Legal

Privacy Policy

Last updated: September 30, 2026

This Privacy Policy explains how Dataflo LLC ("Dataflo," "we," "us," or "our"), the operator of Govflo, collects, uses, discloses, and protects information when you use the Services. It also describes your privacy rights and how to exercise them. Please read it together with any privacy notice provided by the Agency you are dealing with.

1. Govflo and the Agencies It Serves

Govflo is a public records platform used by government agencies. It serves two groups of people: agency staff, who use Govflo to receive, search, review, and respond to public records requests, and members of the public, who submit requests to an agency through that agency's request portal.

When an Agency uses Govflo, the Agency decides what information is collected through its Portal, how its requests are handled, and what is released. We process that information on the Agency's behalf, in accordance with its instructions and our agreement with it. The Agency, not Dataflo, decides whether records are released, withheld, or redacted.

If you submit a public records request, please be aware that your request, your name, and your correspondence with the Agency may themselves be public records that the Agency is required by law to disclose. Questions about how an Agency handles your request, or about that Agency's own privacy practices, should be directed to that Agency. If we receive a request concerning information we hold on an Agency's behalf, we will refer it to that Agency.

2. Definitions

The following terms have the meanings set out below, whether they appear in the singular or the plural.

"Account" means a unique account created for you to access the Services or any part of them.
"Agency" means a government agency or other organization that uses Govflo under an agreement with Dataflo.
"Agency Records" means the documents, emails, audio, video, images, and other records that an Agency uploads to Govflo, or makes available from its connected systems, in order to search, review, redact, and produce them in response to requests.
"Personal Data" means any information that relates to an identified or identifiable individual.
"Portal" means a public records request portal that an Agency operates through Govflo.
"Requester" means an individual or organization that submits a request to an Agency through a Portal, by email, or through any other channel that the Agency records in Govflo.
"Service Provider" means a third-party company or individual that processes Personal Data on our behalf, including to provide or support the Services or to help us analyze how the Services are used.
"Services" means the Website, the Govflo staff console, and each Portal.
"Usage Data" means data collected automatically through use of the Services or from the Services' infrastructure, such as the duration of a page visit.
"Website" means the Govflo website, available at https://govflo.ai.
"You" and "your" refer to the individual accessing or using the Services, or to the company, agency, or other legal entity on whose behalf that individual is accessing or using the Services, as applicable.

3. Information We Collect

3.1 How We Collect Information

We collect information:

directly from you, when you submit a request through a Portal, create an Account, request a demonstration, contact support, or otherwise communicate with us;
from an Agency, when it records a request it received by phone, by mail, or in person, or when it uploads or connects Agency Records;
automatically, through cookies, web beacons, and similar technologies; and
from third-party services, such as the single sign-on provider an Agency uses for its staff, or analytics providers.

3.2 Personal Data

Depending on how you use the Services, the Personal Data we collect may include:

your first and last name;
your email address;
your mailing address;
your phone number;
the content of your request, any files you attach, and your correspondence with the Agency;
for Agency staff, your work email address, job title, role, and department; and
Usage Data.

Where an Agency's governing law permits anonymous requests, you may need to provide only a way for the Agency to contact you.

3.3 Usage Data

Usage Data is collected automatically when you use the Services. It may include your device's Internet Protocol (IP) address, browser type and version, the pages of the Services that you visit, the date and time of your visit, the time spent on those pages, unique device identifiers, and other diagnostic data. When you access the Services through a mobile device, we may also collect the type of device you use, its unique device identifier and IP address, its operating system, the type of mobile browser you use, and other information that your browser sends when you visit the Services.

On a Portal, we may use your approximate location, derived from your IP address, to suggest the jurisdiction to which your request belongs. We may also use security tools that evaluate signals such as IP address and interaction patterns to protect the Portal from automated abuse. These signals are used to route submissions for human review, never to decide your request.

4. Agency Records

Agency Records often contain Personal Data about people who are neither Requesters nor users of Govflo, such as the names, addresses, and phone numbers that appear in emails, reports, and recordings. We process Agency Records solely to provide the Services to the Agency that holds them, in accordance with its instructions and our agreement with it. We do not use Agency Records or request content for marketing, and we never sell them.

Where an Agency chooses to connect a source system, such as an email or document management system, Govflo accesses only the sources and scopes that the Agency authorizes. Connecting a source system does not give Dataflo access to any other part of the Agency's infrastructure, databases, files, or networks.

We also collect product usage analytics, such as the features that staff use, the pages they visit, and general patterns of interaction within the Services, solely to improve the user experience and the quality of the Services. This analytics data is limited to activity within Govflo, does not include the content of Agency Records or requests, and is handled in accordance with this Privacy Policy.

