Privacy Notice

• Account data — name, email address and login credentials (managed by our authentication provider).
• Content you submit — workflow descriptions, interview answers, saved reports, projects and notes.
• Support messages — anything you send us through the contact page or by email.
• Usage and technical data — pages viewed, feature usage, device and browser information, IP address and error logs.
• Subscription data — plan, status and renewal dates. Card details are never seen or stored by us; they are handled by Paddle.

• Creating and managing your account and workspace — performance of our contract.
• Generating your diagnostic reports and recommendations — performance of our contract.
• Managing subscriptions and entitlements — performance of our contract.
• Security, abuse and fraud prevention — our legitimate interests.
• Improving the product and fixing faults — our legitimate interests.
• Responding to support requests — our legitimate interests.
• Marketing emails, where sent — your consent, withdrawable at any time.
• Meeting accounting and legal obligations — legal obligation.

• Lovable — application hosting and the AI gateway that routes analysis requests.
• Google (Gemini models) — produces the AI analysis, reached through that gateway.
• Lovable Cloud (Supabase) — database and authentication for accounts, saved reports and analysis records.
• Paddle, our Merchant of Record, for the sale of subscriptions, payments, subscription management, tax compliance and invoicing.
• Lovable managed email — transactional email such as sign-in and account messages.
• Professional advisers — legal and accounting, where necessary.
• Authorities — where required by law.

We do not use third-party error-monitoring, session-replay or advertising tracking services. The full register is summarised on our Data & Security page.

To produce a report, your workflow description and interview answers are sent over an encrypted connection to the Lovable AI Gateway, which routes them to Google Gemini models. The structured result returns to WorkflowMD, which builds the report you read.

We do not claim that these providers never retain, review or train on the content routed to them — we have not independently confirmed their posture for our traffic, and we would rather say so than imply a guarantee we cannot evidence. Please take that into account before submitting sensitive or client-identifying material.

If you attach a supporting document or paste text, it is read from the request and sent to the AI processing service, which returns a structured summary for you to review. The source file is not persisted in WorkflowMD application storage after extraction — we operate no file storage for uploaded documents. We cannot state that the file is never stored anywhere, because the content is transmitted to the AI processing service and provider-side handling is outside our verification.

Each automated analysis is recorded in an append-only audit table holding the input it received and the output it produced, so a past report can be explained and checked. These records are not linked to the report record and are not removed when you delete a report. They contain no credentials or payment data.

Our providers may process data outside your country, including outside the UK and EEA, and we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses where that happens. We have not yet confirmed the specific processing regions used by each provider, so we do not state them here.

• Saved reports are kept until you delete them. Deleting a report also removes its improvement actions, value metrics and snapshots.
• “Delete my data” in Settings removes every saved report in your workspace; your account, sign-in and subscription remain.
• Analysis records are retained as described above, even after a report is deleted.
• Account deletion is currently handled as a request through the contact page rather than a self-serve button.
• Application logs hold the error message, stack and operation tag only — no workflow content. Retention is set by our hosting runtime.
• Payment records are held by Paddle under its own statutory obligations.

We do not state a fixed deletion timeframe, because we have not verified one, and we do not claim immediate permanent deletion across all systems, providers and backups. Backup retention is an open item we are still documenting.

Depending on where you live, you may have the right to access, correct, erase, restrict or object to processing of your personal data, to receive it in a portable format, and to withdraw consent. UK/EEA users may also complain to their supervisory authority. Contact us and we will respond within one month.

The controls we can evidence against the shipped product are: encryption in transit for all traffic; row-level database access controls enforced at the database rather than in the interface, so one account cannot read another’s reports; authenticated access to saved reports and settings; and restricted administrative access, with privileged credentials held server-side and never sent to the browser.

We do not hold SOC 2, ISO 27001 or HIPAA certification, and we do not describe WorkflowMD as certified, penetration-tested or zero-retention. No system is perfectly secure; we will notify you where required if something goes wrong.

If you submit a workflow belonging to a client or employer, the Consultant Data Addendum sets out client authority, ownership, confidentiality and deletion for that material, and applies over this notice where the two differ.

We use essential cookies and local browser storage to keep you signed in and to save interview progress on your device. We do not use advertising cookies. Any analytics we use is limited to understanding aggregate product usage; you can clear or block cookies in your browser settings, though sign-in will stop working without essential cookies.

To exercise your rights or ask a privacy question, contact Lee Stephens through the contact page.