Privacy Policy

Information handled by PowerFlow

• Account information: the email address and sign-in session used to access PowerFlow. Sign-in credentials are handled by Supabase Auth.
• Purchasing records: vendor and program names, PO and invoice references, quantities, retail prices, amounts, freight, dates, shipping details, workflow selections, descriptions, and notes entered or imported by an authorized user.
• Local information: the browser can retain cached purchase orders, pending deals, preferences, and sign-in session information. Exported files are downloaded to the user's device.

Optional Gmail access

The optional connection uses Google's Gmail read-only permission to retrieve approved, forwarded invoice messages and PDF attachments for LSI Partnership records. Automatic importing runs only when the operator enables it. Connecting a Google account alone does not enable importing.

The permission provides technical read access to the connected mailbox, not just one sender or folder. Processing rules restrict automatic searches to the approved forwarder's invoice messages with PDF attachments and validate the sender, received time, and invoice references before saving. Only emails received after the first activation time are eligible. The connection does not request permission to send messages, change message status, or delete email.

The importer reads message headers, invoice identifiers in the message body, and selected PDF details: invoice, transaction, and auction listing IDs; Type, VRID, and Task ID references; quantities, retail prices, purchase prices, and shipping charges. Type identifies the approved program name. These details support purchasing records, duplicate checks, review, and later PO matching. A Gmail password is not requested or stored by PowerFlow.

Email bodies and source PDFs are processed temporarily in server memory, not retained by this importer as files or raw text. Selected extracted fields and processing history are saved in Supabase. That history includes Gmail message IDs, invoice references, received times, processing outcomes, retry counts, and links to saved purchasing records. Unsupported or ambiguous invoices are held for operator review instead of automatically creating a PO.

Gmail connection credentials are stored in server-side Supabase Secrets, not public website files. A separate scheduling credential is stored in Supabase Vault. The importer does not send invoice content to an AI model service.

Use and sharing

PowerFlow uses information to maintain purchasing records, display workflows and totals, support searches and exports, manage access, and troubleshoot the service. Gmail-derived information is not sold, used for advertising, or used to train AI models.

PowerFlow uses Netlify to host the website and Supabase for account sign-in, cloud records, and server-side secrets. Google provides Gmail and its authorization service. The purchasing application also downloads its Supabase client library from jsDelivr. These providers may process information necessary to deliver their services, including network and security information.

Approved message and PDF content is processed in Supabase's server-side function; selected details and processing history are stored in its database, not published on these information pages. Manual exports and any email drafts initiated by a user are controlled by that user; PowerFlow's existing email-draft feature opens the user's email application rather than sending through the Gmail connection.

PowerFlow follows the Google API Services User Data Policy, including its Limited Use requirements, when using or transferring information received through Google APIs.

Storage and deletion

Cloud purchasing records and importer processing history remain until the operator removes them; there is no automatic expiry. Processing history supports duplicate prevention and is retained separately when a purchasing record is deleted. The original messages and attachments remain in Gmail and are subject to that account's retention and deletion settings.

Local caches, downloaded exports, and separately retained backups may remain until they are removed separately. Deleting a PowerFlow record does not delete its processing history or the original email from Gmail. Contact the operator for a coordinated deletion request.

To request review or deletion of account information or imported records, contact the operator below. The operator may need to confirm your identity and authority over the records before making changes.

Access and your choices

The hosted purchasing application uses Supabase sign-in and database access controls. Public information pages do not read purchasing records or connect to Gmail. Keep sign-in details, Google tokens, and exported business records private.

You can withdraw the Google connection through your Google Account connections. Withdrawing permission stops future Gmail access once the revocation takes effect; it does not automatically remove records already saved in PowerFlow. Contact the operator if you also want those records reviewed or removed.

Contact and updates

For privacy questions or requests, contact Todd Pewitt at pewittmail@gmail.com.

This notice will be updated when data-handling practices change. New Google data uses require updated disclosures and any necessary authorization before they are introduced.