flow, by ufirst — invoice approval software · Last updated: August 29, 2026
This Privacy Policy explains how ufirst LLC ("flow", "we", "us") collects, uses, and protects personal data when you or your organization use flow. It applies alongside our Terms of Service.
Account information — name, email address, and company name when you or your organization's admin creates an account. Document content — the invoices, vendor statements, and related files your organization submits for processing, including any vendor, financial, or contact details they contain. Usage data — log and activity data (such as sign-ins, documents processed, and feature usage) needed to operate and improve the service. If you connect QuickBooks Online, we also access the accounting data you authorize.
To provide the service — routing invoices through your approval workflow, extracting document data, syncing to QuickBooks Online when connected, and billing your organization's chosen plan; to communicate with you about your account, including service notices and, only if you've opted in, product updates and offers; and to monitor, secure, and improve flow.
We rely on a small number of third-party service providers to operate flow, each processing data only as needed for its function: Supabase (database and file storage), OpenRouter (routes documents to AI models for data extraction), Resend (transactional email delivery), Stripe (payment processing), and, where you choose to connect it, QuickBooks Online / Intuit (accounting sync). We may update this list as the service evolves; material changes will be reflected here.
We retain your organization's data for as long as the account is active, plus a reasonable period afterward to allow reactivation, meet legal or accounting obligations, and resolve disputes. You may request deletion of your organization's data after account closure, subject to any retention we're required to keep by law.
We use industry-standard safeguards — including encryption in transit, access controls scoped to your own organization's data, and restricted internal access — to protect the information you submit. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.
Our service providers may process and store data in countries other than your own. Where personal data is transferred internationally, we rely on appropriate safeguards required by applicable law.
Depending on your location, you may have the right to access, correct, export, or request deletion of your personal data, or to object to certain processing. To exercise these rights, contact us at hello@ufirst.co; we'll respond within the timeframe required by applicable law. If your data was submitted to flow by your employer or another organization, we may direct your request to that organization, since they control the account.
We use a limited set of cookies necessary to keep you signed in and to remember basic preferences. We do not use third-party advertising cookies.
flow is a business tool not directed at children, and we do not knowingly collect personal data from anyone under 16.
We may update this Privacy Policy from time to time. For material changes, we will provide reasonable notice, such as an in-app notice or an email to your organization's admin, before the change takes effect.
Questions about this policy, or requests relating to your personal data, can be sent to hello@ufirst.co.