Privacy Policy

GarvFlow processes account names and email addresses, organization details, membership roles, uploaded contracts and extracted terms, customer information, invoices, usage records, findings, evidence, investigation notes and audit history. Operational information may also be processed to authenticate users, maintain security and diagnose service errors.

Information is used to provide your workspace, reconcile records, show evidence and reports, support requested AI explanations, manage access and plan limits, and maintain an audit trail. Organizations are responsible for determining whether they may upload personal information and for providing any required notices to affected people.

Where applicable, processing is based on providing the requested service, legitimate security and operational interests, legal obligations, or consent when required. The business owner must confirm the legal controller and applicable privacy obligations before this policy is finalized.

Lovable Cloud provides managed authentication, database and private file storage. Requested AI features use the configured Lovable AI service and may send relevant contract text, finding amounts and evidence for processing. Reconciliation calculations do not depend on AI. Avoid uploading data your organization is not authorized to share with these providers.

Providers may process information in locations outside your country. Applicable transfer safeguards and contractual processing terms must be confirmed by the business owner. We do not make an unverified promise about provider retention or AI training practices.

Workspace access is scoped to organization membership and role. Contract files are private and opened through short-lived authorized links. Members of your organization may access records according to their permissions. Security controls reduce risk but cannot guarantee absolute protection.

No configurable automatic deletion schedule is currently implemented. Workspace records and files remain stored unless removed through an authorized process. Audit and investigation history may need preservation for legal or operational reasons. Backup copies may retain deleted information until their retention period ends.

Database backups do not include contract file bytes. Your organization should independently preserve both database exports and downloaded files. A backup checklist entry is an owner attestation, not proof that recovery has succeeded.

Authentication uses browser storage or cookies to maintain your session. These are necessary for sign-in and authorized access. This policy does not claim that every hosting-level diagnostic or tracking setting has been independently verified.

Depending on applicable law, you may request access, correction, deletion, restriction or a copy of personal information, and may have the right to complain to a relevant authority. Requests concerning an organization's uploaded records should first be directed to that organization's administrator. The official GarvFlow privacy and support contact must be supplied by the business owner before this policy is finalized.