Privacy Policy

This Privacy Policy explains what information IMSFlow ("the Platform") collects, how it is used, and the choices available to you. 1. Information We Collect. Account details (name, email, role); business records you or your organisation submit (task orders, timesheets, invoices, payroll, candidate/recruiting data); technical data such as IP address, browser/user-agent, and sign-in activity, captured in the platform's activity log for security and audit purposes. 2. How We Use It. To operate the Platform's core functions (invoicing, timesheets, payroll, recruiting), to maintain an audit trail of who changed what and when, to secure accounts (login rate-limiting, session management), and to communicate service-related notices. 3. Cookies. Only strictly necessary cookies (session, saved preferences) are set before you choose. Any additional cookie use requires your consent via the in-app cookie notice, and your choice is recorded against your account with a timestamp. 4. Data Sharing. Business data does not leave the Platform except where you configure an integration (e.g. outbound email via your own SMTP settings) or where required by law. We do not sell personal data. 5. Retention. Records are retained for as long as your organisation's account is active and as needed to satisfy audit, tax, or legal retention requirements; soft-deleted records remain recoverable until permanently purged by an administrator. 6. Your Rights. You may request access to, correction of, or deletion of your personal data by contacting your organisation's administrator, subject to records your organisation is legally required to retain. 7. Security. Access is role-based and logged; stored credentials and third-party API tokens are encrypted at rest; sessions use HttpOnly, Secure, SameSite cookies. 8. Changes. This policy may be updated; the effective date above reflects the current version. Material changes will be reflected in a new version. Contact your administrator with questions about this Policy.