This Privacy Policy explains how TaxLegit Consulting Private Limited collects, uses, and protects your information while using the FlowIQ platform. TaxLegit Consulting Private Limited is committed to protecting the privacy, confidentiality, and security of your organization and user data.
1. Information We Collect
- Company & Process Data: Process flows, subprocess definitions, policy guidelines, operational context, ERP details, and uploaded documentation provided for SOP and RCM generation.
- Account Data: Names, corporate email addresses, phone numbers, job titles, organization names, and billing metadata necessary to create, authenticate, and manage your account.
- Usage & Telemetry Data: Information regarding feature usage, generation runs, credit consumption, and system performance telemetry collected to maintain platform reliability.
2. How We Use Your Data & AI Boundaries
- Generate requested Standard Operating Procedures (SOPs), Risk Control Matrices (RCMs), and process documentation
- Authenticate users, manage tenant workspaces, and enforce role-based access controls
- Process billing, maintain your AI credit wallet balance, and deliver customer technical support
- Protect against fraud, unauthorized system access, and security threats
- Zero Public AI Model Training: We do not sell your data or use your confidential corporate workflows, internal control narratives, or policy documentation to train, fine-tune, or evaluate public or third-party artificial intelligence models.
3. Enterprise Data Security
We implement enterprise-grade security controls to safeguard your data, including:
- Encryption at Rest: AES-256 field-level encryption for sensitive profile fields and database records
- Encryption in Transit: TLS 1.3 encryption for all data transmitted between your browser and our servers
- Access Controls & Segregation of Duties: Strict logical tenant isolation and role-based permissions (Admin, Member, Reviewer) enforcing organizational segregation of duties
- Network Security: Firewalls, automated vulnerability scanning, and secure API gateways
- Cloud Hosting Standards: ISO 27001-certified cloud infrastructure
4. Data Retention & Destruction
Your workspace data is retained as long as your account remains active. Upon account termination or verified written request, your data is securely purged from our active production databases within 30 days in accordance with applicable data retention protocols. We maintain:
- Regular security reviews and access audits
- Employee training on data confidentiality and security best practices
- Strict confidentiality agreements with all personnel and infrastructure partners
- Incident response and security breach notification protocols
5. Your Privacy Rights
You have the right to access your organization's data, request data exports in portable formats (Word/Excel), and update or correct inaccurate account information through your settings dashboard or by contacting support.
