Last updated: August 24, 2026
This Privacy Policy explains how OmniFlow HQ ("OmniFlow HQ", "we", "us", or "our") collects, uses, stores, and processes information when you access or use omniflowhq.com and the OmniFlow HQ web application (collectively, the "Service").
OmniFlow HQ is operated by an independent sole proprietor based in the Kyrgyz Republic. By accessing or using the Service, you acknowledge and agree to the practices described in this Privacy Policy. If you do not agree with this policy, please do not use the Service.
This policy applies to two distinct categories of individuals:
Account Holders. Contractors, service providers, and business owners who register for an OmniFlow HQ account to create estimates, manage jobs, collect signatures, and generate invoices. For these users, we act as a Data Controller (or "Business" under applicable US state privacy laws).
Your Clients. End customers of Account Holders, whose contact and job details are entered into the Service by the Account Holder. For these records, the Account Holder is the Data Controller, and OmniFlow HQ acts solely as a Data Processor / Service Provider. Requests to access, correct, or delete client data should be directed to the relevant contractor first (see Section 9).
Account information. Name, email address, and authentication credentials, or your Google profile identity if you sign in with Google. Passwords are handled by Google Firebase Authentication and are never visible to us. We never receive or store your Google account password.
Business profile. Business name, physical address, business phone number, tax or license number, default tax rate, trade category, and any logo you upload.
Client and operational data. Client names, service addresses, email addresses, phone numbers, job descriptions, line items, pricing, notes, presets, and scheduled jobs created within your account.
Electronic signature data. When a client signs an estimate, we record a signature image drawn by the signer, the name they type, and the date and time of signing. We do not capture IP addresses, device fingerprints, browser information, or other audit metadata during signing.
Lead capture submissions. If you use a lead capture form, we store the information a prospective customer submits through it so that we can pass it to you.
Support and communications. Messages, feedback, and any file attachments you submit through the app's support and feedback features.
Usage and analytics. We use Google Analytics 4 to collect aggregated usage metrics such as browser type, device category, referring page, and approximate geographic region at country or city level. Record identifiers and share tokens are stripped from page addresses before anything is transmitted, so Google Analytics can see that an estimate page was viewed but never which estimate.
Technical server logs. Our infrastructure providers record standard server logs, including IP addresses, timestamps, request headers, and error traces, for diagnostic, security, and fraud prevention purposes.
We do not sell or rent your personal information. We do not use your data or your clients' records to train machine learning or artificial intelligence models.
We process the information described above to:
We do not send marketing email to your clients, and we do not contact them for any purpose other than delivering what you asked us to deliver.
Where applicable data protection law requires a legal basis, we rely on:
Performance of a contract — delivering the Service you registered for.
Legitimate interests — securing the platform, preventing abuse, resolving defects, and maintaining operational continuity.
Legal obligation — meeting mandatory tax, compliance, and reporting requirements.
Consent — where explicit consent has been given, for example for non-essential analytics cookies.
All subscription billing is handled by Dodo Payments, which acts as the official Merchant of Record (MoR).
Dodo Payments is the legal entity responsible for collecting subscription payments, calculating and remitting applicable sales tax or VAT, resolving chargebacks, and issuing receipts.
Zero card storage. OmniFlow HQ never receives, processes, or stores your card number, expiry date, or security code. Payment details are submitted directly to Dodo Payments on a page they host, under their own Privacy Policy and Terms of Service.
We receive only a customer identifier, a subscription identifier, and the status of your subscription, which we use to enable or disable paid access.
Charges will appear on your card or bank statement under Dodo Payments, not OmniFlow HQ.
Essential browser storage. Local storage and session cookies required to keep you signed in, remember your light or dark theme preference, and track onboarding progress. These cannot be disabled, as the Service cannot function without them.
Analytics cookies. Google Analytics 4 cookies used to measure aggregate site traffic, as described in Section 2.2.
You may opt out of Google Analytics at any time using Google's opt-out browser add-on at tools.google.com/dlpage/gaoptout, or by blocking analytics cookies in your browser settings. Doing so does not affect your ability to use the Service.
