Privacy Policy

1. Scope and who we are

Vertical Flows ("VF", "we", "us" or "our") provides workflow orchestration and structured client collection services for professional-services firms. This policy applies to personal information we handle through our websites, applications, client request links, support channels and related services (together, the "Service").

A firm using VF will often decide what client information is collected and why. In that situation, the firm is responsible for its own privacy obligations and VF handles the information to provide the Service to that firm. The firm's privacy notice may also apply.

2. Information we collect

The personal information we collect depends on how you use the Service and may include:

• Account and identity information: name, work email, organisation, role, authentication records and account preferences.
• Firm and business information: firm profile, branding, team membership, connected-system settings and authorised sender details.
• Client and workflow content: contact details, answers, files, requests, review notes, approvals and other information submitted through a workflow.
• Integration information: identifiers, connection status, authorised scopes and information retrieved from or prepared for systems you choose to connect.
• Billing information: subscription, plan, transaction status and billing contact details. Payment card information is handled by our payment provider rather than stored by VF.
• Usage and device information: browser and device type, approximate location derived from an IP address, timestamps, feature use, diagnostics, security events and audit records.
• Support and feedback: messages, issue details and other information you provide when you contact us.

Some workflows may contain sensitive information, such as tax identifiers or identity documents. A firm should only request sensitive information when it has a lawful reason and appropriate safeguards. Please do not submit sensitive information that the relevant workflow does not request.

3. How we collect information

We collect personal information:

• directly from you when you create an account, use the Service, complete a client request or contact us;
• from a firm or authorised user who creates a request, invites you or provides information about you;
• from systems you or your firm choose to connect and authorise;
• automatically when you use the Service, through essential cookies, local browser storage, logs and security controls; and
• from service providers where needed to operate, secure, support or bill for the Service.

If you provide personal information about another person, you must be authorised to do so and provide any notice or obtain any consent required by law.

4. How we use information

We use personal information to:

• provide, personalise and maintain the Service;
• authenticate users, manage firm access and protect accounts;
• prepare, deliver, complete and review authorised client workflows;
• operate user-authorised integrations and record approval and audit evidence;
• process subscriptions and maintain billing records;
• answer support requests and communicate service or security information;
• monitor reliability, prevent misuse, investigate incidents and improve the Service; and
• comply with law, enforce our agreements and protect people, VF and our customers.

We do not sell personal information.

5. Vee and AI-assisted features

Vee can help interpret instructions, draft content, classify information and suggest workflow steps. Relevant prompts, conversation context and workflow information may be sent to approved AI service providers to produce these features.

Vee is assistive. Its output can be incomplete or incorrect and does not replace professional judgement. VF is designed so that material workflow actions, including sending client requests or preparing changes to connected records, remain subject to the controls and human approvals shown in the Service.

We do not intend Vee to make decisions that significantly affect a person's rights or interests without human review. If our use of automated decision-making changes, we will update this policy and provide any additional notice required by law.

6. When we share information

We may disclose personal information to:

• the firm that controls the relevant workspace and its authorised users;
• clients, recipients or reviewers involved in an authorised workflow;
• infrastructure, hosting, storage, authentication, email, AI, monitoring, support and payment providers that help us operate the Service;
• third-party systems that you or your firm choose to connect, within the access you authorise;
• professional advisers, auditors and insurers who are required to protect the information;
• regulators, courts, law enforcement or other parties where disclosure is required or authorised by law; and
• a buyer, investor or successor in connection with a proposed or completed business transaction, subject to appropriate confidentiality protections.

We require service providers to handle information only for agreed purposes and with appropriate safeguards.

7. Overseas disclosures

VF is designed for Australian professional-services workflows and our default production position is to keep customer payload data and files in Australian-region storage. Some service providers may process limited personal information, metadata or operational records outside Australia.

Overseas locations may include the United States and other countries where our approved service providers operate. The exact locations can change with provider infrastructure and the integrations a firm enables. We assess providers and take reasonable steps to protect personal information in accordance with applicable Australian privacy requirements.

8. Storage, security and retention

We use administrative, technical and organisational safeguards designed to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. No system is completely secure, so users must also protect their credentials and promptly tell us about suspected unauthorised access.

We retain personal information for as long as needed to provide the Service, meet the firm's documented instructions, maintain security and audit records, resolve disputes and comply with legal, accounting or reporting obligations. Retention periods vary by information type and workspace settings. When information is no longer required, we take reasonable steps to delete or de-identify it, subject to backups and lawful retention requirements.

9. Cookies and local storage

The Service uses essential cookies and local browser storage for authentication, security, preferences, session continuity and application operation. These technologies are necessary for requested features to work.

We do not currently use third-party advertising cookies. If we introduce non-essential analytics or similar technologies, we will update this policy and provide any consent controls required by law.

10. Marketing communications

We may send marketing messages where you have consented or where otherwise permitted by law. Commercial electronic messages will identify the sender and provide a clear way to unsubscribe. You can opt out at any time using the unsubscribe option or by contacting us. Service, account and security messages are not marketing and may still be sent where necessary.

11. Access, correction and privacy requests

You may ask to access or correct personal information we hold about you. You may also ask us to delete information, object to or restrict certain handling, or provide a copy of information where applicable. Some requests may need to be directed to the firm that controls the relevant workspace.

Send a request to support@verticalflows.com. We may need to verify your identity and authority before acting. We will respond within a reasonable period and explain any lawful reason we cannot fulfil a request.

12. Privacy complaints

If you believe we have mishandled personal information, email support@verticalflows.com with enough detail for us to investigate. We will acknowledge the complaint, investigate it fairly and tell you the outcome or next steps.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner through oaic.gov.au.

13. Changes to this policy

We may update this policy when our practices, Service or legal obligations change. We will publish the updated policy here, change the effective date and provide additional notice where a change is material or required by law.

14. Contact us