Privacy Policy
Effective July 13, 2026
QBR Flowexists to turn your service activity into client-ready reports. That means you trust us with operational data about your business and your clients' businesses. This page says plainly what we collect, what we do with it, and what we never do with it.
What we collect
- Account data: your email address, password (hashed, never readable by us), workspace name, and business country.
- Report content:the metrics, notes, CSV-derived numbers, and text you enter or edit — including your clients' names and operational details.
- Usage events: when reports are generated, published, emailed, or their links changed, so you have an audit trail and we can operate the service.
- Billing data: handled by Stripe. We never see or store card numbers.
What we do with it
We use your data to provide the product: generate and store reports, serve share links, send report emails you request, bill your subscription, and fix problems. We do not sell your data, rent it, or use your clients' information for advertising — ours or anyone else's.
AI processing
When a report is generated, the facts you provided are sent to OpenAI's API to draft the section text. API data is not used by OpenAI to train models. If the AI call fails or is not configured, reports are drafted by our own deterministic templates instead — your data never leaves our infrastructure in that case.
Who processes data for us
- Supabase — database and authentication hosting; data encrypted in transit and at rest.
- Stripe — subscription payments.
- OpenAI — drafting report text from the inputs you submit.
- Resend — delivering report emails you send.
- Vercel — application hosting and privacy-friendly page analytics.
- Sentry — error monitoring, so failures reach us before your complaint does.
We will email you before adding or replacing a subprocessor that handles your data; concerns go to support@qbrflow.com.
Where data is stored
QBR Flow is offered to businesses in the United States and Canada. Our infrastructure is hosted in the United States.
Share links
A published report is readable by anyone who has its link, without a login. Links use long random tokens, are excluded from search-engine indexing, and can be rotated or taken offline by you at any time from the editor.
Cookies
We set cookies to keep you signed in. Page analytics are aggregate and do not build advertising profiles. There are no third-party advertising cookies.
Your rights
Email support@qbrflow.comto access, correct, or delete your personal data, or to ask for a copy of your reports. There is no self-serve export. Because you upload your clients' data, your clients' own requests should be directed to you as the controller of that data; we will help you respond to them as the law requires.
Retention and deletion
Your reports and workspace data stay until you delete them or ask us to. Email support@qbrflow.com from your account address to have a workspace and its data permanently deleted; we process deletion requests within 30 days — usually sooner — and confirm completion at the email address on your account.
Changes
If this policy changes in a way that affects how your data is handled, we will email the address on your account before the change takes effect.
Contact
Privacy questions or deletion requests: support@qbrflow.com.