Draft — pending legal review
Privacy policy
What we collect, why, who helps us process it, and the choices you have.
Last updated September 28, 2026
Who we are
mdflows is operated by Markdown Consulting (“we”, “us”). This policy covers mdflows.com and mdflows Cloud. On-premises installations run on our customers’ own infrastructure; we do not receive their data.
Two roles
For your organization’s content we are a processor. Forms, submissions, uploaded files, documents, signatures and workflow data belong to the organization that collects them. We process that content only to provide the service, on that organization’s instructions. If you filled in a form or signed a document, the organization that sent it to you is responsible for it — contact them first.
For accounts and the website we are a controller. That covers the information below.
What we collect
- Signup details: your name, email address and organization name. Unverified signups are deleted within 24 hours; once an organization is created, the pending record’s name and email are erased (a one-way fingerprint of the email is kept to limit repeated free trials).
- Account data: staff names, email addresses, roles, password hashes and two-factor settings, stored in your organization’s own database.
- Security records: sign-in sessions with IP address and browser, and audit entries recording who did what and when.
- Operational data: short-lived rate-limit counters keyed by IP address, and error logs used to keep the service running.
- Correspondence you send us, and billing contacts once you subscribe.
We do not sell personal information, and we do not use advertising or analytics trackers.
Cookies
We use only strictly necessary cookies: a session cookie per organization you sign in to, and one for our own operators. The signup form uses Cloudflare Turnstile to tell people from bots; it processes technical signals about your browser for that purpose only.
Who helps us
- Cloudflare, Inc.
- Hosting, databases, file storage, email delivery, bot protection, and — only if your organization chooses our hosted model — AI processing.
- Services you connect
- If your organization connects Microsoft 365, Google, SharePoint, its own database, or its own AI provider key, data flows to those services under your organization’s own agreement with them.
How long we keep it
Organization data is kept while the organization exists. When an organization asks us to delete it, it is scheduled for permanent deletion after a short grace period; deleted data can persist in point-in-time database recovery for up to 30 days after that. Individual records follow the retention rules each organization sets.
Your choices and rights
You can ask us to access, correct, export or delete personal information we hold as a controller, and you can object to or restrict some processing. For content an organization collected about you, ask that organization — mdflows gives them the tools to answer. Write to help@mdflows.com; we respond within 30 days.
Students and minors
mdflows is not directed at children. When a school or other organization uses mdflows to collect information from students or minors, that organization is responsible for any consents the law requires.
Sensitive information
mdflows is not designed to hold payment card numbers or protected health information under HIPAA; organizations should not collect those through it unless we have agreed otherwise in writing.
Security
See the security overview for how the service protects data.
Changes
We will post changes here with a new date, and email account owners about material changes before they take effect.
Contact
Markdown Consulting · help@mdflows.com