Privacy Policy

TeamFlow ("we", "our", or "us") is a multi-tenant project management SaaS platform built to enable secure, real-time collaboration across teams, organizations, and projects. TeamFlow is created and maintained by Anup Kumar, currently studying at IIT Dhanbad. This Privacy Policy outlines how we collect, store, process, and protect your personal and organizational data when you interact with our application and APIs.

We collect information required to provide, secure, and improve our services. This includes personal identifiers (name, primary email address, profile avatar), account credentials managed via Clerk authentication, and user-generated project content including tasks, comments, attachment metadata, and workspace settings.

We use collected data solely for operating TeamFlow, enforcing multi-tenant organization access controls, facilitating Socket.IO real-time updates, processing transactional emails via Resend (such as member invitations and task notifications), generating AI standups, and protecting our infrastructure against unauthorized access.

Authentication in TeamFlow is powered by Clerk. Your single TeamFlow identity is tied to your secure Clerk user ID. One user identity may be associated with multiple verified email addresses and belong to multiple independent organizations with scoped role-based access control (ADMIN, MANAGER, DEVELOPER, VIEWER).

Organizations created within TeamFlow represent strict multi-tenant boundaries. Organization data (such as workspace name, logo URL, domain, and member rosters) is isolated. Members of an organization only access resources within workspaces where active membership has been explicitly granted.

Projects, Kanban board columns, task statuses, due dates, priority assignments, and comments created within a workspace are stored securely in our PostgreSQL database using Prisma ORM. Access is enforced on the backend via authorization middleware and role-based permissions.

Files uploaded to tasks are stored securely via Cloudinary integration. Executable file formats (.exe, .sh, .bat, .dll) are strictly blocked for security. Attachment URLs are associated directly with specific tasks and accessible only to authorized workspace members.

TeamFlow offers AI-assisted standups, task breakdowns, and discussion summaries. AI queries process only the relevant text prompts and project context explicitly sent to Google Gemini API endpoints. Data submitted to AI processing is used strictly to produce real-time responses and is not used to train public AI models.

We partner with reputable infrastructure providers to deliver our service: Clerk for authentication & identity management, Resend for transactional email delivery, Cloudinary for media storage, Redis for real-time pub/sub, and PostgreSQL for relational data storage. Each provider processes data in compliance with strict privacy standards.

We enforce industry-standard security controls including TLS/HTTPS encryption in transit, cryptographically signed invitation tokens with mandatory 24-hour expiration periods, rate limiting, system prompt injection defenses, and strict backend authorization middleware preventing cross-tenant IDOR vulnerabilities.

We retain user account and workspace data for as long as your account or organization remains active. Revoked or expired invitation tokens are automatically cancelled. Users or workspace administrators may request complete deletion of their account or organization data.

You have the right to inspect, update, or remove verified email addresses associated with your TeamFlow account, leave organizations, manage notification preferences, and request export or deletion of your personal data by contacting our support team.

TeamFlow uses essential cookies and local storage items (such as `teamflow_active_org_id`) necessary for authentication sessions, active workspace context retention, and security verification. We do not use third-party tracking cookies for targeted advertising.

We may update this Privacy Policy periodically to reflect enhancements in TeamFlow features or regulatory requirements. Any modifications will be posted on this page with an updated revision date.

If you have questions, privacy requests, or security inquiries regarding this policy or TeamFlow data practices, please reach out to Anup Kumar at mangorango2004@gmail.com or +91 98XX XXX 4821.