Privacy Policy

DeckFlow is a business-to-business platform. Our direct customers are the businesses (“Customers”) who use DeckFlow to operate their site and manage their leads, projects, and clients. Some information we process belongs to a Customer’s own end clients (“Client Data”); for that data the Customer is the controller and DeckFlow acts as a processor on the Customer’s behalf.

• Account information — name, email address, and authentication credentials for the people who log in to a DeckFlow account.
• Business content — the marketing copy, images, services, portfolio, and SEO metadata a Customer publishes through DeckFlow.
• Customer relationship data — leads, contacts, estimates, projects, messages, photos, and notes a Customer enters or uploads to manage their business.
• Connected-service data — when a Customer connects a third-party account (such as Google or QuickBooks), we process the data needed to provide that feature and store the access tokens required to maintain the connection. See “Third-party connections” below.
• Usage and technical data — basic logs, device/browser information, and feature usage we use to operate, secure, and improve the service.

We use information solely to provide, secure, maintain, and improve DeckFlow: to authenticate users, render and publish a Customer’s website, power CRM and estimating features, deliver transactional email, sync data a Customer explicitly chooses to sync, and diagnose problems. We do not sell personal information, and we do not use Client Data for advertising.

Some features rely on third-party services that a Customer opts into:

• Google (Analytics & Search Console) — read-only access to a Customer’s own website analytics, used only to display that Customer’s traffic and search metrics inside their dashboard.
• QuickBooks Online (Intuit) — when connected, DeckFlow accesses the Customer’s QuickBooks data (such as customers, items, estimates, and invoices) only to synchronize records the Customer chooses to push from DeckFlow, and to reflect status back into DeckFlow. We request the minimum scope required, store OAuth tokens securely on the server side only, never sell or share QuickBooks data, and use it solely to provide the integration the Customer enabled. A Customer can disconnect at any time from Settings, which revokes our access and removes the stored tokens.

We share data with infrastructure subprocessors that operate the platform on our behalf — including Supabase (database, authentication, storage), Vercel (hosting), Cloudflare R2 (media storage), Resend (transactional email), and the connected services above. Each processes data only to provide its service to DeckFlow.

DeckFlow is multi-tenant by design and isolates each Customer’s data at the database level using row-level security keyed to account membership, so one Customer cannot read another’s data. Private media is served only through short-lived signed URLs. Access tokens for connected services are restricted to server-side use and are never exposed to the browser. Data is encrypted in transit. No system is perfectly secure, but we work to protect your information using industry-standard practices.

We retain information for as long as an account is active and as needed to provide the service. A Customer may request export or deletion of their account data, and may disconnect any third-party integration at any time. On account closure we delete or de-identify Customer data within a reasonable period, except where we must retain limited records to comply with law.

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, or to object to or restrict certain processing. To exercise these rights, contact us at info@yidy.dev. For Client Data, please contact the Customer who controls it; we will assist that Customer in responding.

DeckFlow uses strictly necessary cookies to keep you signed in and to operate the dashboard. We do not use third-party advertising cookies.

DeckFlow is a tool for businesses and is not directed to children, and we do not knowingly collect personal information from children.

We may update this policy from time to time. We will revise the effective date above and, for material changes, take reasonable steps to notify Customers.

Questions about this policy or your data: info@yidy.dev.