Privacy Policy

We collect information that you provide directly, information generated when you use the Services, and information that you authorize us to receive from connected systems.

Information you provide may include your name, business email address, telephone number, company, role, account information, support requests, communications, and other information you choose to submit.

When you use our Website or Services, we may automatically receive technical and usage information such as your IP address, browser type, operating system, device information, referring pages, pages viewed, dates and times of access, feature interactions, and diagnostic or audit logs.

If you connect a third-party service or upload business records, we process the information you direct us to access. Depending on the workflow, this may include spreadsheets, files, orders, product records, inventory records, supply-chain records, and workflow outputs.

When you authorize ManuFlow to connect to a third-party service, we receive and process information made available through that service according to the permissions you grant. This may include account or service identifiers, authorization metadata, granted access scopes, connection credentials, business records, and other information needed to provide the integration and related Services.

For Shopify connections, we collect and store the store's myshopify.com domain, shop name, authorization metadata, granted access scopes, and an encrypted Shopify access token. We use these credentials only to provide the merchant-authorized integration and related Services.

Through Shopify's APIs, the Services may read product and variant information, product titles, SKUs, inventory item identifiers, inventory levels and quantities, and related catalog information.

The Services may also read order and fulfillment information, including order identifiers and names, timestamps, financial and fulfillment status, totals and currency, line-item titles, quantities and SKUs, fulfillment timestamps and status, and order source or sales channel. Order and fulfillment records can relate to a merchant's customers even when they do not contain direct contact details.

Our current Shopify integration is designed not to request customer names, email addresses, telephone numbers, or billing or shipping addresses. ManuFlow does not install tracking technology on a merchant's Shopify storefront and does not directly collect information from visitors to a merchant's storefront.

For QuickBooks Online connections, we collect and store the QuickBooks company identifier, verified company name, authorization and expiration metadata, and encrypted access and refresh tokens. We use this information only to establish, maintain, display, refresh, reconnect, and disconnect the QuickBooks integration that the customer authorizes.

During the current connection-validation phase, ManuFlow uses Intuit's APIs only to read basic CompanyInfo needed to verify which QuickBooks company the customer selected. ManuFlow does not yet use the integration to read other accounting records or to create, change, or delete accounting records. We will update this Policy before enabling broader QuickBooks data access or accounting actions.

ManuFlow requests only the QuickBooks accounting scope. We do not request the QuickBooks Payments or OpenID identity scopes, and we do not process payments, move funds, handle payment card information, or obtain the connecting user's Intuit identity through Intuit's APIs.

A customer workspace owner or administrator may disconnect QuickBooks from ManuFlow. ManuFlow first asks Intuit to revoke the stored authorization and then deletes the local QuickBooks connection credentials. A temporary revocation failure leaves the encrypted credential in place only so the customer can safely retry the revocation.

You control whether to connect third-party services and may disconnect them through the Services. Disconnecting prevents further API access and removes the stored connection credential, subject to the retention and legal requirements described below.

Connecting Gmail to ManuFlow is optional. Before you connect, Google shows you the permissions ManuFlow requests: read access to your mailbox and permission to manage drafts and send email. Google includes sending in the permission needed to create drafts. ManuFlow uses this access only for the order-release features described here and does not send email from your Gmail mailbox.

When you approve a release email in ManuFlow, we create a draft in your connected Gmail mailbox with the recipients, message, and purchase order attachment. You review, edit, and send the draft yourself in Gmail. ManuFlow does not send it for you.

ManuFlow reads new messages to identify release correspondence: sent messages and replies in release conversations, incoming messages from addresses used as release recipients, and messages you explicitly link to an order. We use relevant messages and attachments to confirm that a release email was sent and identify pickup or confirmation numbers. We show these results with supporting email evidence in ManuFlow and may record them in your connected Orders spreadsheet as part of the release workflow you authorize.

