Privacy Policy

Last updated: April 16, 2026

This Privacy Policy describes how Verflo ("we", "us", or "our") collects, uses, and shares information in connection with the Verflo field task verification service (the "Service"). By using the Service, you agree to the practices described below.

1. Information We Collect

We collect the following categories of information:

• Account information: name, email address, and password (stored as a bcrypt hash) for project managers and administrators who create accounts.
• Team member information: name, phone number, email address (for PMs/Admins), preferred language, role, and job trade of field workers added to a workspace by a PM or administrator.
• Task data: task titles, descriptions, due dates, locations, assignment records, photo attachments, status history, and timestamps.
• SMS message content: the body of messages exchanged between PMs, field workers, and our automated system, including any media attachments (e.g., photos sent as MMS).
• Billing information: subscription plan, billing address, and payment records. Payment card details are handled directly by Stripe and are not stored on Verflo servers.
• Usage and log data: access timestamps, IP addresses, and internal identifiers used to operate and secure the Service.

2. How We Use Information

We use the information we collect to:

• Deliver the Service, including creating tasks, routing SMS messages to the correct workers, and displaying status updates to PMs.
• Send SMS notifications and reminders to field workers and PMs as part of normal task flow.
• Send account-related emails such as welcome messages, password resets, and team invitations.
• Process subscription payments and manage billing.
• Monitor service health, prevent abuse, and respond to security incidents.
• Translate messages between a worker's preferred language and English so PMs and workers can communicate.

We do not sell personal information, and we do not use personal information for advertising.

3. Who We Share Information With

We share information only with service providers that help us operate the Service. These providers are contractually bound to use the information only for the purposes described below:

• Twilio — for sending and receiving SMS/MMS messages. Phone numbers and message content are transmitted to Twilio to complete delivery.
• Stripe — for subscription billing and payment processing. Billing contact info and subscription details are shared with Stripe.
• Resend — for transactional email delivery (welcome, password reset, and invite emails).
• Google Cloud Translation — for translating messages between supported languages. Only the text to be translated is sent; no account or identifier information is attached.
• Railway — our hosting and database provider, which stores the Service's application data.

We may also disclose information when required by law, subpoena, or court order, or to protect the rights, safety, or property of Verflo, our users, or the public.

We do not sell personal information to third parties.

4. Data Retention

We retain account and task data for as long as your account is active. If you close your account, we will retain data for up to 90 days for backup and dispute-resolution purposes, after which we will delete or anonymize personal information except where we are required by law to retain it (e.g., billing records retained for tax purposes).

5. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• The right to access a copy of the personal information we hold about you.
• The right to correct inaccurate or incomplete information.
• The right to request deletion of your personal information, subject to our retention obligations.
• The right to object to or restrict certain processing activities.
• The right to opt out of SMS messages by replying STOP to any message. Workers who opt out will not receive further task-related texts.

To exercise any of these rights, contact us at noreply@verflo.app.

6. Cookies and Local Storage

Verflo does not use advertising or tracking cookies. We use browser localStorage to store your authentication token (verflo_token) and basic user information (verflo_user) so you stay signed in between sessions. We do not use third-party analytics services that set cookies.

7. Security

We take reasonable administrative, technical, and physical measures to protect your information, including encrypted HTTPS transport, hashed passwords (bcrypt), and access controls. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Children's Privacy

The Service is not directed to children under 16, and we do not knowingly collect personal information from children. If we learn that we have collected information from a child under 16, we will delete it.

9. International Users

Verflo is operated from the United States. If you access the Service from outside the U.S., your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced by posting the updated policy with a new "Last updated" date.

11. Contact

For questions about this Privacy Policy or to exercise your rights, contact noreply@verflo.app.