Project Cashflow Privacy Policy

Project Cashflow, LLC

Effective date and last updated: October 12, 2026

This Policy explains how PCF handles information collected through its website and business analysis services, and how to contact us about privacy.

1 Scope and who we are

Project Cashflow, LLC (“PCF,” “we,” “us”) provides Project Cashflow Analyst, a remote business analysis and advisory service. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information through getprojectcashflow.com, inquiries, onboarding, payments, communications, and service delivery.

This Policy covers website visitors, prospective clients, client representatives, and individuals whose information is included in authorized client records. Business financial records may contain personal information about owners, employees, customers, or vendors. Our confidentiality and data-handling commitments for those records are also addressed in our Terms of Service and Client Service Agreement.

We operate from Florida. Applicable privacy rights depend on the information, our role, the individual’s location, and the law’s coverage. This Policy does not waive those rights or serve as blanket consent to otherwise unlawful processing.

2 Information we collect

Consultation information. Our website consultation form requires your full name, business name, work email, phone number, industry, approximate annual revenue (including the option to prefer not to say), and a description of your business challenge. The application adds a submission identifier and date and time. Valid submissions are stored in a server-side file on our Replit-hosted application, outside the publicly served website directory. If email notification is configured, the application attempts to send the submitted fields, identifier, and timestamp to PCF’s support email through the authenticated SMTP service configured by PCF; your validated email is set as the reply address. The saved record includes the email notification status. A failed email attempt does not delete the saved submission. Authorized PCF personnel may access the submission to respond to your inquiry. If you become a client, we may separately collect business, billing, and service contact information.

Service and accounting information. With the client’s authorization, we access QuickBooks Online company records and receive relevant financial statements, transactions, budgets, cash flow records, payroll summaries, contracts, operational records, and supporting documents. These may identify owners, employees, customers, or vendors. We request information reasonably necessary for the agreed analysis.

Communications and deliverables. We retain relevant emails, support requests, meeting scheduling details, written notes, reports, recommendations, and documents exchanged during the relationship. We do not record meetings without notifying participants and obtaining consent where required.

Billing and acceptance records. We receive payment status, subscription details, transaction identifiers, invoices, billing contact information, and records of agreement acceptance. Our payment processor may provide limited payment-method information, such as card brand and last four digits. Full card numbers and security codes are collected through the processor’s checkout rather than requested by PCF through email.

Technical information and spam prevention. The application temporarily processes IP addresses and submission timestamps in server memory to limit excessive consultation submissions. Its counting window is one hour, but this is not a guaranteed one-hour deletion deadline: inactive entries may remain until updated or the server restarts. IP addresses are not included in the saved consultation records. A hidden form field is checked to detect spam and is not saved in those records. Application code does not deliberately log consultation contents or ordinary visitors’ user-agent, referrer, or page-view history. Storage-error logs may contain technical details. Replit and its infrastructure providers may separately process request headers, IP addresses, browser or device information, access logs, security records, and traffic metrics under their hosting practices.

Please do not send passwords, full card details, Social Security numbers, health records, or other unnecessary sensitive information. Provide payroll and other records in summarized or redacted form where that meets the analysis need. Specially regulated information requires prior agreement and appropriate safeguards.

3 Where information comes from

We obtain information directly from you; from the business client and its authorized representatives; from QuickBooks Online through permissions granted by the client; from our payment processor; and from the website and communications systems used to deliver the service.

Clients are responsible for lawful authority to provide records containing other people’s information. We use client-supplied records for authorized service purposes, not to build unrelated personal profiles.

4 How we use information

We use information to respond to inquiries; assess service fit; onboard clients; access authorized records; conduct analysis; prepare daily reviews, weekly reports, and recommendations; schedule meetings; provide support; administer subscriptions and payments; maintain agreement and business records; detect misuse; protect systems; resolve disputes; and comply with applicable legal obligations.

Submitting the consultation form permits us to contact you about that inquiry; it does not enroll you in recurring marketing or authorize subscription charges. If we separately send marketing messages where permitted, you may unsubscribe through the message’s opt-out mechanism or by emailing support@getprojectcashflow.com. Necessary billing, security, and service messages may continue while relevant to your relationship.

