ArchFlow
Sign InView plans

Last updated 20 October 2026

Privacy Policy

This policy explains how ArchFlow (“we”, “us”) handles personal information when you visit archflowsolutions.com, create a firm account, use the practice workspace, talk to Archie on the web or WhatsApp, connect a mailbox, pay for a plan, open a client portal link, or subscribe to our newsletter. It covers firm users, newsletter subscribers, and the people whose details a firm stores in ArchFlow (clients, contractors, and team members).

Privacy questions and requests: sales@archflowsolutions.com. The Terms of Service sit alongside this policy.

1. Who we are

ArchFlow is a practice operating system for architecture firms. The public site and product are operated at archflowsolutions.com. We do not publish a street address on this page. Write to sales@archflowsolutions.com and we will handle the request, including a postal address when the law requires us to give one.

If you are in the European Economic Area or United Kingdom, ArchFlow is the controller of account, billing, and website data. For client, contractor, and project records a firm types into ArchFlow, the firm is the controller and we process that information on the firm’s instructions. If you are in South Africa, we process personal information as a responsible party for our own account data and as an operator for the firm’s practice records, under POPIA.

2. Who this covers

  • Visitors to the marketing site, login, signup, and these legal pages.
  • Firm owners and team members with an ArchFlow seat.
  • People you invite to a firm.
  • Clients, contractors, and other contacts whose names, emails, phones, and files a firm stores. Those people usually do not have their own ArchFlow account.
  • Anyone who opens a client portal link a firm sends them.
  • People who subscribe to the ArchFlow newsletter (they need no account; see section 11).

3. What we collect

Account and firm

Name, email, password or Google sign-in tokens, phone number if you add one, firm name, address, currency, logo, theme preference, team roles, and permissions.

How you found us

On your first visit we note what sent you to our site: the campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_content, utm_term), a Google or Meta ad click ID (gclid, fbclid), the page you arrived on (without anything after the “?”) and the name of the referring website. We keep this in a first-party cookie for 90 days. If you create an account, we save it with your firm, together with the role and practice size you give at sign-up. We use it to understand which campaigns and pages bring architecture practices to ArchFlow. We do not sell it or use it to build an advertising profile of you.

Practice records the firm enters

Clients and contractors (including email and phone), projects, fees, proposals, invoices, expenses, permits, drawings and revisions, RFIs, snags, variations, tasks, notes, time entries if the firm turns time tracking on, uploaded files, and portal settings.

Archie

Messages you send Archie in the web app or on WhatsApp, short conversation history used to answer follow-ups, and tool results (for example the client record Archie just updated). The browser may also keep the last day’s Archie thread on your device so changing menus does not wipe the chat.

Connected mailbox

If you connect Gmail or Outlook, we receive OAuth tokens and the mailbox address. We ask for access only to sign you in and send mail as you, so Archie can send mail you approve from your address. We do not read your inbox, in Gmail or in Outlook. We do not use the mailbox to advertise to your contacts.

WhatsApp

If you link a number, Meta delivers the message text, media, and your WhatsApp identifier to our bot. Replies go back through the WhatsApp Business API.

Voice notes

If your firm uses voice notes on WhatsApp, Meta delivers the recording to our bot like any other message. We have it turned into text (section 5), and keep what Archie understood from it as a list waiting for the sender to type YES or tap Save. We do not keep the recording. For each note we also keep a usage record (who sent it, when, how long it was, and whether it worked) without any of the words, to apply the daily fair-use limit.

Studio and drafts

Images, sketches, prompts, and generated stills or films, plus credit usage against the firm wallet.

AI Compliance Checker

Drawing sets you upload for a check (PDF or image files), the page images and drawing text your browser cuts from them, where the project is and what it is (country, region, local authority, building use, type of work, the code basis you choose, and any planning figures you enter), the facts and findings the check produces, your decisions on each finding, and the name and registration number of the person who marks a report reviewed. Title blocks often carry names, addresses, and contact details; that information comes with the drawings.

Billing

Plan, interval, seat count, payment status, and identifiers our payments provider needs. We do not store full card numbers on ArchFlow servers. Card data is handled by Dodo Payments as merchant of record.

Newsletter

If you subscribe: your email address, and if you give them your first name, what you do and your country, with the consent you gave and a keyed hash of your IP address. Section 11 has the detail.

