RFPMill
RFPMill Privacy Policy
Published at: https://rfpmill.com/privacy
Last updated: 2026-08-22
Version: 1.0
Flow Solutions Group LLC ("we", "us") runs RFPMill. This explains what we collect, why, who we send
it to, and what you can tell us to do about it.
We do not sell personal information. We do not share it for advertising. We have never done
either and the business does not depend on it.
1. Who this covers
Customers. People who sign up and use RFPMill.
People named in uploaded documents. RFP packages contain names, work email addresses and
phone numbers of architects, owners' representatives and consultants. Those people did not sign
up with us. Section 6 is about them.
Visitors. People who load our website without an account.
2. What we collect
You give us:
| What | Why |
| Your name, work email, firm name | To create your account and sign you in |
| Your firm's business details: address, tax ID, certifications, insurance limits | To fill in the proposals the Service produces for you |
| Your hourly rates and pricing template | To price your bids |
| RFP packages you upload, including the emails and attachments in them | To read them and produce your proposal |
| Support emails | To answer you |
Payment card details go to Stripe, not to us. We never see or store a card number. We keep
the last four digits, the card brand, and your billing history so we can show you a receipt.
We collect automatically:
| What | Why | Kept for |
| Sign-in times and IP address | Security, so you can see if someone else got in | 12 months |
| Pages you loaded and errors you hit | To fix what is broken | 90 days |
| Token usage per document reading | To measure what the Service costs to run and to bill overage | Life of the account |
We do not use advertising cookies, analytics trackers, or third party pixels. The only cookie
we set keeps you signed in. There is no cookie banner because there is nothing to consent to.
3. Why we are allowed to use it
For customers, because we need it to give you the service you are paying for, and because we
have a legitimate interest in keeping the service secure and working.
For people named in uploaded documents, because our customer has a legitimate interest in
processing the bidding documents they hold and we act on their instructions. See section 6.
Where the law requires your consent, we ask for it and you may withdraw it.
4. Who we send it to
The current list, with what each one receives and where it operates, is at
https://rfpmill.com/subprocessors. In summary:
| Provider | What it receives | Where |
| Anthropic | The text and PDF attachments of packages you upload, so its model can read them | United States |
| Amazon Web Services | Everything, because it hosts the Service and stores the files | United States, us-east-2 |
| Stripe | Your name, email, billing address and payment details | United States |
| Amazon Simple Email Service | Your email address, to send your sign-in link | United States |
Anthropic does not train its models on data sent through the commercial interface we use.
We will give at least thirty days notice before adding a provider that receives your uploaded
documents.
We will also disclose information if the law compels us. If we get a valid legal demand for your
data we will tell you before we hand anything over, unless we are legally forbidden from telling
you.
If our business is sold, your data goes with it, and you will be told before that happens.
5. Where it is kept and how long
Everything is stored in the United States, in Amazon Web Services region us-east-2.
| Data | Kept |
| Your account and bid data | While your account is open |
| After you close your account | 30 days live, then deleted; gone from backups within a further 90 days |
| Uploaded documents | Same as your bid data, and you may delete any bid yourself at any time |
| Billing records | 7 years, because tax law requires it |
| Sign-in logs | 12 months |
Deleting a bid in the app deletes its documents, its fee build and its history immediately and
permanently. There is no recycle bin. That is deliberate.
6. About people named in documents you upload
If you are reading this because your name appeared in an RFP package one of our customers
uploaded, here is the position.
We hold that document because our customer, a firm bidding on the project, put it into a tool
that reads it and prices their work. We process it on their instructions. We do not use it for
anything else, we do not build a profile of you, and we do not contact you.
If you want it removed, email info@flowsolutionsgroup.com. We will pass your request to the customer who
uploaded it, because it is their record of their own bid, and we will tell you what happens. If
we are legally required to delete it regardless, we will.
7. Your rights
Wherever you live, you can ask us to:
- show you what we hold about you;
- correct anything wrong;
- delete it, subject to records we must keep by law;
- export it in a machine readable file;
- stop a particular use.
Email info@flowsolutionsgroup.com. We answer within thirty days and we do not charge for it. We may ask
you to confirm who you are first, because handing your data to the wrong person is worse than a
delay.
If you are in California, you have these rights under the CCPA as amended. We have not sold
or shared personal information for cross context behavioural advertising in the last twelve
months, and we will not treat you differently for exercising a right.
If you are in the EU or UK, you have these rights under the GDPR, you may object to
processing based on legitimate interests, and you may complain to your supervisory authority.
Our transfers to United States providers rely on the standard contractual clauses in our
agreements with them.
8. Security
Everything moves over encrypted connections. Data at rest is encrypted on the disk. Credentials
for our service providers are held in AWS Secrets Manager, never in our source code. Sign in is
by a link sent to your email, so there is no password of yours for us to lose. Access to
production is limited to people who need it.
No system is perfectly secure. If a breach affects your data we will tell you promptly, and in
any case within the time the law requires, and we will tell you what we know and what we are
doing.
9. Children
RFPMill is a business tool. It is not for anyone under eighteen and we do not knowingly collect
anything from children.
10. Changes
If we change this policy in a way that matters, we will email account holders at least thirty
days before it takes effect. Older versions stay at https://rfpmill.com/privacy with their dates.
11. Contact
Privacy questions and requests: info@flowsolutionsgroup.com
Everything else: info@flowsolutionsgroup.com
Flow Solutions Group LLC
Flow Solutions Group LLC, 7901 4th St N, Ste 300, St. Petersburg, FL 33702