Privacy Policy
Last updated 2 November 2026
StaffFlow is timesheet-to-invoice automation software for staffing firms. This policy explains what data we handle, where it goes, and who else can see it. It is written to describe what the software actually does, rather than to reserve rights we do not use.
Who we are
StaffFlow is operated by Saichandra Bandi, Hyderabad, Telangana, India. For any question about this policy, or to exercise a right described below, write to hello@staffflowpro.com.
Where StaffFlow processes data on behalf of a customer, that customer is the data controller and StaffFlow is a processor acting on their instructions. The terms of that processing are set out in our Data Processing Agreement, which forms part of our Terms of Service.
What data StaffFlow handles
- Configuration. Consultant names, placement records, bill rates, pay rates and pay percentages, vendor names, and routing email addresses. Entered by the customer.
- Timesheet content. Documents received in the customer's mailbox, and the hours read from them.
- Invoice and pay figures. Invoice amounts, periods, and the QuickBooks identifiers of invoices created; and the pay amounts StaffFlow computes from the customer's pay rates and percentages.
- Operational logs. Errors, processing outcomes, and the identifiers of emails handled — used to investigate failures.
- Account data. The name, email address, role, password hash and, where enabled, encrypted two-step sign-in secret of each dashboard user. When someone asks to reset a password, we record the time and the network address of the request, to limit abuse. When an admin invites someone, we keep the invited address, name and access level until the invite is accepted or cancelled.
- Access requests. When a firm asks for access through our request form, we keep what it sends — the contact’s name, work email and phone, and the firm’s name, size, email system and accounting system — to reply and arrange setup. For this data StaffFlow is the controller. The form uses Cloudflare Turnstile to tell people from automated traffic, and we keep a one-way hash of the visitor’s network address for one day to limit abuse.
StaffFlow does not request or store payment card details, bank account numbers, social security numbers, or tax identifiers. Where a customer enters pay rates or pay percentages, StaffFlow uses them only to compute pay figures and margin for the customer's review; it does not run payroll, make payments, or hold the bank details of anyone it pays.
Where your records live
StaffFlow does not become a second system of record. Timesheet documents are filed into the customer's own OneDrive. Invoices are created in the customer's own QuickBooks company. StaffFlow's database holds the configuration, the hours recorded, the invoice references and pay figures, the audit history behind them, and the operational logs described above.
Who else sees your data
Reading a timesheet requires sending its contents to services that can interpret a document. We name each one, and what it receives:
| Processor | What it receives | Purpose |
|---|---|---|
| n8n (workflow engine, self-hosted on our Railway infrastructure — not a third-party service) | Timesheet emails and their attachments | Runs the workflow that passes a timesheet to the services below |
| Microsoft Azure (Document Intelligence) | Timesheet document contents | Reads text and tables from images and PDFs. Deleted 24 hours after processing |
| OpenAI | Timesheet text and tables | Extracts hours, dates, and labels. Not used for training; may be kept up to 30 days for abuse monitoring, then deleted |
| Microsoft Graph | Mailbox and OneDrive access, as authorised by the customer | Receives timesheets, files documents |
| Intuit QuickBooks Online | Invoice data, as authorised by the customer | Creates invoices and attaches proof |
| Railway | Application hosting, database, and workflow engine | Runs StaffFlow |
| Cloudflare | Dashboard hosting; the bot check on the access-request form | Serves the web application; checks that access requests come from people |
| Resend | Operational alert emails; password-reset, password-changed and invitation emails to dashboard users (their email address, the firm’s name and, for a reset or an invitation, a single-use link) | Notifies the operator of failures; sends account emails |
n8n is StaffFlow's own software, run on Railway. Microsoft Graph and QuickBooks Online act on the customer's own Microsoft 365 tenant and QuickBooks company, as the customer authorises. The others act as our sub-processors, under the terms and retention set out in Annex 3 of the Data Processing Agreement; customers are told at least fourteen days before a new one is added. We do not sell personal data, we do not share it for advertising, and we do not permit our processors to use customer content to train their models.
QuickBooks data
StaffFlow accesses a customer's QuickBooks company only after an authorised user of that company grants access through Intuit's consent screen. We request the minimum scope needed to read customers, create invoices, and read the status and payments of the invoices StaffFlow created or the customer linked to it. Access can be revoked at any time from within QuickBooks, or by writing to us. StaffFlow does not read bank feeds, payroll, or transactions unrelated to those invoices.
Security
- All data in transit is encrypted with TLS.
- QuickBooks access tokens and two-step sign-in secrets are encrypted by StaffFlow before storage. Passwords are stored only as bcrypt hashes.
- A password-reset link works once and expires after 30 minutes, and only a one-way hash of it is stored. A reset never signs anyone in, so two-step sign-in still applies.
- Access to the dashboard requires authentication, and every request is scoped to a single customer.
- StaffFlow staff access customer data only to operate the service and resolve issues, and do not review timesheet contents beyond what an issue requires.
- Credentials and API tokens are held as environment secrets, never in source code.
The full set of measures is described on our Security page. No system is perfectly secure. If a breach affects your data, we will tell you without undue delay, and in any event within 72 hours of becoming aware of it, and describe what happened.
Retention
Configuration, hours, and invoice records are retained for as long as the customer's account is active, because they are the audit trail behind invoices already issued. Operational logs are retained while they remain useful for investigation. Records of password-reset requests are deleted after 90 days. Invites that were cancelled, accepted or never answered are deleted 90 days later. Access requests are deleted 12 months after they are sent. When a customer closes its account, its data is exported to its admins, kept for a fourteen-day grace period, and then deleted from our live systems within thirty days of closing; backup copies expire within about ninety days and are never restored selectively. Details are in the Data Processing Agreement.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete personal data we hold about you, and to object to or restrict its processing. Where StaffFlow acts as a processor for a customer, please direct such a request to that customer; we will assist them in answering it. Otherwise, write to hello@staffflowpro.com.
International transfers
StaffFlow is operated from India. Its processors operate infrastructure in the United States and elsewhere. Data handled by StaffFlow may therefore be processed outside the country in which it was collected.
Children
StaffFlow is business software. It is not directed at children and we do not knowingly collect data from anyone under 18.
Changes
If this policy changes materially, we will update the date above and, where the change affects an active customer, tell them directly.