Privacy Policy

This page explains what OnboardFlow collects and why, for both agencies using the dashboard and their clients completing a campaign.

What we collect

From an agency: account details (name, email, a securely hashed password) and whatever campaigns, tasks, and branding settings they create. From a client: whatever they submit through a campaign's link — file uploads, text answers, and the timestamps of when they submitted them. Clients never create an account, so we don't collect a password or profile from them — their campaign link is the only credential involved.

How it's used

Client submissions are shown only to the agency that created the campaign. We use an agency's email to send account verification, password reset, and campaign reminder ("nudge") emails via our email provider. We don't sell or share this data with third parties, and we don't use it for advertising.

Cookies

We set one cookie — a signed, httpOnly session cookie used to keep an agency user logged in. It isn't used for tracking or advertising. Clients accessing a campaign link don't get a session cookie at all.

Data retention & deletion

An agency can delete a campaign at any time, which permanently removes its tasks, submissions, and uploaded files. To request deletion of an agency account or the data tied to it, contact us directly.

Changes

We may update this policy as the product changes. Material changes will be reflected here.