Password reset

When you ask for a password reset on the sign-in page, we check whether an ArchFlow account uses the address you typed and how it signs in (with a password or with Google), and the page says which. So anyone who types an address there learns whether it has an ArchFlow account, and whether that account signs in only with Google; nothing else about the account is shown. To limit how much the form can be used to test addresses or to flood an inbox (10 checks an hour from one connection, 3 reset emails an hour to one account), we keep a keyed hash (HMAC) of the IP address the request came from (for IPv6, of its first 64 bits, and of its first 48), never the address itself, and, when we send a reset link, a keyed hash of the account's email address. Both are deleted within two hours. Cloudflare Turnstile runs its “not a robot” check on that form too (most people never see it): it receives your IP address and browser details for that check, under Cloudflare's own privacy policy (section 12).

Technical logs

IP address, browser, pages requested, and error logs needed to run and secure the service. We do not sell advertising profiles.

4. How we use it

  • Provide the workspace, portal, Archie, Render Studio, Technical Drafts, and the AI Compliance Checker.
  • Authenticate you, keep seats and permissions accurate, and send system mail (invites, password reset, sign-in links, email-address confirmations, invoices from us).
  • Send the person who created the firm a short series of product emails: a welcome, a few setup tips, reminders about the account's plan (for example while it has no plan yet), and a note when the AI credits run low. Every one has an unsubscribe link, and turning them off never stops account email such as password resets, invites and receipts.
  • If you email us your data for free setup, we use it only to set up your workspace, and we delete the email and its files once setup is done.
  • Send the newsletter to people who subscribed and confirmed their address, and the emails the sign-up needs (section 11).
  • Process subscription payments and credit the firm wallet.
  • Update firm records when you ask Archie to change an email, phone, address, or other field.
  • Turn WhatsApp voice notes into text, list what Archie understood, and save only what the sender confirms by typing YES or tapping Save.
  • Send email as you after you confirm a draft, when a mailbox is connected.
  • Prevent abuse, debug failures, and meet legal duties.

Legal bases (GDPR / UK GDPR) include contract (providing the service you bought), legitimate interests (security, product operation, answering support), consent (optional mailbox connect, WhatsApp link, cookies that are not strictly necessary, and the newsletter), and legal obligation. Under POPIA we process for the same purposes with the grounds that apply to those purposes. We send product emails under our legitimate interest in helping you set up and use the service you signed up for (and, where a law treats them as marketing, as messages to an existing customer about our own service). You can unsubscribe at any time with the link in any of them. The newsletter is different: it goes only to people who asked for it and confirmed (consent; section 11), customers or not.

5. Archie and other AI

Archie is ArchFlow’s assistant on the web and on WhatsApp. It reads and can update the same firm data you can, within your team permissions. It may send the text of your prompt and the tool results it needs to a large-language-model provider (currently Anthropic) so it can answer. Render Studio and Technical Drafts send images and prompts to image-generation providers to produce the still, film, or plan you requested.

Voice notes

A voice note sent to Archie on WhatsApp goes to OpenAI, which turns it into text and may process it in the United States. With the recording we send a short list of building words to help it hear trade terms, never your project, client or contractor names. OpenAI’s terms for its API say it does not train its models on what we send, and it may keep it for up to 30 days to watch for abuse. Archie then reads the text, as it would a typed message, and replies with a list of what it understood. Nothing is saved to your projects until the sender types YES or taps Save; until then the list is visible only to the sender. We do not keep the recording, and we ask Meta to delete its copy once we have it, though what Meta keeps is governed by WhatsApp’s own terms. While a note’s list is waiting, its text stays in Archie’s short chat history so Archie can follow up on it. Once the list is saved, cancelled or expires, the text is replaced by a one-line summary within the hour.

If a voice note records other people, for example at a site meeting, let them know you are recording and what it is for.

The AI Compliance Checker sends the drawing text and page images of a check to Anthropic so its models can read them; images go as links that expire within an hour, and Anthropic may process them in the United States. The rules a drawing is checked against are written by ArchFlow, not by the model. Where we have not researched a place’s rules, the checker searches official government and standards sources on the web for that place’s published requirements (through Anthropic’s web search) and keeps what it finds to reuse for other checks in the same place. That search uses only the country, region, and type of building, never your drawings, your project, or your client’s details. We do not use uploaded drawings or check results to train AI models, and Anthropic’s commercial terms do not allow it to train its models on them.