5. Artificial Intelligence

Govflo uses artificial intelligence to assist Agency staff. These features include detecting names, addresses, Social Security numbers, and other Personal Data in records; suggesting redactions together with the exemption that supports each one; classifying requests; searching records by meaning; and transcribing audio and video.

These features assist staff; they do not make decisions. No record is redacted, withheld, or released through Govflo without review and approval by a person at the Agency.

We do not use Agency Records, request content, or other Personal Data to train artificial intelligence models, and our artificial intelligence service providers are contractually prohibited from doing so. These features run on services hosted in the United States, as described in Section 12.

6. Cookies and Tracking Technologies

We use cookies and similar tracking technologies, such as beacons, tags, and scripts, to track activity on the Services, store certain information, and improve and analyze the Services. We do not use cookies for advertising.

Cookies. A cookie is a small file placed on your device. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. If you do not accept cookies, some parts of the Services may not function. Unless you have set your browser to refuse cookies, the Services may use them.
Web beacons. Certain pages of the Services and our emails may contain small electronic files known as web beacons (also called clear GIFs, pixel tags, or single-pixel GIFs). Web beacons allow us, for example, to count the users who have visited those pages or opened an email, and to compile related statistics, such as the popularity of a section or the integrity of our systems and servers.

Cookies may be "persistent" or "session" cookies. Persistent cookies remain on your device when you go offline, while session cookies are deleted when you close your web browser. We use the following cookies, all of which are administered by Dataflo:

Cookie typeDurationPurposeNecessarySessionAuthenticate users, prevent fraudulent use of accounts, and enable the core features of the Services. Without these cookies, the services you request cannot be provided.Cookie consentPersistentRecord whether you have accepted the use of cookies on the Website.FunctionalityPersistentRemember choices you make, such as your login details or language preference, so that you do not have to re-enter them each time you use the Services.

7. How We Use Personal Data

We may use Personal Data to:

provide and maintain the Services, including monitoring their use;
deliver your request to the Agency and send you acknowledgments, status updates, and responses on the Agency's behalf;
manage your Account and your registration as a user of the Services;
perform our contracts with Agencies, including the contract under which an Agency purchased the Services;
comply with legal and regulatory requirements;
contact you by email, telephone, SMS, or other electronic communication about updates or information related to the Services, including security updates, where necessary or reasonable;
send Agency contacts and Website visitors news and general information about Govflo and related events, unless they have opted out of receiving it (we do not send marketing communications to Requesters based on their requests);
respond to and manage your requests to us;
detect, prevent, and respond to fraud, abuse, and security incidents; and
evaluate or carry out a merger, acquisition, or other transfer of our business, subject to Section 8.

8. How We Share Personal Data

We do not sell Personal Data. We may share Personal Data only in the following circumstances:

With the Agency. Information you submit through a Portal, and information about your request, is shared with the Agency to which you submitted it.
With Service Providers. We may share Personal Data with Service Providers that host and operate the Services, monitor and analyze their use, or contact you on our behalf. Service Providers are bound by written agreements to use Personal Data only to provide services to us, and they store and process it only in the United States.
With affiliates and in business transfers. We may share Personal Data with our affiliates, or with a successor in a merger, acquisition, or sale of assets, only if they are bound by this Privacy Policy. Agency Records and Request Data remain subject to our agreement with each Agency and are never sold.
Through public request logs. Some Agencies publish a log of the requests they receive or the records they release. The content of any such log is determined by the Agency under its governing law.
With your consent. We may disclose Personal Data for any other purpose with your consent.

9. Legal Disclosures

Business transactions. If Dataflo is involved in a merger, acquisition, or asset sale, Personal Data may be transferred. We will provide notice before Personal Data is transferred and becomes subject to a different privacy policy.

Law enforcement. We may be required to disclose Personal Data by law or in response to valid requests from public authorities, such as a court or a government agency. Where such a request concerns information we hold on an Agency's behalf, we will notify the Agency unless the law prohibits us from doing so, and will direct the requesting authority to the Agency where appropriate.

Other legal requirements. We may disclose Personal Data in the good-faith belief that doing so is necessary to:

comply with a legal obligation;
protect and defend the rights or property of Dataflo;
prevent or investigate possible wrongdoing in connection with the Services;
protect the personal safety of users of the Services or the public; or
protect against legal liability.

10. Payments

Some Agencies charge fees for copies of records. Where an Agency collects a fee through Govflo, the payment is processed by a third-party payment provider. Govflo does not collect or store your card or bank account details.

