This explains what FlowPlanner keeps about you, why, who else sees it, and what you can ask us to do with it. It is written to meet the Protection of Personal Information Act, 2013 (POPIA).
Who we are
FlowPlanner is run by a private company ("we"). We are the responsible party for the personal information described here.
What we keep
- Your name, email address and password (stored only as a one-way hash), to create your account, sign you in and email you about it.
- What you and your team put in FlowPlanner: projects, tasks, plans, maps, comments and tables, to provide the service. This is your content; we don't read it except to fix a problem you ask us to look at.
- Documents you attach to tasks (photos and other files), to provide the service. Like the rest of your content, they're yours: we don't open them except to fix a problem you ask us to look at, and we don't scan or analyse what's in them. A photo that's too big is made smaller in your browser before it's sent, so only the smaller copy reaches us.
- Who changed what and when (item activity and version history), so your team can see the history of their work and owners can restore earlier versions.
- Calendar links you add, and the events read from them, to show your calendar beside your plan. The links are stored encrypted.
- Your licence, invoices and payments, to bill you and keep accounting records.
- When you last signed in, and your IP address for a short while, to keep your account secure and stop repeated sign-in attempts.
- What you send through the contact form, to answer you.
We don't sell your information, show you adverts, or use tracking or advertising cookies.
Cookies
FlowPlanner sets one cookie, which keeps you signed in. It is needed for the service to work, so there is nothing to opt out of. Your browser also stores a few settings on your own device, such as which team you last opened.
Who else sees it
- The people in your teams see your name, email and the work you share with them, as the team's owners set. Everyone who can open a project can open and download the documents attached to its tasks, including people who can only view it.
- Our hosting provider, runs the servers your information is stored on.
- Our email provider delivers sign-up, reminder and invite emails.
- Anyone the law requires, when a valid legal request obliges us.
No Data is stored outside South Africa
How long we keep it
- Your account and content: while your account is open.
- Version history: up to 90 days; for a deleted project, 30 days.
- Documents: while the task they're attached to exists. When the task or its project is deleted, its documents are kept for 30 days, so restoring an earlier version brings them back, and then deleted for good. When a team is deleted, its documents are deleted at once.
- Backups, documents included: 14 days, then overwritten.
- Invoices and payments: as long as tax law requires, five years.
When a trial or licence ends, your projects become read-only or locked; we don't delete them. Ask us to close your account and we'll delete your information within 30 days, apart from records the law requires us to keep.
Keeping it safe
FlowPlanner is reached only over HTTPS. Passwords are hashed with Argon2id, sign-in attempts are limited, and team owners decide who can open each project. No system is perfectly secure; if a breach affects your information we will tell you and the Information Regulator as POPIA requires.
Your rights
You can ask us what we hold about you, ask us to correct or delete it, or object to how we use it. Write to info@3sm.co.za and we'll answer within 10 business days. You can also complain to the Information Regulator (South Africa) at inforeg.org.za.
Children
FlowPlanner is for work and productivity. We don't knowingly keep information about children or condone it in any way.
Changes
If we change this policy in a way that matters, we'll email account holders before it takes effect.