The AI Template Matcher on the invoice page sends the template you upload and the invoice’s details to Anthropic, so it can lay the invoice out in your template’s style. Those details are what the invoice prints: your firm’s name, address, email, phone, tax and registration numbers and bank details, the client’s name, address, contact details and tax number, and the project, lines, dates, notes and totals. Nothing is sent unless you use the matcher. We do not use them to train AI models, and Anthropic’s commercial terms do not allow it to train its models on them.

Do not paste secrets you would not store in the firm file. Archie can be wrong. Confirm emails before send. You stay responsible for what is written to the CRM and what is sent to a client.

6. Google user data

If you sign in with Google or connect Gmail so Archie can send mail as you, ArchFlow accesses Google user data only with your consent, and only for the features you turn on. We request these Google API scopes:

  • openid, email, and profile — to create or sign in to your ArchFlow account and show the Google account you used.
  • gmail.send — to send an email from your Gmail address after you review a draft and confirm send. We do not send mail in the background without that confirmation. We do not request Gmail read access.

How we use Google user data: account authentication, sending confirmed mail from your mailbox, and refreshing the connection with the tokens Google returns. We do not read your inbox. We do not use Google user data for advertising, credit scoring, or selling access to other parties. We do not allow humans to read Google user data unless you ask us to for support, we must do so for security or law, or the data is already public.

ArchFlow’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Gmail is used only to send mail you confirm. We do not transfer Gmail content to other parties except the processors that deliver this product (for example our EU database host), and then only to provide that send feature.

OAuth tokens are stored encrypted. You can disconnect Gmail in Settings → Account, or revoke ArchFlow in your Google Account permissions. After disconnect we stop using those tokens and delete them from the firm record.

7. Connected email (Gmail and Outlook)

Connecting Gmail or Outlook is optional. Tokens are stored so Archie can send as you after you confirm. We ask Google and Microsoft for permission only to sign you in and send mail as you. We do not read your inbox, and we do not copy mail you receive into ArchFlow. You can disconnect the mailbox in Settings → Account. Revoking access in Google or Microsoft also stops new use of those tokens. Google and Microsoft are independent controllers of their own account data; their policies apply as well.

8. WhatsApp

Archie on WhatsApp is optional reach into the same firm dataset. Meta processes messages under its WhatsApp Business terms. We use the content to carry out your instructions (create or update records, send a drawing, quote a render). Unlink the number in Settings if you want that channel off. The firm owner can also switch voice notes off for the whole firm in Settings.

9. Client portal

Clients do not need an ArchFlow account. A firm shares a token link. Anyone with the link can see the progress, fees, invoices, approved drawings, and permit status the firm chose to publish. The firm can revoke the link. Treat the URL like a document you would email a client.

Client approvals

A firm can switch on client approvals. It can then ask its client, through the portal link, to approve a stage of the work or a set of drawings. When the client approves or asks for changes, ArchFlow keeps the firm's record of that decision: the name the client typed, their email address, the date and time, the IP address and device details (the browser and operating system) the decision came from, which drawings they opened, any comments, and, when the firm asks for one, the signature they drew. When the firm asks for an email code, we email a 6-digit code to the client and store only a salted hash of it, which expires after 30 minutes. A firm can also record a decision the client gave by email, phone or in person; the client is emailed what was recorded and can tell the firm within 14 days if it is wrong.

A copy of each drawing is kept in private storage with its fingerprint (a SHA-256 hash), and each decision gets a fingerprint too, so a later change to the record can be detected. The client and the firm are emailed a PDF of the record, and a copy is filed with the project's documents. The copies of the drawings and the PDFs stay with the project; when the firm deletes the project, ArchFlow removes them from storage too (see section 14). The firm is the controller of this record; we keep it on the firm's behalf, and the firm's own privacy notice may apply as well (the approval page links to it). The IP address, device details, email address and signature are kept apart from the fingerprinted record, so the firm owner can erase them on request without breaking it; the name, the decision and its time stay. In the firm, only members who work with the client portal can see those details. If you approved something for a firm, ask that firm first (see section 18).

10. Payments

Subscriptions and eligible purchases are charged by Dodo Payments as merchant of record. Dodo receives the billing details needed to take payment and handle tax where it is the seller of record. See Dodo’s own privacy notice as well. Plan prices on the site are in US dollars unless we say otherwise.