We do not use client confidential information in public case studies, testimonials, marketing, or demonstrations without separate written permission. We do not use accounting access to initiate payments, alter books, or take other business actions without separate express authority and an agreed scope.

5 When we disclose information

Personnel and service providers. We disclose information only as reasonably necessary to authorized employees, contractors, and providers supporting payment processing, accounting access, hosting, email, document storage, security, and analysis. Examples in the service workflow include Square for payments, Intuit for QuickBooks Online, and Replit for website hosting. When notification email is configured, the SMTP email provider receives consultation form fields, the submission identifier and timestamp, and the visitor’s email address as reply-to information so it can send the inquiry to PCF. The information each provider receives depends on its function; website hosting alone does not mean all client accounting records are placed on the website.

We use appropriate contractual and confidentiality protections for providers handling client records and limit access to legitimate needs. Providers may also process information under their own policies when you use their independent products or checkout pages.

Professional advisers and legal purposes. We may disclose necessary information to legal, accounting, insurance, or other professional advisers subject to appropriate duties, and where required by law, valid legal process, or reasonably necessary to investigate unlawful activity or protect legal rights. Where lawful and practicable, we notify the affected client of compelled disclosure.

Business succession. Information may be transferred as part of a lawful merger, acquisition, or business transfer, subject to confidentiality protections, applicable notice requirements, and the successor assuming relevant obligations. A transaction does not authorize unrelated use contrary to this Policy.

We do not sell personal information or client confidential records. We do not disclose personal information for cross-context behavioral advertising or permit advertising use of confidential client records. Any future change to these practices requires updated disclosures and applicable choices or consent before the change occurs.

6 QuickBooks Square and other third party services

QuickBooks Online access may be granted through Intuit’s accountant invitation tools during onboarding. It does not require a custom connection through the PCF website. Clients can manage or revoke permissions in their accounting account. Revoking access may prevent PCF from completing the agreed service and does not itself cancel recurring billing; use the cancellation process in the service agreement.

Consultation email notifications, when enabled, are sent through PCF’s Titan Email service supplied through WordPress.com. Titan processes the message contents and related delivery information under its own service terms and retention practices. Notifications remain disabled until the sender mailbox and SMTP settings are configured.

Square processes payment details under its applicable privacy and payment terms. Removing an accounting permission or deleting a website account does not necessarily cancel a Square subscription. Contact support@getprojectcashflow.com or use the provided subscription cancellation control.

Third-party websites, payment pages, and products have their own privacy policies. PCF does not control their independent practices. Review the policies available through those services before supplying information.

7 Cookies and website technologies

The current application code does not set or read cookies, use local storage, session storage, IndexedDB, or service workers, or install analytics scripts, advertising pixels, or session-replay tools. Website scripts, styles, images, and fonts are local or system-provided. Normal browser caching may retain site assets. These statements describe application code, not a guarantee that the published hosting environment never uses cookies or collects traffic information.

Replit may independently collect hosting and security information. Its optional Project Analytics feature adds a tracker to published releases when enabled and may measure visits, pages, referring sites, approximate country, browser, device, and configured events. Application-code review alone does not establish whether that hosting feature is enabled. Any nonessential analytics enabled by PCF must be reflected in current disclosures, with legally required privacy controls and consent provided before applicable collection.

You can manage cookies and browser storage through browser settings. Independent provider features may be affected. We honor legally required opt-out preference signals, including Global Privacy Control where applicable. We do not place confidential client records, consultation descriptions, contact details, or other personal information in analytics event names or properties.

8 Analytics automation and artificial intelligence

PCF may use approved software, rules, automation, analytics, or AI tools to assist service delivery. Confidential client information will not be submitted to public AI tools or used to train general-purpose AI models without separate express written authorization.

Any approved processing tool handling confidential records must have appropriate confidentiality and security arrangements and controls against unauthorized training or disclosure. Human analysts review outputs before including them in client deliverables. PCF does not use automated processing to make legally binding decisions about individuals’ employment, credit, insurance, housing, or similar eligibility.