We store your connected mailbox address, granted permissions, and encrypted connection credentials. We retain copies of release drafts and the complete email messages identified as release correspondence, including message bodies, headers, embedded attachments, sender, recipients, subject, timestamps, labels, and Gmail identifiers, as evidence supporting your order history. Relevant PDF attachments are also stored separately for processing. Messages identified as unrelated are discarded without retaining their content, headers, or attachments.

To read scanned PDF attachments in release replies, ManuFlow sends images of relevant pages to Google's Gemini API, which returns text used to identify a pickup or confirmation number.

We use Gmail data only to provide and improve these order-release features. With your consent, service providers may process it on our behalf only as necessary to deliver these features, under confidentiality and security obligations.

We do not sell Gmail data or use it for advertising, creditworthiness or lending decisions, or creating, training, or improving artificial intelligence or machine-learning models. Gemini processes attachments to extract text; it does not train a model on them. These restrictions also apply to aggregated, anonymized, or derived Gmail data and to the service providers that process it on our behalf.

Human access to Gmail data, including access by our personnel and service providers, is limited to specific messages, attachments, or other data for which we have first obtained and documented your affirmative permission, access necessary for security purposes, or access required by law. Other disclosures are limited to providing these order-release features with your consent, security purposes, legal requirements, or a merger, acquisition, or asset sale with your explicit prior consent.

A workspace owner or administrator may disconnect Gmail in ManuFlow. This stops further Gmail access through that connection and removes the connection credentials stored by ManuFlow. You can separately revoke ManuFlow's authorization through the third-party connections page of your Google Account. Revoking authorization at Google prevents further authorized access but does not automatically remove ManuFlow's local connection record. If you have already revoked authorization and cannot disconnect in ManuFlow, contact founders@manuflow.ai to request removal of the stored connection credentials.

Disconnecting Gmail or revoking its authorization does not by itself delete previously retained release records from ManuFlow. We keep these records as order history while your ManuFlow account is active. If you close your account or tell us that you will not proceed with ManuFlow, we delete retained Gmail messages, attachments, and data derived from them from our systems within 90 days, unless retention is required by law. You may request deletion sooner by contacting founders@manuflow.ai. We may need to verify your identity and authority over the workspace before fulfilling a request, and will explain any retention required by law. Deleting ManuFlow's stored copies does not delete the originals in your Gmail mailbox or records in spreadsheets you control.

ManuFlow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

We use information to provide, operate, maintain, and improve the Services; authenticate users and connected systems; perform merchant-requested workflows; reconcile products, orders, fulfillments, and inventory; provide support; communicate about accounts, security, updates, and requested services; monitor performance; prevent fraud or misuse; comply with law; and protect the rights, safety, and integrity of ManuFlow, our users, and others.

ManuFlow does not share one customer's QuickBooks data with another customer and does not use raw QuickBooks customer data to produce cross-customer insights.

For data other than Google user data or data derived from it, we may create aggregated or de-identified information that cannot reasonably be used to identify a merchant, customer, or individual. We use only that aggregated or de-identified information for internal development and improvement of our proprietary artificial intelligence and machine-learning systems and for internal benchmarking. We do not use raw merchant data or personal information to train generalized models. We do not use Google user data or data derived from it to create, train, or improve artificial intelligence or machine-learning models. Gmail data and data derived from it are subject exclusively to the uses described in Gmail Data above.

We may send service-related messages. Where permitted, we may also send marketing emails about ManuFlow. You may opt out of marketing emails at any time by using the unsubscribe link in the message or contacting us.

We may disclose information to service providers that process information on our behalf, such as providers of cloud hosting, databases, authentication, analytics, communications, security, customer support, and artificial intelligence services used to deliver the Services. These providers are permitted to process information only for the services they provide to us and subject to applicable contractual obligations.

We may disclose information to professional advisers, auditors, insurers, financing sources, or potential transaction counterparties where reasonably necessary; to comply with law, regulation, legal process, or governmental request; to enforce agreements or protect rights and safety; or in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of our business or assets. The narrower disclosure restrictions in Gmail Data apply to Gmail data and data derived from it.