11. Data Retention

We retain Personal Data only for as long as necessary for the purposes described in this Privacy Policy, including to comply with our legal obligations, resolve disputes, and enforce our agreements and policies.

Request data and Agency Records are retained in accordance with the Agency's instructions, its records retention schedules, and our agreement with it. Many Agencies are required by law to retain request files for a specified period. When an Agency's agreement with us ends, we make its data available for export and then delete it, as set out in that agreement.

We retain Usage Data for internal analysis. Usage Data is generally retained for a shorter period, except where it is used to strengthen security or improve the functionality of the Services, or where we are legally required to retain it for longer.

12. Data Location and Access

All Personal Data, Agency Records, and request data are hosted and processed exclusively in the United States on Amazon Web Services, and are never stored, replicated, or backed up outside the United States.

Access by Dataflo personnel is role-based, limited to what a task requires, protected by multi-factor authentication, and recorded in audit logs. Some engineering and support personnel work outside the United States; they access data only within our US-hosted environment and cannot download or store it elsewhere. If an Agency requires that its data be accessed only by personnel located in the United States, we will restrict access accordingly on its written request.

13. Your Rights and Choices

13.1 Access, Correction, and Deletion

You may update, correct, or delete certain information by signing in to your Account, if you have one, and visiting your account settings. You may also contact us to request access to, correction of, or deletion of Personal Data that you have provided to us.

If your information is part of a request file or Agency Records, the Agency controls it and may be required by records retention or public records law to keep it. In that case, we will forward your request to the Agency and assist it in responding. We may also retain certain information where we have a legal obligation or lawful basis to do so.

13.2 Rights Under the GDPR

If the General Data Protection Regulation (GDPR) applies to you, you have the right to:

access your Personal Data;
rectify inaccurate Personal Data;
request erasure of your Personal Data;
object to or restrict processing;
receive your Personal Data in a portable format;
withdraw your consent at any time; and
lodge a complaint with a supervisory authority.

We process Personal Data on the basis of your consent, the performance of a contract, compliance with a legal obligation, or our legitimate interests.

13.3 Rights of California Residents

Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), California residents may:

request access to the Personal Data we collect about them;
request deletion of their Personal Data;
request correction of inaccurate Personal Data;
opt out of the sale or sharing of Personal Data; and
limit the use of sensitive Personal Data.

We do not sell or share personal information, as those terms are defined under the CPRA.

13.4 How to Exercise Your Rights

To exercise any of these rights, contact us at support@govflo.ai. If your information is in Govflo because of a request you made to an Agency, or because it appears in Agency Records, we will work with that Agency to respond.

14. Automated Decision-Making

Govflo does not use your data to make automated decisions that produce legal or similarly significant effects. Decisions about your request, including whether records are released, withheld, or redacted, are made by people at the Agency.

15. Data Security

We protect Personal Data with administrative, technical, and physical safeguards, including encryption in transit and at rest, single sign-on and multi-factor authentication, role-based permissions, and audit logs of staff activity. Dataflo has completed a SOC 2 Type 1 examination, and its SOC 2 Type 2 examination is in progress. Our applications undergo independent penetration testing.

If we become aware of a security incident affecting an Agency's data, we will notify that Agency without undue delay and in any event within 72 hours, and will support it in any notifications it is required to make.

No method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

16. Children's Privacy

The Services are not directed to anyone under the age of 13, and we do not knowingly collect Personal Data from anyone under the age of 13. If you are a parent or guardian and believe that your child has provided us with Personal Data, please contact us. If we learn that we have collected Personal Data from a child under 13 without verified parental consent, we will take steps to remove that information from our servers, subject to any obligation an Agency has to retain it. Where we rely on consent as the legal basis for processing and your country requires consent from a parent, we may require that consent before we collect and use the information.

Agency Records may contain information about minors. That information is handled in accordance with the Agency's instructions and the law that applies to it.

17. Links to Other Websites

The Services may contain links to websites that we do not operate. If you click a third-party link, you will be directed to that third party's site. We encourage you to review the privacy policy of every site you visit. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites or services.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will post the revised policy on this page and update the "Last updated" date above. Before a material change takes effect, we will also notify you by email or by a prominent notice on the Services. We encourage you to review this Privacy Policy periodically. Changes are effective when they are posted on this page, unless the notice states a later date.

19. Contact Us

If you have any questions about this Privacy Policy, please contact us:

Email: support@govflo.ai
Support: govflo.ai/support
Mail: Dataflo LLC, 100 Sun Avenue NE, Suite 650, Albuquerque, New Mexico 87109, USA

‍