Privacy Policy

Welcome to Investigation Flow ("we," "our," or "us"). We are committed to protecting your privacy. This Privacy Policy explains how we handle information in connection with your use of the Investigation Flow desktop application, our marketing website, and any related services (collectively, the "Service").

By using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, please discontinue use of the Service.

This Policy covers two distinct surfaces, and the data practices differ between them:

• Desktop Application: the Investigation Flow software you install and run on your computer. The app itself collects no personal data and transmits nothing to our servers.
• Marketing Website: the public website we use to describe and sell Investigation Flow. The website uses analytics tools to help us understand how visitors interact with our pages.

Important: Google Analytics and PostHog are used exclusively on our marketing website. They are not present in the desktop application and have no access to anything you do inside the app.

Within the desktop application, Investigation Flow does not collect, process, or store any personal data. Specifically, the app does not collect:

• Usage data, analytics, or behavioral information
• Device identifiers or hardware information
• Location data
• In-app content, notes, case files, or other data you create
• Any information beyond what is strictly required to process your purchase

Your in-app activity stays entirely on your device and is never transmitted to our servers.

4.1 Email Address

When you make a purchase, whether a one-time payment or a subscription, your email address is collected as part of the payment process. This is the only personal information we collect from customers.

4.2 Payment Processing

We use third-party payment processors to handle all transactions. Those processors may collect billing information (such as credit card details and billing address) directly from you. We do not receive, store, or have access to your full payment card details. Please review the privacy policy of the relevant payment processor for details on how they handle your financial data.

4.3 Website Analytics (Google Analytics & PostHog)

Our marketing website uses Google Analytics and PostHog to collect anonymized, aggregated information about how visitors interact with our website pages. This may include:

• Pages visited and time spent on each page
• Referring website or search terms that brought you to our site
• General geographic region (country or city level, not precise location)
• Browser type, operating system, and device category
• Clicks, scrolls, and other on-page interactions (via PostHog)

This data is used solely to improve our website and marketing. It is not linked to your identity, your email address, or your use of the desktop application.

You can opt out of Google Analytics across all websites by installing the Google Analytics Opt-out Browser Add-on (available at tools.google.com/dlpage/gaoptout). PostHog analytics can be blocked via standard browser privacy extensions or by enabling "Do Not Track" in your browser settings.

For more information on how these tools handle data, please review the Google Analytics Privacy Policy and the PostHog Privacy Policy.

We use the information we collect for the following purposes:

• To process payments and deliver access to the Service
• To send transactional emails (purchase confirmations, receipts, subscription renewal notices)
• To send marketing emails about Investigation Flow features, updates, and offers
• To provide customer support when you contact us
• To analyze aggregated, anonymized website traffic and improve our marketing site

You may opt out of marketing emails at any time by clicking the unsubscribe link in any marketing message, or by contacting us directly. Transactional emails cannot be opted out of while your account remains active.

We do not operate our own user-data databases. Your email address is held only within the systems of our payment processor and email service provider(s). Website analytics data is stored within the Google Analytics and PostHog platforms, subject to their respective data retention policies.

We do not sell, rent, trade, or otherwise share your email address or any personal information with third parties for their own marketing or commercial purposes.

We may share information only in the following limited circumstances:

• Service Providers: We may share your email with trusted service providers (e.g., payment processors, email delivery platforms) who assist in operating the Service. These providers are contractually required to use your information solely on our behalf.
• Analytics Platforms: Aggregated, anonymized website usage data is processed by Google Analytics and PostHog as described in Section 4.3. This data is not linked to your identity.
• Legal Requirements: We may disclose information if required by law, court order, or governmental authority, or when disclosure is necessary in good faith to protect our rights or the safety of others.

Investigation Flow offers both subscription-based plans and one-time purchase options. Regardless of which you choose, the same data practices apply: we collect only your email address and do not retain any additional personal information on our own systems.

If you hold an active subscription, your email may be used to send renewal notices, billing alerts, and related service communications.

We retain your email address for as long as necessary to fulfil the purposes described in this Privacy Policy, including for the duration of your subscription or licence, and for a reasonable period thereafter to comply with legal obligations or resolve disputes.

To request deletion of your email address from our records, please contact us using the details in Section 15. We will honour your request subject to any applicable legal retention requirements.

We take reasonable technical and organisational measures to protect the limited information we hold against unauthorised access, loss, or disclosure. However, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.

The Service is not directed to children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

If you are located in the European Union or European Economic Area, the General Data Protection Regulation (GDPR) provides you with specific rights regarding your personal data. This section describes those rights and how to exercise them.

12.1 Legal Basis for Processing

We process your personal data on the following legal bases:

• Contractual necessity: Processing your email address is necessary to fulfil your purchase and deliver the Service.
• Legitimate interests: Sending marketing communications about our own products where you have a reasonable expectation of receiving them as a customer. You may object at any time.
• Consent: Where required by applicable law, we will obtain your consent before sending marketing emails.

12.2 Your GDPR Rights

Under the GDPR, you have the right to:

• Access: request a copy of the personal data we hold about you
• Rectification: request correction of inaccurate or incomplete data
• Erasure ('Right to be Forgotten'): request deletion of your personal data where there is no overriding legal reason for us to retain it
• Restriction: request that we limit the processing of your data in certain circumstances
• Data Portability: receive your personal data in a structured, machine-readable format
• Objection: object to processing based on legitimate interests, including direct marketing
• Withdraw Consent: where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing

12.3 International Data Transfers

Our service providers, including payment processors and analytics platforms, may process data in the United States or other countries outside the EU/EEA. Where such transfers occur, we rely on appropriate safeguards (such as Standard Contractual Clauses) to ensure your data is protected to EU standards.

12.4 Right to Lodge a Complaint

You have the right to lodge a complaint with your local data protection authority if you believe we have not handled your personal data in accordance with applicable law.

To exercise any of your GDPR rights, please contact us at support@investigationflow.com. We will respond within 30 days.

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you additional rights regarding your personal information. This section describes those rights.

13.1 Categories of Personal Information Collected

In the past 12 months, we have collected the following categories of personal information from California consumers:

• Identifiers: Email address (collected at point of purchase)
• Internet or other electronic network activity: Anonymized website usage data via Google Analytics and PostHog (not linked to your identity)
• Commercial information: Records of products purchased

We do not sell or share your personal information with third parties for cross-context behavioral advertising purposes.

13.2 Your CCPA/CPRA Rights

As a California resident, you have the right to:

• Know: request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for which it is used, and the categories of third parties with whom it is shared
• Delete: request deletion of personal information we have collected from you, subject to certain exceptions
• Correct: request correction of inaccurate personal information
• Opt Out of Sale/Sharing: we do not sell or share personal information as defined under the CCPA/CPRA, so this right is not currently applicable
• Limit Use of Sensitive Personal Information: we do not collect sensitive personal information as defined under the CPRA
• Non-Discrimination: we will not discriminate against you for exercising any of your CCPA/CPRA rights

13.3 How to Submit a Request

To exercise your rights under the CCPA/CPRA, please contact us at support@investigationflow.com with the subject line "California Privacy Request." We will verify your identity before processing your request and will respond within 45 days. If we need additional time, we will notify you.

13.4 Authorized Agent

You may designate an authorized agent to submit a request on your behalf. We will require written authorization and may verify your identity directly before processing the request.

We may update this Privacy Policy from time to time. When we do, we will revise the Effective Date at the top of this document. If changes are material, we will notify you via email. Your continued use of the Service after any update constitutes acceptance of the revised Policy.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Investigation Flow
Email: support@investigationflow.com