11. The newsletter

Anyone can subscribe to the ArchFlow newsletter on our homepage or at archflowsolutions.com/newsletter. You don't need an account, and subscribing has nothing to do with a firm's workspace.

  • What we collect. Your email address; if you give them, your first name, what you do (architect, practice owner, student or other) and your country; which form you used; the exact wording of the box you ticked, its version and when you ticked it; and when you confirmed. We also keep a keyed hash (HMAC) of the IP address the sign-up came from (for IPv6, of its first 64 bits; for the flood limit alone, also of its first 48), never the address itself. We use it to stop one connection flooding the form, and as a record of where the sign-up came from.
  • Legal basis: your consent. The box starts unticked, and you are added only after you click the link in the confirmation email we send you (double opt-in). You can withdraw your consent at any time: with the unsubscribe link in every issue, the Unsubscribe button your email app shows, or at archflowsolutions.com/newsletter/unsubscribe, with no sign-in (without your link, type your address there and we email it a new one, so nobody else can unsubscribe you). Withdrawing does not affect what was sent before.
  • What we send.The confirmation email (just the link, and a link to tell us it wasn't you, which deletes the request at once); if someone signs up an address that is already subscribed, a short note saying nothing changed; if someone asks on the unsubscribe page, an email with a new unsubscribe link to an address already on the list; and the newsletter itself. The newsletter has no tracking pixel and no tracked links, so we don't record whether you open it or what you click. We don't sell or share the list, and we don't use it to build an advertising profile of you.
  • Who handles it.Supabase stores the list (in the EU), and Resend sends the emails. When you start on a sign-up form, Cloudflare Turnstile runs its “not a robot” check (most people never see it): it receives your IP address and browser details for that check, under Cloudflare's own privacy policy.
  • How long we keep it. A sign-up nobody confirms loses its name, role and country when its link expires after 7 days, and is deleted after 30 days. Sign-up attempts (the IP hash and the time) are deleted after a day, and our record of the sign-up emails we sent after 2 days. For each issue, our record of who it went to and whether Resend accepted it (which stops anyone getting it twice) is deleted 30 days after the issue goes out; only the totals stay. While you are subscribed we keep your details. When you unsubscribe we delete your name, role, country and IP hash, and keep only your address, the consent wording and the dates you subscribed and left (and, until its 30 days are up, the record of issues already sent to you): the record that you opted in and then out, which also stops us adding the address again by mistake. Write to sales@archflowsolutions.com if you want that record erased too, and we will erase everything we hold about the address.

12. Processors we rely on

We use specialist providers to run ArchFlow. The main ones today are:

  • Supabase — authentication, database, file storage, and edge functions (hosted in the EU, eu-west-1).
  • Vercel — hosting the web application.
  • Dodo Payments — checkout and subscription billing.
  • Anthropic — Archie language responses, reading drawings for the AI Compliance Checker (including its searches of official sources), and laying out invoices for the AI Template Matcher.
  • OpenAI — turning WhatsApp voice notes into text (section 5).
  • Image-generation providers — Render Studio and Technical Drafts outputs.
  • Google and Microsoft — optional sign-in and mailbox OAuth.
  • Meta — WhatsApp Business delivery, and the Meta Pixel for measuring our own ads (see Cookies).
  • Google Ads — the Google tag for measuring our own ads (see Cookies).
  • Resend — system email (invites, notifications) when a personal mailbox is not used, the product emails described in section 4, client approval emails and codes (section 9), and the newsletter and its sign-up emails (section 11).
  • Cloudflare — Turnstile, the “not a robot” check on the newsletter sign-up forms (section 11) and the password-reset form on the sign-in page (section 3). For that check it receives the IP address and browser details of whoever uses the form.

Providers only get what they need to perform that job. We will update this list if the stack that holds personal information changes in a material way.

13. Cookies and device storage

We use cookies and similar storage to keep you signed in, remember a plan you picked before signup, store theme preference, keep the last day’s Archie conversation on the device you used, and, on the page where you choose a new password, keep the reset link in that browser tab until it is used or the tab is closed (so reloading the page doesn't lose it). The pages that open a sign-in link or an email-address change from one of our emails keep that link in the same way; the email-change link names the old and the new address. These are needed to run the product. You can clear site data in the browser; you will need to sign in again.