We do not sell personal information for monetary consideration.

We use cookies and similar browser storage where necessary to operate the Website and Services. Cookies may remember preferences, support authentication, and help us understand how the Website is used.

We use Google Analytics and PostHog to measure Website visits and interactions. These tools may collect information such as IP address, device and browser information, referring pages, pages visited, and interaction events. PostHog also records clicks, scrolling, and mouse movement to produce heatmaps and session recordings of Website visits, which we use to improve the Website. Text typed into form fields is masked in these recordings. At present, Google Analytics and PostHog are the only analytics or tracking technologies we use on the Website.

You can configure your browser to block or delete cookies, although doing so may affect some Website or Service features. You can also use Google's browser add-on to opt out of Google Analytics. If your browser sends a Do Not Track signal, PostHog does not collect information about your visit.

We retain personal information for as long as reasonably necessary to provide the Services, maintain security and business records, resolve disputes, and comply with legal obligations.

Unless a longer period is required or permitted by law, we generally delete or de-identify personal information within 90 days after the relevant account is terminated or the connected service is disconnected. Disconnecting Gmail while your ManuFlow account remains active does not start this deletion period for release records retained as order history. As described in Gmail Data, we delete those records within 90 days after you close your account or tell us you will not proceed with ManuFlow, unless retention is required by law. When a connected platform sends a valid privacy or redaction request, we respond according to applicable platform requirements. For Shopify customer or shop redaction requests, we delete or de-identify the applicable Shopify-associated information within 30 days after receipt, unless we are legally required to retain it.

We may retain aggregated or de-identified information that cannot reasonably identify a merchant, customer, or individual for longer periods. This does not override the deletion commitments for Gmail data or data derived from it.

We use reasonable physical, technical, and administrative safeguards designed to protect information against unauthorized access, loss, misuse, alteration, or disclosure. These measures include access controls and encryption for stored connection credentials, including Shopify access tokens, QuickBooks access and refresh tokens, and Google access and refresh tokens. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Depending on where you live and subject to applicable law, you may have rights concerning your personal information. We may need to verify your identity before fulfilling a request.

• Request access to or a copy of personal information we maintain about you.
• Request correction of inaccurate personal information.
• Request deletion of personal information.
• Request restriction of or object to certain processing.
• Request data portability where applicable.
• Withdraw consent where processing is based on consent.
• Appeal a decision concerning a privacy request where applicable.

To exercise a privacy right, contact us at founders@manuflow.ai. You may also authorize an agent to submit a request where permitted by law. We will not discriminate against you for exercising an applicable privacy right.

Connected platforms may provide mechanisms for merchants, customers, or other data subjects to make privacy requests. We respond to applicable platform requests according to law, our contractual obligations, and platform requirements.

For Shopify, this includes applicable customers/data_request, customers/redact, and shop/redact requests received through Shopify's mandatory compliance processes.

For a valid data request, we identify responsive information associated with the identifiers the platform provides. For a valid Shopify customer or shop redaction request, we delete or de-identify the applicable Shopify-associated information within 30 days after receipt unless retention is legally required. Privacy requests concerning Shopify or other connected services may also be submitted directly to founders@manuflow.ai.

ManuFlow is based in the United States, and information may be processed in the United States and other countries where we or our service providers operate. Those countries may have data-protection laws that differ from the laws where you live. Where required, we use appropriate safeguards for international transfers of personal information.

The Services are intended for business users and are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, contact us so that we can take appropriate action.

The Website or Services may link to third-party websites or services. We do not control those third parties, and their privacy practices are governed by their own policies.

We may update this Policy from time to time. We will post the updated version on this page and revise the effective date. If a change is material, we will provide additional notice where required by law. Before accessing Google user data that was not previously disclosed, or using Google user data in a new way or for a different purpose, we will notify you and obtain your consent.