Legal
Privacy notice
Last updated: October 7, 2026
This privacy notice explains what personal information the FLOW workspace at https://flowoftheday.com collects, how it is used and shared, how long it is kept, and the choices you have. Creative Exit, LLC ("we", "us") runs the workspace for FLOW.
Who is responsible for your information
Every location (store) in the workspace belongs to its own company. That company — usually your employer — decides which records it keeps about the people who work there and how it uses them. We run the workspace for those companies and handle their records on their instructions, as their service provider. For information about the workspace itself, such as sign-in and security records, we are responsible. Questions about your employer's own records are best sent to your employer first; you can also write to us at support@flowoftheday.com.
If a security breach affects your employer's records, we tell your employer promptly and help them tell you, as the law requires.
Who this notice covers
Everyone with an account in the workspace (owners, managers and team members), people invited to create one, and outside contacts — such as suppliers and service vendors — who use a link or portal page sent to them.
What we collect
- Account details: name, email address, role, the locations you work at, preferred language, start date, and, if you add them, a phone number, profile photo and emergency contact.
- Sign-in and security records: your password in a scrambled form no one can read, your two-step sign-in settings, when you signed in, and a log of important actions with the time and the network (IP) address they came from.
- Work records you and your managers create: checklists, temperature and food-safety logs, counts, orders, waste, maintenance requests, cash and invoice records, announcements and logbook entries.
- Onboarding and training records: what you are asked to read or sign, the exact wording shown, the name you type to sign, the time, network address and device description at signing, forms you fill in, certificates you upload, the time each step took, and your training progress, quiz results and completion dates.
- Files and photos uploaded as part of the work, such as proof photos, invoices, documents and certificates. The location, time and camera details that phones store inside a photo are removed when it is uploaded.
- Notification choices and history: which alerts you receive and how, and whether each message was delivered.
- Technical records: the network (IP) address, browser and device description sent with each visit, kept in security and error logs.
- For outside contacts: the name, email address and phone number the business keeps for them, and what they send back through their link or portal.
Where it comes from
From you, when you type or upload something; from your employer and managers, for example when they invite you, assign you to a location or record your training; from outside contacts who use a link or portal; and from your device, automatically, when you use the workspace.
How we use it
- To run the workspace: let you sign in, show you your work and keep the records the business needs.
- To send the alerts you and your managers set up, and account emails such as invitations, password resets and sign-in codes.
- To keep the workspace and its users safe: prevent misuse and fraud, and look into problems.
- To support and improve the workspace: fix errors and answer questions.
- To meet legal duties: keep records the law requires and answer lawful requests.
We do not sell your personal information, share it for advertising based on your activity across other sites, use it for advertising, or give it to data brokers. We do not use it to train artificial intelligence models.
Who we share it with
- Inside the workspace: what each person sees follows their role and the locations they belong to. Managers see the records of the locations they manage. Your profile photo is shown only to the people who work at the same locations as you.
- Between companies: a location's records are shared with another company only when the companies have agreed to it in the workspace. The companies may agree to share refund customer records and watch-list flags with every company using the workspace, so that any of their stores can see them.
- Service providers who help us run the workspace: our web host, a network security service that shields the site from attacks and delivers its pages, our email delivery service and, when those features are switched on, a text-message provider, the browser makers' notification services, an AI service that reads invoice photos and supplier messages, and a file storage provider. They may use your information only to provide their service to us.
- When the law requires it or to protect people: to comply with a law, court order or lawful request, or to protect the safety or rights of anyone.
- If the business changes hands: as part of a merger, sale or transfer of the workspace, with this notice continuing to apply.
The people who run the workspace can reach records to support and maintain it, and important actions are logged.
The service providers the workspace uses today:
- GoDaddy: hosts the workspace, its database and the files people upload, and sends its emails.
- Cloudflare: shields the site from attacks and delivers its pages.
- The notification services of the browser makers (Google, Apple, Mozilla and Microsoft): pass alerts to the devices where a person has turned on notifications.
