Skip to content

Privacy policy

Last updated:

This policy explains what personal information SOPFlow collects, why we collect it, who we share it with, and the rights you have over it. SOPFlow operates from Miami, Florida, United States; questions about this policy should go to admin@sopflow.io.

1. Who we are

"SOPFlow", "we", "our", and "us" refer to SOPFlow, operating from Miami, Florida, United States, and providing the website at sopflow.io. For any privacy question, you can reach us at admin@sopflow.io.

2. What data we collect

We collect the following information:

  • Account data: the name and email address you provide, and a bcrypt hash of your password (never the plaintext).
  • Workspace content: the organizations, org charts, standard operating procedures, versions, phases, steps, and files you create inside SOPFlow. You own this data.
  • Technical data: IP address, user agent, and timestamps on authentication events and mutations so we can investigate abuse and build an audit trail.
  • Verification and security tokens: hashed email-verification tokens (14-day expiry), bcrypt-hashed 2FA codes (10-minute expiry), and hashed trusted-device tokens (30-day expiry).
  • Contact form submissions: the topic, name, email, subject, body, IP, and user agent of any message you send via our contact form.
  • Recorder browser-extension data (opt-in): if you install the SOPFlow Recorder Chrome extension and click Start Recording, the extension captures the click targets, form-field labels, page URLs, page titles, and screenshots of the supported tabs in the browser window where you start recording. Pause suspends new capture; queued data can continue uploading while paused or after Stop. The recorder also captures selected options, checkbox states, keyboard commands, file names, and notes you save. Input values are masked by default. Password, payment, and one-time-code controls remain masked when you turn off the general input mask. Uninspectable embedded surfaces are hidden in screenshots, and you can manually hide elements. These controls cannot identify every secret. Recordings live inside your workspace and follow the workspace’s deletion and retention process.

The extension stores its connection key, settings, pending actions and redacted screenshots locally in your browser to support retries and recovery. Optional workflow narration requires microphone permission and explicit consent before audio is sent to SOPFlow and OpenAI for transcription. Timestamped transcripts are combined with captured actions and screenshots to draft the SOP. Pause and Finish turn off the microphone. SOPFlow deletes temporary server audio after each transcription attempt. Unsent or failed audio remains in your browser for recovery until you discard it; successfully transcribed local audio is removed. On-device dictation remains available where the browser supports it and does not upload audio. Typed and on-device note drafts stay local until saved. Saved transcripts and notes may be sent to the configured AI provider when drafting instructions. The extension does not record a continuous screen video or capture browsing activity outside a recording session.

Recorder capture starts with an explicit recording session. The website also supports measurement and diagnostics according to its configuration and the consent controls described below.

Recordings can contain interactions, field values, and screenshots. Masking does not guarantee removal of all sensitive information. Deletion can use the trash before final purge; files already imported into an SOP are managed separately. AI features can send selected content to configured providers, including Anthropic or OpenAI. Stripe processes payments; Sentry can process diagnostics when configured, and Google supports measurement under the controls described below.

Support chat privacy notice

SOPFlow stores your support chat messages, any files you choose to share, and contact details you provide to respond to your requests. AI replies are processed by Anthropic. Our support team can review the conversation and contact details to help you. When signed in, requests may include relevant workspace content, subject to your existing permissions. Do not share passwords, payment details, or other sensitive information in chat.

The chat asks you to agree to this notice before starting or loading a conversation. You can close the notice without starting a chat. This choice does not change your website cookie preferences.

3. Why we collect it

We use the data above strictly to:

  • Authenticate you and keep your workspace secure.
  • Enforce role-based permissions and tenant isolation.
  • Detect and respond to abuse (rate limiting, suspicious logins).
  • Maintain an audit trail of who changed what and when.
  • Deliver transactional emails (verification, 2FA, notifications).
  • Respond to your support, sales, or legal requests.

If your organization grants the customer-identification permission in our Terms of Service, we may also display its business name and an approved logo on our website and in digital marketing materials solely to identify it as a customer. This covers business identifiers only and does not authorize disclosure of personal information or private workspace content. You can opt out at any time by emailing admin@sopflow.io; the removal process and timing are described in that section.

4. Lawful basis (GDPR)

If you are in the European Economic Area, the United Kingdom, or another jurisdiction with a GDPR-style lawful-basis framework, we rely on:

  • Contractual necessity — providing the service you signed up for.
  • Legitimate interest — security, abuse prevention, and audit logs.
  • Consent — anything beyond the above, such as receiving a newsletter if we ever offer one (we do not today).

