Dueflow Logo

dueflow

Privacy Policy

Last updated: July 7, 2026

1. Introduction

Welcome to Dueflow ("we," "our," or "us"). We are committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our dues collection and billing platform.

2. Information We Collect

We collect information that you provide directly to us, including:

  • Name, email address, and contact information
  • Organization and membership details
  • Payment information (processed securely through our payment partners)
  • Account credentials
  • Communications you send to us

We also automatically collect certain information when you use our Service:

  • Device and browser information
  • IP address and location data
  • Usage patterns and interaction data
  • Cookies and similar tracking technologies
  • Authentication events, admin actions, and payment activity, which we log for security, fraud detection, and audit purposes

3. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve our Service
  • Process transactions and send related information
  • Send administrative notifications and updates
  • Respond to your comments, questions, and requests
  • Monitor and analyze usage trends and preferences
  • Detect, investigate, and prevent fraudulent transactions, account takeovers, and other illegal or abusive activity
  • Personalize and improve your experience

4. Artificial Intelligence and Automated Processing

Dueflow uses artificial-intelligence features to help organizations run their finances. These include an in-app assistant/chat, automated draft-email and wrap-up summaries, roster and institution matching, and duplicate/conflict detection. To provide these features, relevant account and organizational data (which may include member names, payment status and amounts, and the content you submit to the assistant) is processed by us and by our AI subprocessor, Anthropic, through its commercial API.

Our AI subprocessor is contractually bound not to use data submitted through its commercial API to train its models. AI outputs can be imperfect; features that affect money movement, membership, or communications are designed to keep a human in control, and you should review AI-generated content before relying on or sending it. We do not use AI to make legal or similarly significant decisions about you without human involvement.

We disclose our use of AI so you can make an informed choice about the information you share with these features. If you would prefer not to use AI-powered features, contact us at support@dueflow.co.

5. SMS/Text Messaging

If you opt in to receive SMS/text messages from Dueflow, the following terms apply:

  • Opt-in is affirmative and occurs only when you (or a treasurer adding you) provide a mobile number and check the SMS consent box in the "Activate Dueflow Account" dialog, in your member profile at /member/settings, or during treasurer onboarding.
  • Message frequency varies based on your organization's billing schedule; most recipients receive fewer than 10 messages per month.
  • Message and data rates may apply depending on your mobile carrier plan.
  • You can opt out at any time by replying STOP to any Dueflow SMS message. Reply HELP for assistance.
  • Mobile information (including phone numbers and SMS opt-in status) is not shared, sold, or used for promotional or marketing purposes with third parties. Information shared with subprocessors solely to deliver SMS (e.g., our SMS gateway provider) is excluded from this restriction.
  • By opting in, you consent to receive automated transactional text messages related to your account, payment reminders, payment receipts, and organizational communications.

See our SMS Messaging Policy for full details on opt-in paths, frequency, HELP/STOP instructions, supported carriers, and privacy.

6. Information Sharing

We may share your information in the following circumstances:

  • With payment processors (Stripe, Whop) to facilitate transactions
  • With your organization's administrators for dues management
  • With service providers who assist in operating our platform
  • With AI providers (Anthropic) that process data to power our AI features, under contractual confidentiality and no-training terms
  • With tax authorities, card networks, banks, regulators, or law-enforcement authorities when required to investigate suspected fraud, chargebacks, sanctions violations, or other illegal activity, or to respond to lawful requests
  • To comply with legal obligations or protect our rights
  • In connection with a merger, acquisition, or sale of assets

We do not sell your personal information to third parties for marketing purposes.

7. Cookies, Analytics, and Tracking Technologies

We and our service providers use cookies, pixels, session-replay tools, and similar technologies to operate the Service, remember your preferences, measure performance, and understand how the Service is used. The third-party analytics and advertising tools we currently use include:

  • PostHog — product analytics and error tracking. On our production site this includes session replay (recording of on-screen activity), with payment amounts, donor/member names, and all form inputs masked.
  • Google Ads / Google tag (gtag.js) — conversion measurement for our advertising, loaded on public marketing pages.
  • Vercel Analytics — privacy-friendly, aggregate traffic measurement.
  • Sentry — application error and performance monitoring, which may capture limited diagnostic data about your session when an error occurs.

Most browsers let you refuse or delete cookies. Where required by law, we present a consent choice for non-essential analytics and advertising cookies. We also honor Global Privacy Control (GPC) browser signals as a valid request to opt out of the “sale” or “sharing” of personal information as described below.

8. Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including:

  • Encryption of data in transit and at rest
  • Regular security assessments and audits
  • Access controls and authentication measures
  • Secure payment processing through PCI-compliant partners
  • Logging of authentication events, administrative actions, and payment events to detect and investigate fraud or abuse

While we strive to protect your information, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. We may also retain information as required by law, to resolve disputes, to enforce our agreements, and to maintain audit trails for fraud detection. Financial transaction records are retained in accordance with applicable financial regulations.

10. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

  • Access and review your personal data
  • Request correction of inaccurate data
  • Request deletion of your data
  • Object to or restrict processing of your data
  • Data portability
  • Withdraw consent at any time

To exercise these rights, please contact us at support@dueflow.co.

11. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you additional rights. In the past 12 months we have collected the following categories of personal information: identifiers (name, email, phone, IP address); customer records (contact and organization details); commercial information (payment and transaction history); internet or network activity (usage and device data); geolocation (approximate, from IP); and inferences drawn from the above. We collect this information for the business purposes described in this Policy.

We do not sell your personal information for money. However, our use of advertising and analytics tools such as Google Ads may be considered “selling” or “sharing” of personal information for cross-context behavioral advertising under California law. You have the right to opt out.

As a California resident, you have the right to: know and access the personal information we hold about you; request deletion; request correction; and opt out of the “sale” or “sharing” of your personal information. You will not be discriminated against for exercising these rights. You may exercise them by emailing support@dueflow.co, or by enabling a Global Privacy Control (GPC) signal in your browser, which we treat as a valid opt-out of sale/sharing. You may use an authorized agent to submit a request on your behalf.

12. Children's Privacy

Our Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us so we can delete such information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.

14. Contact Us

If you have any questions about this Privacy Policy, please contact us at support@dueflow.co.