Privacy Notice
Paveflow reads enterprise invoices against the contracts they were billed under. That means we handle two very different kinds of information: the ordinary details of people who contact us, and the commercial documents a customer shares with us during a proof of concept. This notice covers both, and tries to be specific rather than reassuring.
Who we are
Paveflow, Inc. is a contract to invoice compliance company with offices in San Francisco, California and Toronto, Ontario. This notice applies to paveflow.ai and to the proof of concept we run with prospective customers.
For anything in this notice, including a request about your own information, write to [email protected].
What we collect
When you contact us
Our demo request form asks for four things: your name, your work email, your company, and your role. That is the whole form. If you email or book a call with us instead, we hold whatever you choose to put in that message.
When you book a call
Booking runs on Calendly, embedded in our page. Calendly collects your name, email address and time zone in order to schedule the meeting and send the invitation. We do not ask the booking form for anything beyond that.
Proof of concept materials
This is the substantive one. During a proof of concept you give us, for a single spend category, roughly twelve months of invoices and the contracts behind them: master agreements, rate cards and amendments. These are commercial documents, but they can contain personal information incidentally, such as the names, email addresses and signatures of the people who raised, approved or signed them.
We ask for these under a mutual NDA signed first, and we use them for one purpose: producing your findings report. We do not sell them, and we do not share them with other customers.
Automatically, when you visit
Our host records standard server logs, including IP address, browser user agent and timestamps. We also run Microsoft Clarity for product analytics, which is described in its own section below because it does more than count page views.
Why we use it
- To reply to you, arrange a call, and run a proof of concept.
- To produce the findings report: the errors we found, the recoverable dollars by supplier, and the evidence for each one.
- To understand how our site is used, so we can make it clearer.
- To keep the site working and defend it against abuse and spam. Our form includes a hidden field that people never see and automated bots tend to fill in; a filled field is discarded silently.
- To meet our legal, accounting and record keeping obligations.
We do not sell personal information, and we do not use it for advertising or run advertising trackers on this site.
Analytics and session recording
We use Microsoft Clarity, which records how pages are used: click and scroll heatmaps, and session recordings of on page interactions such as movement, clicks and scrolling. Clarity masks text entered into form fields by default, so what you type into the demo form is not intended to appear in a recording.
Clarity sets cookies to do this. You can block them with your browser settings, and Microsoft offers its own opt out controls. Microsoft’s handling of this data is governed by the Microsoft Privacy Statement.
We do not currently show a cookie banner. If that changes, this notice will change with it.
Who else receives it
We keep the list of vendors short on purpose. Each one receives only what it needs to do its job.
| Service | What it does | What it sees |
|---|---|---|
| Vercel | Hosts the site | Server logs, IP address |
| Formspree | Delivers demo requests to our inbox | Name, work email, company, role |
| Calendly | Schedules calls | Name, email, time zone |
| Microsoft Clarity | Product analytics and session recording | On page interactions, device and cookie data |
We may also disclose information if the law requires it, or to protect our rights, and to professional advisers such as accountants and lawyers who are bound by confidentiality. If the business is ever sold or merged, information may transfer as part of that transaction.
Where it is processed
We work from the United States and Canada, and the vendors above are United States companies, so your information is processed in the United States. If you are outside the United States, that means your information is transferred there, where privacy laws differ from your own and where it may be subject to lawful access requests by United States authorities. We use vendors that commit contractually to protecting the data they process for us.
How long we keep it
We keep enquiry and booking details for as long as we are in contact with you and for a reasonable period afterwards for our records, then delete them.
Proof of concept materials are kept for as long as we need them to produce and explain your findings report, and are governed by the NDA and any specific handling terms we agree with you. If those terms say something different from this notice, those terms govern.
Security
We hold SOC 2 Type II, we sign a mutual NDA before receiving any customer files, and we restrict access to proof of concept materials to the people working on that engagement. Our proof of concept runs standalone: it needs a file export, not a login or an integration into your AP system, so we do not hold credentials or connect to your systems.
No system is perfectly secure, and we will not pretend otherwise. If you believe information has been exposed, email [email protected] and we will look into it.
Your choices and rights
Depending on where you live, you may have a legal right to some or all of the following. We would rather offer them to everyone than argue about which law applies, so you can ask us to:
- tell you what information about you we hold, and why;
- correct it if it is wrong;
- delete it, or stop using it;
- withdraw a consent you gave us, including for analytics cookies;
- stop sending you messages.
Email [email protected] and we will respond within the time our law allows. We may need to confirm who you are first. Where a request concerns documents a customer gave us, we will usually need to work through that customer, since the documents are theirs.
We will not treat you differently for making a request. If you are not satisfied with our answer, you can complain to the privacy regulator where you live: in California, the California Privacy Protection Agency or the Attorney General; in Canada, the Office of the Privacy Commissioner of Canada.
Children
This is a business to business service. It is not directed at children, and we do not knowingly collect information from them.
Changes to this notice
If we change how we handle information, we will update this page and the effective date above. This notice was last updated on 10 September 2026.