9 Retention and deletion

Consultation submissions currently have no automated expiration or deletion feature and no fixed retention period enforced by the application. They remain in the server-side file until manually deleted or the underlying storage is lost. Loss of storage is not a privacy deletion procedure. You may request deletion at support@getprojectcashflow.com; PCF handles requests manually, verifies identity as appropriate, and removes information when required by law or otherwise appropriate, subject to legitimate legal and recordkeeping exceptions. PCF retains inquiry information only as reasonably necessary to respond, manage the relationship, protect the service, comply with law, or resolve disputes. Hosting logs, backups, and checkpoints follow the provider’s own controls and may not be deleted at the same time as an application record.

Working records for paying clients are distinct from website consultation submissions. Consistent with our service agreement, we delete or return working client data within 90 days after service termination, except records reasonably required for legal, tax, dispute, or documented retention purposes. This is a service commitment that must be carried out through appropriate operational procedures; the consultation application does not automate it. Protected backup copies are removed through the ordinary backup cycle. Retained records remain protected and are not used for unrelated purposes.

On a client’s request within 30 days after termination, we supply available client-provided files and completed paid deliverables in commonly usable formats. Deleting information from PCF does not delete copies held independently by Intuit, Square, the client, or other parties.

10 Security and incident response

We use reasonable administrative, technical, and organizational safeguards appropriate to the information. Consultation files are stored outside the publicly served directory; the application requests restrictive filesystem permissions and excludes its data directory from ordinary source-control tracking. Those measures do not replace host-account access restrictions, protected storage, or secure handling by authorized personnel. The application has no public interface for viewing submissions or self-service deletion. No electronic system is completely secure; this limitation does not excuse safeguards or legal duties.

If a breach affects client information, we notify the client without unreasonable delay, provide reasonably available information and updates, and cooperate in response. We meet applicable legal notification deadlines, including Florida’s deadline for notice by third-party agents where applicable. Required notifications to individuals and regulators are handled by the legally responsible party unless validly delegated.

11 Requests and privacy choices

Contact support@getprojectcashflow.com to ask about access, correction, deletion, a copy of information, or applicable privacy choices. Depending on applicable law, you may also have rights to restrict certain uses, opt out of certain processing, use an authorized agent, or appeal a denial. We honor rights that apply to our processing and will not discriminate for exercising legally protected rights.

We verify identity or authority using information reasonably necessary for the request. Do not include sensitive credentials in your request. We respond within applicable legal deadlines. If we cannot fulfill a request, we explain the reason and any available appeal or complaint options where required.

When we hold information solely on behalf of a business client, we may direct a request to that client and assist it as required rather than independently changing its records. A privacy request does not automatically cancel a subscription or require deletion of records we must lawfully retain.

Where consent is the basis for an optional use, you may withdraw that consent for future processing. This does not invalidate prior lawful processing. You can opt out of marketing while continuing to receive the subscribed service.

12 Children and service location

PCF’s website and services are intended for adults acting for businesses. We do not knowingly collect personal information online from children under 13. If you believe a child has supplied information, contact us so we can investigate and take appropriate action. Our services are not directed to children.

PCF provides services from the United States. Service providers may process information in the United States or other locations where they operate, subject to applicable contractual and legal safeguards. If a relationship requires additional international transfer or data-processing terms, those must be addressed before the affected processing begins.

13 Policy changes and relationship to the service agreement

We post updates here with a revised last-updated date. For material changes affecting existing clients’ contractual data rights, we provide the notice required by the service agreement. We obtain additional consent before new processing where law or our contractual commitments require it. Changes do not retroactively authorize incompatible use of previously collected information.

This Policy describes information practices. It does not authorize subscription charges, change cancellation or refund terms, or reduce confidentiality and security duties in the service agreement. Applicable law and any controlling data-processing agreement remain effective.

14 Contact

Project Cashflow, LLC
Email: support@getprojectcashflow.com
Website: https://getprojectcashflow.com