Privacy Policy

• Account data. Your name, email address, a salted and hashed password, your plan, and the date you completed onboarding.
• Workspace data. The projects, governance rules, roadmap items, risks, dependencies, assessments, decisions, and review notes you create in ORsFlow.
• Session data. A session identifier stored in an httpOnly cookie, plus its creation and expiry time, so you stay signed in.
• Operational logs. Server error logs used to diagnose failures. We do not run third-party advertising or cross-site tracking on ORsFlow.

We use your data to operate the service: to authenticate you, store and restore your workspace, generate the recommendations ORsFlow is built to provide, process subscription payments, and respond to support requests. We do not sell personal data, and we do not use your workspace content for advertising.

Account and workspace data are stored in a managed PostgreSQL database. Passwords are never stored in recoverable form — they are hashed with scrypt and a per-user salt. Session cookies are httpOnly, SameSite protected, and marked Secure in production, so they cannot be read by page scripts.

ORsFlow relies on a small number of infrastructure providers acting as processors on our behalf: an application hosting provider, a managed database provider, and — for paid plans — a payment processor that handles card details directly. Card numbers never reach ORsFlow servers.

We keep your data for as long as your account is active. Deleting your account from the profile page permanently removes your account record, your sessions, and every workspace document associated with it. Backups age out on their normal rotation.

You can access and correct your account details in ORsFlow, export your workspace from the export surfaces, and delete your account at any time. Depending on where you live, you may also have rights to portability, restriction, or objection. Contact us and we will action verified requests.

ORsFlow is a business tool and is not directed at children under 16. We do not knowingly collect their data.

We will post material changes to this policy on this page and update the date above. Privacy questions: Contact & Support, Sentinel Fortune LLC.