Privacy Policy
1. Who we are
FLOWCRAFT FOR IT CONSULTING ("Flowcraft", "we") is a freelance IT consultancy licensed in the United Arab Emirates. Contact: hello@flowcraftit.com.
2. This website
This website has no contact forms, no analytics, no advertising and no cookies, and it loads nothing from third parties. Our hosting provider, Cloudflare, keeps standard server logs (IP address, browser type, pages requested, time) for security and reliability, and deletes them on its own schedule. We do not use those logs to identify visitors.
3. When you contact or hire us
If you email us or work with us through Upwork or Fiverr, we process your name, business contact details, messages and the project information you give us. We use it only to answer you, quote, deliver the agreed work, invoice and keep records the law requires. For client projects, the Statement of Work and our AI-Use and Confidentiality Terms also apply.
4. Work inside your systems (remote sessions)
When we work in your environment, we connect through access you provide (for example your VPN, Azure Bastion, virtual desktop or a browser session to your cloud consoles) or through an attended remote-support session that you start and can end at any time. Your files and data stay on your systems; we do not copy them to ours except for deliverables you agree to receive. We do not record or store session screens unless you ask us to.
Our FlowCraft AI tooling runs on Flowcraft's own workstation. To assist with the work it reads what is shown in the session, and that screen content is processed by our AI model providers under business terms that exclude training on your data. You can ask for any engagement to be delivered without AI.
5. Google user data (Gmail)
Flowcraft runs an internal automation that connects to Flowcraft's own Gmail account only. No other person's Google account is connected, and we do not offer a Google sign-in to the public.
- Access: read-only access to Flowcraft's mailbox (to read job-alert emails sent to us by freelance platforms) and permission to send email from that same account (to send ourselves summaries).
- Use: the content of those alert emails is used only to extract job details, score how well each job fits our services and draft a proposal for us to review. Nothing is sent to a platform or a client automatically.
- Storage: we keep a job title, budget, country, score, short reasons and any draft proposal in a database on Flowcraft's private server for up to 12 months. Full email text is not kept in that database; automation run logs, which can contain it, are deleted automatically after 14 days.
- Sharing: email text is sent to our AI model providers (Anthropic and OpenAI) only to perform that scoring, under commercial terms that do not allow it to be used for model training. We do not sell Google user data, use it for advertising, or share it with anyone else.
- Human access: only Flowcraft's consultant reads this data, to operate and maintain the automation. No other person has access.
Flowcraft's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can see or remove this access at any time under Google Account → Security → Third-party apps with account access.
6. Service providers
We use a small number of providers to run Flowcraft: Microsoft (Azure hosting for our private automation server, platform and backups; Microsoft 365 for business email and identity), Cloudflare (website hosting, DNS and email routing), Anthropic and OpenAI (AI processing under business terms that exclude model training), Google (email), a commercial remote-support provider (attended sessions, when used), GitHub (private code storage, no client data), Tailscale (private network access), and Upwork and Fiverr (where you hire us). Some of them process data outside the UAE. We only use providers whose terms protect personal data, and we send them the minimum needed.
7. How long we keep data
Enquiries that don't become projects: 12 months. Client project records: 2 years after the project ends, to match our confidentiality commitments. Client working data and credentials: deleted within 14 days of project close. Job-scoring records: 12 months.
8. Security
Our automation server has no public inbound access and is reachable only through a private network. Every account uses multi-factor authentication, secrets are kept in a vault and never in code, and access is limited to Flowcraft's consultant.
9. Your rights
Wherever you are, you can ask us to: tell you what personal data we hold about you and give you a copy; correct it; delete it; restrict or object to its processing; and move it to another provider. Where we rely on your consent, you can withdraw it at any time. These rights apply under UAE data protection law and, where they apply to you, under other laws such as the EU and UK GDPR.
Email hello@flowcraftit.com. We complete requests within 7 days. If we need to confirm your identity first, we tell you within one business day. If you are not satisfied, you may complain to the UAE Data Office or to the data protection authority where you live.
10. Children
Our services are for businesses, and we do not knowingly collect data from anyone under 18.
11. Changes
We will update this page if our practices change and show the new date at the top.