We engage a small number of vendors solely to operate the platform:
| Provider | Purpose | Data handled |
|---|---|---|
| Google Firebase / Google Cloud | Authentication, database, file storage, serverless functions, hosting | Account data, business profile, client records, estimates, invoices, uploaded logos |
| Resend | Transactional email delivery | Recipient email addresses, sender business name, message content, attachments |
| Dodo Payments | Subscription billing and Merchant of Record | Subscriber name, email, billing address, payment details, payment status |
| Google Analytics | Aggregated usage and traffic measurement | Anonymized device, browser, and navigation data |
Each provider is bound by its own terms and may use the data only to deliver its service to us.
Public share links. When you share an estimate or invoice by link or text message, that link opens without requiring a login. Anyone who has the link can view the document, including your client's name, address, line items, and pricing. We instruct search engines not to index these pages, but you should treat these links as sensitive and share them only with the intended recipient.
Legal disclosure. We may disclose information where legally required by court order, subpoena, or enforceable regulatory request, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
Business transfer. If the Service is sold, merged, or otherwise transferred, information may be transferred as part of that transaction. We will give notice before your information becomes subject to a different privacy policy.
Active accounts. Data is maintained for as long as your account remains active.
Account deletion. You may permanently delete your account from the Settings menu. On deletion, your business profile, clients, estimates, invoices, presets, jobs, leads, and uploaded files are removed from our active database.
Backups. We take an automated daily backup of the database and retain each backup for 7 days. Deleted records may therefore persist in a backup for up to 7 days before being permanently removed. Backups exist so that we can recover from accidental deletion or technical failure.
Anti-abuse hash. To prevent repeated claiming of the free trial, we retain an irreversible one-way cryptographic hash (SHA-256) of your registered email address. This hash is retained even after you delete your account. It cannot be reversed into your email address, cannot be used to identify or contact you, and is never used for marketing.
Payment records are retained by Dodo Payments under their own retention schedule, which may be longer than ours because of tax and accounting obligations.
Export. You can download your clients, estimates, and invoices as CSV files at any time from the Settings page. This works whether your account is on trial, active, or expired.
Correction. You can edit your business profile, clients, estimates, and invoices directly in the app.
Deletion. You can delete your account from Settings. This is permanent and cannot be undone. Export your data first if you want to keep it.
Analytics opt-out. See Section 6.
US state privacy rights (CCPA / CPRA / VCDPA and similar). Residents of certain US states, including California, have specific rights regarding personal information, including the right to know what personal data is collected, to request deletion, and to opt out of any sale or sharing of personal data. We do not sell or share personal data. To exercise these rights, email support@omniflowhq.com.
Other jurisdictions. Depending on where you live, you may also have rights to object to processing, to restrict processing, to data portability, or to lodge a complaint with a supervisory authority.
If you are a client of an Account Holder, we act as a processor on their behalf. Please direct your request to the contractor who sent you the document. If you cannot reach them, contact us and we will make a reasonable effort to help.
We employ industry-standard administrative and technical controls, including TLS encryption in transit, strict database security rules that prevent one account from reading another account's data, and server-side verification of privileged operations.
No web-based system is completely secure. We cannot guarantee absolute protection against unauthorized access, zero-day exploits, or infrastructure failures, and you use the Service at your own risk. If we become aware of a breach affecting your personal data, we will notify you without undue delay where required by law.
OmniFlow HQ is operated from the Kyrgyz Republic and uses database and hosting infrastructure located in the United States. By using the Service, you consent to the transfer, storage, and processing of your information across international borders, subject to appropriate security safeguards. These locations may have different data protection laws than your country of residence.
The Service is a business-to-business application intended for commercial trade operators and is not directed at persons under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal information, contact us and we will delete it.
We may revise this Privacy Policy as the Service evolves. When we do, we will update the "Last updated" date above. For material changes, we will make a reasonable effort to notify Account Holders by email or through an in-app notice. Continued use of the Service after an update takes effect constitutes acceptance of the revised policy.
Email: support@omniflowhq.com
Platform: OmniFlow HQ — omniflowhq.com