If your business switches on invoice reading, Anthropic, the AI service, reads the invoice photos and supplier messages. If text messages or signing in with Google are switched on, the text-message provider or Google is added to this list. We update this list before we start using a new service provider.
When someone chooses a password or signs in with one, the first 5 characters of a scrambled copy of it (its hash) are checked against Have I Been Pwned's free list of passwords exposed in data leaks. The password itself, and anything that identifies you, never leaves the workspace.
Text messages
If you add a mobile number, confirm it and agree to receive text alerts, your employer's work alerts may be sent to it. How many messages you get depends on your alerts. Message and data rates may apply. Reply STOP to stop them or HELP for help, or switch them off in your notification settings. Agreeing to texts is never a condition of your job or of using the workspace. We do not share your mobile number or your consent to receive texts with anyone for their own marketing.
Signing in with Google
If your business offers Google sign-in and you choose it, Google tells this site the email address of your Google account and whether Google has confirmed it, so it can be matched to your existing account. No account is created this way, and nothing else from your Google account is read or kept.
Reading invoices and messages with AI
When your business switches on automatic invoice reading, invoice photos taken at deliveries, and supplier messages a manager pastes into the Order Assistant, are sent to an AI service provider to read the supplier, items and prices. Nothing else is sent, and a person checks the result.
Cookies
The workspace uses only the cookies it needs to work and to keep you signed in and secure — no advertising, tracking or analytics. The cookie notice at https://flowoftheday.com/legal/cookies explains each one.
How long we keep it
- While a location uses the workspace, its records are kept until its company deletes them or closes.
- When a company closes, its records are kept for the periods set under Record Retention and are then removed. Some records have a minimum: food-safety records are kept at least 3 years, and the onboarding and training records of people who worked there at least 3 years after they left.
- Activity and security logs are kept with the records they describe.
- The workspace is backed up every night; these backups are encrypted and the last 7 are kept. A copy of the database is also kept from before each of the last 5 updates. Removed records can remain in these copies until they are replaced.
How we protect it
Connections to the workspace are encrypted. Passwords are stored in a form no one can read, and saved keys for outside services, session records and nightly backups are encrypted. Access follows each person's role and locations, important actions are logged, and two-step sign-in is available and can be required. No system is perfectly secure; if a security breach affects your information, you will be told as the law requires.
Your choices and rights
You can see and update your own details in your profile, choose which alerts you get and how, and download a copy of your onboarding and training records.
You can also ask to see, correct or delete your personal information, to get a copy of it, and to know how it is used and shared. Because your employer decides about most work records, we may pass your request to them. Some records must be kept by law; if we cannot delete something, we will tell you why. We will not treat you differently for using these rights. To make a request, use the form at https://flowoftheday.com/contact or write to support@flowoftheday.com. We answer within 45 days, confirm who you are before acting, and you may ask someone to make a request for you.
California residents
If California law applies to your information, you have the right to know what personal information is collected, used and disclosed, and to ask for it to be deleted or corrected. In the past 12 months the workspace has collected: identifiers (such as name, email address, phone number and network address); professional or employment information (such as role, locations, start date, onboarding and training records); internet activity within the workspace (such as sign-in and security records); photos and files you upload; and account sign-in details, which are sensitive personal information. They are collected for the purposes and kept for the periods described above. We do not sell or share personal information, including that of anyone under 16, and we do not use sensitive personal information to infer anything about you. Make a request as described under "Your choices and rights".
Children
The workspace is for people who work for or with the businesses that use it. It is not meant for children under 13, and we do not knowingly collect their information.
Where your information is stored
The workspace is hosted in the United States. If you use it from another country, your information is transferred to and stored in the United States.
Changes to this notice
When this notice changes, the new version is posted on this page with a new date. For important changes, we also tell you in the workspace.
Contact
Creative Exit, LLC, 16027 Brookhurst St. Suite I-747, Fountain Valley, California, CA 92708. Email: support@flowoftheday.com.