5. Third parties

SOPFlow runs on a single hosted VPS. We use a small number of sub-processors:

  • Hosting: OVH (dedicated IP, single-region).
  • Email delivery: our own Postfix instance on the same host, with DKIM, SPF, and DMARC configured. No third-party ESP.
  • DNS and TLS: standard providers for domain and Let's Encrypt certificates.

The service can use payment, AI, diagnostics, and measurement providers for the functions described here. The categories and consent controls in this policy explain those uses.

6. Cookies and analytics

SOPFlow uses two categories of cookies:

Strictly-necessary (always on)

  • sopflow_token — httpOnly JWT session cookie. Expires in 7 days. Used to authenticate you.
  • sopflow_device — httpOnly 2FA trusted-device token. Expires in 30 days. Used to skip 2FA on a browser you've previously verified.
  • sopflow.theme, sopflow.lang, sopflow.consent — stored in localStorage (not cookies). Remember your light/dark preference, language choice, and your response to the cookie banner. None of these are sent to third parties.

Analytics and advertising

Consent settings can vary by region. The site uses controls for Google Analytics, Google Tag Manager and Google Ads when configured. Review or change your choice through “Manage cookie preferences” in the footer. Rejecting or withdrawing consent disables the corresponding optional storage; consent signals may still be sent to Google. These signals should not be treated as a guarantee of anonymity.

Microsoft Clarity session replay

When enabled and with your explicit consent, Microsoft Clarity collects website interactions, such as clicks, scrolling, page visits, browser and device information, to create heatmaps and reconstruct sessions so we can improve usability. This is separate from the SOPFlow Recorder. We mask page content and exclude sensitive account and authentication routes; masking does not remove all metadata, such as page addresses and titles. We send Clarity an analytics consent signal and deny advertising storage. You can withdraw consent in Settings or through the footer’s cookie preferences. See the Microsoft Privacy Statement for Microsoft’s data practices. Clarity normally retains playback for 30 days, and selected, labeled or favorited sessions and aggregate data for up to 9 months.

7. Data retention

  • Active accounts: data is kept for as long as your account is active.
  • Deleted accounts: removed within 30 days of termination. Backups are rotated out within 90 days.
  • Audit log: retained for 2 years after the corresponding mutation. Kept even after account deletion to meet legal obligations and help investigate disputes.
  • Contact form submissions: retained for 2 years, then deleted unless required to keep longer (e.g., legal hold, open support case).

8. Your rights

Depending on your jurisdiction you may have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate or incomplete data.
  • Erase your data (subject to our legitimate interest in keeping audit logs for up to 2 years).
  • Port your data to another service.
  • Object to processing based on legitimate interest.
  • Lodge a complaint with a supervisory authority in your country of residence.

To exercise any of these rights, email admin@sopflow.io. We will verify your identity before acting on the request and respond within 30 days.

9. Security

See our dedicated security policy for the full threat model, controls, and responsible-disclosure process. In summary: HTTPS-only, HttpOnly + Secure + SameSite cookies, bcrypt password hashing, email verification, 2FA on new devices, per-tenant database isolation at the query layer, full audit log, DKIM-signed outbound mail.

10. International transfers

Your data is stored in the region where our hosting provider is located. If you are accessing SOPFlow from a different country, your data will be transferred to and processed in that region. We rely on standard contractual clauses where applicable.

11. Children

SOPFlow is intended for adult business users aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, contact us at admin@sopflow.io and we will delete it.

12. Changes to this policy

We may update this policy from time to time. If we make a material change we will email all active account holders at least 30 days before the change takes effect, and update the "Last updated" date at the top of this page.

13. Contact

Privacy questions, data requests, complaints — email admin@sopflow.io or use our contact form and pick "General question".

14. SMS customer care privacy

If you choose SOPFlow SMS customer care, we process your mobile number, support message contents, delivery status, and the date and source of your SMS consent or opt-out. We use these records to provide the support you requested, manage delivery, and honor your communication choices. Consent to calls, email, or call recording does not authorize SMS.

We do not sell, rent, or share mobile information, SMS opt-in data, or consent records with third parties or affiliates for marketing or promotional purposes. Other sharing provisions in this policy exclude those records for purposes unrelated to the SMS programme. We disclose only the information needed by Telnyx, mobile carriers, and contracted service providers to deliver and support the messages, or information we are legally required to disclose.

Authorized staff can access support and consent records. We retain the records needed to resolve your request and honor consent, opt-out, and legal obligations; opting out stops support texts but does not erase the suppression record that prevents further messages. For privacy or deletion requests, email admin@sopflow.io. See the SMS customer care terms for consent, STOP, and HELP instructions.