This Policy explains how SDM Workflow, operated by a California-based sole proprietor, collects, uses, discloses, and protects personal information. We do not sell personal information or share it for cross-context behavioral advertising.
1. Scope and our role
This Policy applies to the SDM Workflow website, subscription application, support and privacy forms, and public client request forms.
For account, billing, website, and support information, SDM Workflow decides how information is processed. For client, project, and work information entered into a customer workspace, the workspace owner generally determines what is collected and why; SDM Workflow processes that content to provide the service. Questions about a contractor’s use of client information may need to be directed to that contractor.
2. Information we collect
| Category | Examples |
|---|---|
| Account and workspace information | Name, email address, password hash, workspace name, role, preferences, verification status, and account settings. |
| Customer Content | Client contacts, projects, milestones, requests, work items, subtasks, assignments, comments, time entries, reports, URLs, and uploaded files. |
| Public request information | Requester and company names, email address, request details, requested dates, page URLs, uploaded files, submission type, and IP address. |
| Billing information | Subscription status, plan, billing address, payment status, and limited payment-method details received from Stripe. We do not store complete card numbers. |
| Communications | Support requests, privacy requests, invitation activity, email delivery events, and information included in correspondence. |
| Technical information | IP address, browser and device information, timestamps, session and security records, application logs, and essential cookie identifiers. |
3. Sources of information
We collect information directly from account holders, invited members, website visitors, and people who submit public request forms. Workspace users may provide information about their clients, vendors, subcontractors, or other contacts. Stripe provides billing and subscription information, and our infrastructure automatically generates security and diagnostic records.
4. How we use information
- Provide, maintain, secure, troubleshoot, and improve SDM Workflow.
- Create and authenticate accounts, isolate workspaces, and enforce permissions.
- Process client requests and create related workflow records.
- Process subscriptions, prevent duplicate checkout, and enforce plan limits.
- Send verification, password-reset, invitation, support, billing, and workflow messages.
- Prevent spam, fraud, abuse, unauthorized access, and security incidents.
- Respond to support, privacy, legal, and account-deletion requests.
- Comply with law, enforce agreements, and establish or defend legal claims.
5. How we disclose information
We disclose information only as reasonably necessary for the purposes described above:
- Workspace users: information is available according to workspace roles and record permissions selected by the workspace owner.
- Infrastructure and security: IONOS hosts the application and database; Cloudflare provides DNS, network, and security services.
- Payments: Stripe processes checkout, payment methods, invoices, subscriptions, and the customer billing portal.
- Email: Resend transmits transactional and support-related email.
- Professional and operational providers: limited information may be disclosed to providers assisting with security, maintenance, legal, accounting, or customer support under appropriate obligations.
- Legal and safety: information may be disclosed when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or respond to lawful process.
- Business transfer: information may transfer as part of a merger, financing, reorganization, or sale, subject to applicable law and continued protection.
We do not sell personal information, rent customer lists, or share personal information for cross-context behavioral advertising.
6. Cookies and tracking
SDM Workflow currently uses essential cookies for login sessions, security, CSRF protection, and workspace continuity. We do not currently use advertising cookies or third-party behavioral analytics.
Because we do not sell or share personal information for targeted advertising, browser Do Not Track signals and Global Privacy Control signals do not change the service’s current behavior. If our tracking practices change, we will update this Policy and provide any required choices before using non-essential tracking.
7. Retention and deletion
We retain account and Customer Content while needed to provide the service, maintain read-only access, comply with law, resolve disputes, prevent fraud, and enforce agreements. Subscription cancellation does not automatically delete a workspace.
After identity and authority are verified, we aim to complete approved account-deletion requests within 30 days. Some records may be retained longer where required for billing, tax, security, fraud prevention, legal claims, or other lawful purposes. Deleted information may remain temporarily in protected backups until those backups expire through the normal rotation process.
8. Security
We use administrative, technical, and physical safeguards appropriate to the service, including encrypted HTTPS connections, hashed passwords, authenticated access, workspace isolation, private file paths, role-based permissions, rate limiting, backups, and restricted server access.
No system is completely secure. Users should use unique passwords, limit workspace access, avoid uploading unnecessary sensitive information, and notify us promptly through Contact Support if unauthorized activity is suspected.
9. Your choices and privacy rights
Depending on where you live, you may have rights to request access, correction, deletion, portability, restriction, or objection, and to appeal or complain to a regulator. You may also update certain account information directly in the service.
Submit a request through our Privacy Request form. The form does not reveal a private contact address. We may verify your identity, account ownership, or authority before acting. Authorized agents may submit requests, but we may require proof of authorization. We will not discriminate against you for exercising applicable privacy rights.
10. California privacy notice
California residents may request information about categories and specific pieces of personal information collected, sources, purposes, and disclosures, and may request correction or deletion where applicable. SDM Workflow does not sell personal information or share it for cross-context behavioral advertising and therefore does not offer a “Do Not Sell or Share” opt-out link.
Some California privacy laws apply only when statutory thresholds are met. Whether or not a particular statute applies, we will make reasonable efforts to honor verified access, correction, and deletion requests consistent with this Policy and applicable law.
11. International access
SDM Workflow is operated from California and information is processed in the United States. If you access the service from another country, your information may be transferred to a jurisdiction with different data-protection laws. Where legally required, additional safeguards may apply.
12. Children
The service is intended for business users age 18 and older and is not directed to children. We do not knowingly collect personal information from children. A parent or guardian who believes a child provided information should use the Privacy Request form.
13. Changes and contact
We may update this Policy as the service or law changes. The effective date above shows the latest revision. We will provide additional notice when a change materially affects existing customers.
Privacy questions and requests may be submitted through the Privacy Request form. No personal or private email address is published.