Fundflow
ENRO
Sign in

Privacy Policy

This policy explains how the Fundflow application collects, uses, stores, protects, retains, deletes, and shares information, including data received from Google APIs.

Effective date: September 18, 2026

Scope

This policy applies to Fundflow at fundflow.cnmkstudio.ro. Fundflow is primarily an internal application for managing funded projects, including budgets, funding, suppliers, purchases, payments, personnel, compliance, reports, exports, and related documents. The organization that invites a user and its Fundflow administrators control who may access its project information.

Information we collect

  • Account information, such as your name, email address, profile image, sign-in provider, role, and access status.
  • Information entered or uploaded to Fundflow, such as project, financial, supplier, personnel, compliance, reporting, and file data.
  • Authentication, session, security, and operational information, such as timestamps, IP address, browser or device details, and application logs.

How we use information

We use information to authenticate users, control access, provide project-management features, create requested exports, maintain auditability, secure and troubleshoot the service, and meet operational or legal obligations.

Google user data

Fundflow accesses the following Google user data only for the purposes described below:

Google account identity

When you sign in with Google, Fundflow receives basic identity information, such as your name, email address, profile image, and Google account identifier, to authenticate and link your Fundflow account.

Authorization records

Fundflow stores the Google account link, the scopes you granted, and encrypted OAuth access and refresh tokens so it can maintain the connection and perform the Google action you request.

Google Drive and Sheets exports

If you separately grant the drive.file permission and request a Google Sheets export, Fundflow sends the project, budget, financial, or reporting data selected for that export to Google and creates the spreadsheet in your Google Drive.

The drive.file permission is limited to files created or opened with Fundflow. Fundflow does not list, read, modify, or delete unrelated files in your Google Drive.

Fundflow's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Google user data is not sold, used for advertising, or used to train generalized AI or machine-learning models.

How information is shared

  • Authorized Fundflow users may see information according to their roles and project access. Your name or email may appear to administrators and in records that identify who performed an action.
  • Cloudflare processes application data to provide hosting, database, file storage, security, and operational logging services.
  • Google processes account identity for sign-in and receives the selected export data only when you request creation of a Google Sheet.
  • Fundflow does not sell personal information or Google user data, share it with data brokers, use it for advertising, or disclose it to third parties except as described in this policy, when you direct the disclosure, or when required to protect the service or comply with law.

Storage and security

Application records are stored in Cloudflare D1, uploaded files in Cloudflare R2, and operational logs in Cloudflare services.

  • Data is transmitted over encrypted HTTPS connections.
  • Role and project access controls restrict application data to authorized users, and sessions are protected through the application's authentication controls.
  • Google OAuth access and refresh tokens are encrypted at rest and are not displayed to Fundflow users.
  • Administrative and operational safeguards are used to protect the service, but no system can guarantee absolute security.

Retention

  • Account identity, the Google account link, granted scopes, and encrypted tokens are retained while the account or Google connection remains active and they are needed to provide the requested features.
  • Project content and audit records are retained for as long as the relevant organization needs Fundflow to administer its projects and meet contractual, audit, security, or legal obligations. These records may remain after an individual's access is removed.
  • Google Sheets created by an export remain in your Google Drive until you delete them. Fundflow retains the source application records according to the project-record rules above.
  • Session, security, and operational records are retained only for as long as reasonably needed to operate, secure, and troubleshoot the service or meet applicable obligations.

Deletion and revoking Google access

You can revoke Fundflow's Google access from your Google Account at any time. Revocation stops future use of that authorization but does not delete spreadsheets already created in your Drive or project and audit records that Fundflow must retain. Ask your Fundflow administrator to disconnect or delete your account information; the administrator will delete eligible account and Google-link data subject to project, audit, security, and legal retention requirements.

Your choices

Contact your Fundflow administrator to request access to, correction of, export of, or deletion of eligible account information. You can also delete an exported spreadsheet directly from your Google Drive.

Cookies and local storage

Fundflow uses essential authentication and session cookies. It may store language, appearance, and interface preferences in your browser. Fundflow does not use advertising cookies.

Changes to this policy

We may update this policy when Fundflow or its data practices change. The effective date above identifies the current version.

Contact

For privacy, account, or service questions, contact the Fundflow administrator who invited you. If you have not yet been invited, use the developer contact address displayed on Fundflow's Google OAuth consent screen.