production data is limited to the people who need it to operate the service.
Your rights
You can ask what personal data we hold about you, and ask us to correct it, export it or delete it, subject to what the law requires us to keep. If your data came from an organization's account, we may pass your request to that organization. Email [email protected]; we answer within 30 days. You can also complain to the data protection authority of your country.
Changes
If this policy changes in a way that matters, we tell account owners by email or in the product before the change takes effect.