Privacy Policy

TimingFlow ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform at timingflow.io and any related services (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

1. Information We Collect

Account Information

When you create an account, we collect:

• Name and email address
• Password (stored as a bcrypt hash, never in plain text)
• Company name and role (if provided)
• Billing information (processed securely through Stripe; we do not store full card numbers)

Usage Data

We automatically collect information about how you interact with the Service:

• Pages visited, features used, and actions taken within the platform
• Device type, browser type, operating system, and screen resolution
• IP address and approximate geographic location
• Referring URL and session duration

Content You Create

We store the content you create on the platform, including projects, pages, databases, files, and workflow configurations. This content is yours and is stored solely to provide you the Service.

Cookies and Similar Technologies

We use cookies and similar technologies to maintain your session, remember preferences, and analyze usage patterns. See Section 6 for details.

2. How We Use Your Information

We use the information we collect to:

• Provide and maintain the Service — Authenticate your identity, deliver features, and store your projects
• Improve the platform — Analyze usage patterns to identify bugs, optimize performance, and develop new features
• Communicate with you — Send account notifications, security alerts, service updates, and respond to support requests
• Process payments — Manage subscriptions, billing, and invoicing through our payment processor
• Ensure security — Detect and prevent fraud, abuse, and unauthorized access
• Comply with legal obligations — Meet regulatory requirements and respond to lawful requests

We do not use your content to train AI models. AI features within TimingFlow process your data only to deliver the specific feature you requested, and that data is not retained beyond the request.

3. Data Storage and Security

We take the security of your data seriously. Our infrastructure includes:

• AES-256 encryption at rest for all databases and file storage
• TLS 1.3 encryption in transit for all data transferred between your browser and our servers
• KMS-managed encryption keys with automatic rotation
• Web Application Firewall (WAF) protecting against OWASP Top 10 threats
• Automated backups with 7-day retention and point-in-time recovery
• Rate limiting and DDoS protection on all API endpoints

Data Residency

By default, your data is stored in Canada (ca-central-1). Enterprise customers can choose data residency in the United States or European Union to meet local data sovereignty requirements.

4. Your Rights

Under GDPR (European Economic Area)

If you are located in the EEA, you have the following rights under the General Data Protection Regulation:

• Right of access — Request a copy of the personal data we hold about you
• Right to rectification — Request correction of inaccurate or incomplete data
• Right to erasure — Request deletion of your personal data ("right to be forgotten")
• Right to data portability — Receive your data in a structured, machine-readable format
• Right to restriction — Request that we limit processing of your data
• Right to object — Object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — Withdraw consent at any time where we rely on consent for processing

Under PIPEDA (Canada)

As a Canadian company, we comply with the Personal Information Protection and Electronic Documents Act. You have the right to:

• Access the personal information we hold about you
• Challenge the accuracy and completeness of your information
• Withdraw consent for certain uses of your information
• File a complaint with the Office of the Privacy Commissioner of Canada

To exercise any of these rights, contact us at privacy@timingflow.io. We will respond within 30 days.

5. Data Sharing

We do not sell your personal information. We never have and never will.

We share data only with the following categories of third-party service providers, solely to operate the Service:

• Amazon Web Services (AWS) — Cloud infrastructure, data storage, and computing
• Stripe — Payment processing and subscription management
• AWS Bedrock (AI) — AI feature processing (data is not retained by the AI provider)

All third-party processors are bound by data processing agreements and are required to handle your data in accordance with this policy and applicable law.

We may disclose your information if required by law, regulation, legal process, or governmental request.

6. Cookies

We use the following types of cookies:

• Essential cookies — Required for authentication, security, and core functionality. These cannot be disabled.
• Analytics cookies — Help us understand how the Service is used so we can improve it. These are anonymized and aggregated.
• Preference cookies — Remember your settings, language preferences, and UI customizations.

We do not use advertising or tracking cookies. You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent you from using the Service.

7. Children's Privacy

The Service is not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected data from a child under 16, we will take steps to delete that information promptly. If you believe a child has provided us with personal data, please contact us at privacy@timingflow.io.

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it for legal, tax, or audit purposes.

Content you have published to live sites will be unpublished upon account deletion. Backup copies are automatically purged after 7 days.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and/or by posting a prominent notice on the Service at least 30 days before the changes take effect.

Your continued use of the Service after the effective date of the revised policy constitutes your acceptance of the changes.

10. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, contact us at:

• Email: privacy@timingflow.io
• General support: support@timingflow.io
• Location: Canada