We set one first-party cookie, af_src, that remembers how you first reached our site (the campaign tags, the ad click ID, the page you arrived on and the referring site’s name) for 90 days, so that if you sign up later we can tell which ad or page brought you. Only our own site reads it; it is not shared with Meta, Google or anyone else.

We also use the Meta Pixel and the Google Ads tag to measure our own advertising on Facebook, Instagram and Google. They record page visits and a few actions on our website (watching the demo, confirming a new account, starting checkout and paying for a plan, with the amount paid) so we can see which of our ads work. We do not send Meta or Google your name, email, firm data, clients, projects or anything inside the workspace. Meta and Google may link these events to your own accounts with them under their own privacy policies. You can limit this in your Meta and Google ad settings or by blocking third-party cookies in your browser.

14. How long we keep it

Account and firm records stay until the firm deletes them or the account is closed and any legal retention period ends (for example tax records for invoices). Archie chat history on the server is a short rolling window; the browser copy expires after one day. Mailbox tokens stay until you disconnect. How you found us, and your sign-up answers, stay with the firm’s account until it is deleted. The af_src cookie expires after 90 days. We keep a record of which product emails we sent, and your unsubscribe choice, for as long as the account exists. AI Compliance Checker: the uploaded files, the report, and its facts and findings stay until someone at the firm deletes the check or the account is closed. The page images cut from the drawings for reading are deleted 30 days after the check finishes. What the checker finds in official sources for a place holds no customer information and is kept to reuse for later checks. Newsletter: section 11 sets out what is deleted when, and what stays after you unsubscribe. Client approvals: the record of a decision, its copies of the drawings and its PDF stay with the project until the firm deletes the project, which ArchFlow allows only after the firm has exported the whole decision log. Deleting the project deletes the record, and ArchFlow then removes the copies of the drawings and the PDFs from storage, usually within the hour. Copies already emailed to the client or the firm stay in those mailboxes. The firm owner can erase the personal details in a record sooner (section 9). Password reset: the hashes of the IP address and of the email address are deleted within two hours. Voice notes: the recording is not kept. A list waiting for YES or Save is kept until 23:59 on the firm’s next working day, on the firm’s own clock; after that nothing from it is saved, and the sender can bring it back by replying RESTORE for 14 days. Once a list is saved, cancelled or expires, the text of its notes leaves Archie’s chat history within the hour (section 5). Lists that were saved, cancelled or expired are deleted 30 days after they closed. The usage record of each note (no words) stays with the firm’s account. Backups exist for a limited period for disaster recovery. Support mail to sales@archflowsolutions.com is kept as long as the thread is still needed.

15. When we share it

We do not sell personal information. We share it with the processors above, with the firm’s own members according to permissions, with a client who has a portal link the firm created, and if the law or a binding request requires it. If ArchFlow is sold or merged, information may move with the business under this policy or a successor notice.

16. International transfers

You may access ArchFlow from outside the country where the data is stored. Infrastructure listed above may process data in the EU, the United States, or other regions those providers operate in. Where a transfer needs a safeguard (for example standard contractual clauses), we rely on the provider’s terms and those clauses. Voice notes go to OpenAI in the United States under its data processing addendum, which includes standard contractual clauses.

17. Security

Access to the workspace is authenticated. Firm data is scoped so one firm cannot read another. Mailbox tokens are stored encrypted. No internet service is perfectly secure. Use a unique password, limit team permissions, and revoke portal links and mailboxes you no longer need.

18. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or port personal information, to object to some processing, and to withdraw consent (for example disconnect Gmail, or unsubscribe from the newsletter). Firm users can edit most practice records in the app or ask Archie to update them. For account deletion or a copy of what we hold, email sales@archflowsolutions.com from the address on the account. We may need to verify who is asking.

If we process your details only because a firm stored them (you are a client of that firm), contact that firm first. We will help the firm respond.

You can complain to your data protection authority. In South Africa that is the Information Regulator. In the EEA or UK, complain to your local authority.

19. Children

ArchFlow is built for architecture practices, not for children. We do not knowingly collect information from anyone under 16. If you believe a child created an account, write to sales@archflowsolutions.com and we will close it.

20. Changes

We will update this page when the product or the law requires it. The date at the top is the current version. Material changes will be noted here; if a change needs consent, we will ask for it.