Privacy Policy

Miso Flow is an investigation case-management platform used by investigation firms, insurers, and law firms to manage cases, evidence, and reports. This notice explains what personal data the platform processes and who it is shared with. Each customer organization (the “workspace”) is the data controller for the case data it uploads; Miso Flow acts as a processor on its behalf.

We process two broad categories of personal data:

Account data (about platform users)

• Name and email address
• Hashed password and two-factor authentication settings
• Role, organization membership, and activity/audit logs
• Billing contact and subscription details (via Stripe)

Case data (about the people a case concerns)

Workspaces upload investigation material that can include sensitive personal data about claimants, insured parties, and other individuals, such as: names, national ID numbers, dates of birth, addresses, phone numbers, occupation, incident details, locations (including GPS coordinates), uploaded evidence files (documents, images, audio), and — depending on the case — health, medical, injury, and disability information.

Sensitive categories of data are only present because a workspace chooses to upload them for the purpose of conducting its investigation.

• To provide the service: storing cases, evidence, tasks, and reports.
• To authenticate users and enforce access controls.
• To generate documents and assist users via optional AI features (see §4).
• To send transactional email (e.g., invitations, scheduled reports).
• To process subscription billing.
• To maintain security, audit logs, and prevent abuse.

Miso Flow offers optional AI features (case intake extraction, report generation, a chat assistant, answers, triage, and report synthesis). When a workspace enables AI and a user invokes one of these features, the relevant case content — which may include the personal data described in §2, and the text and files attached to a case — is sent to the AI provider configured by that workspace for processing. Supported providers are:

• Anthropic (Claude)
• OpenAI
• Google (Gemini)

The provider and API key are configured per workspace by a workspace administrator. AI features are off unless enabled, and individual AI capabilities can be disabled in the workspace AI policy.

Workspaces can enable a PII-redaction control that masks certain identifiers (such as email addresses, phone numbers, ID-like numbers, and configured financial fields) in the text sent to AI assistant and report-generation features. Important limitations, stated honestly: redaction is a best-effort text filter; it does not remove personal data embedded inside uploaded images or PDF files, and it is not applied to document-extraction (intake), whose purpose is to read identifiers from the uploaded documents. Workspaces that require stricter handling should avoid uploading files they do not want sent to the configured provider.

Personal data may be transferred to and processed by these providers outside your country, including in the United States.

We rely on the following service providers to operate Miso Flow:

• Supabase / PostgreSQL — primary database and file storage.
• S3-compatible object storage — evidence and attachment files.
• Anthropic, OpenAI, Google — AI processing (only when AI is enabled).
• Resend — transactional email delivery.
• Stripe — subscription billing and payment processing.
• Google Maps — address autocomplete and geocoding.
• OpenStreetMap (Nominatim) and Komoot (Photon) — fallback address autocomplete and geocoding.
• Slack, Google Calendar, Google Drive — only when a workspace connects that integration (see §5a).
• Dropbox, Microsoft (Teams, Outlook), GitHub, Atlassian (Jira), Linear, Zoom, Figma — can be connected, but no event delivery to them is implemented, so no case data is sent (see §5a).
• Unsplash — decorative template images loaded by your browser on the new-project screen. It receives your IP address and browser details, as any image host does; no case or account data is sent.
• Hosting/CDN provider — application hosting and content delivery.

Workspaces may also share a read-only project summary with external guests via a time-limited, revocable link. The guest’s email address is processed to scope and audit that access; the shared view excludes claimant/insured identity details, financials, evidence files, and intake data. Note that the invitation email’s subject line includes the project name, which may identify the case or the people it concerns, and is delivered to the guest’s email provider.

Separately, a member with permission to a file may create a share link to that single file, including an evidence file. Anyone holding the link can download that one file without signing in, so it should be treated like the document itself. Links expire — 7 days by default, 30 days at most — can be revoked at any time, and every link issued is recorded in the workspace audit log with who issued it and when.

A finished report may likewise be delivered to a named recipient as a link they can open without an account. The report content they see may include case details. These links last up to 90 days, can be shortened when created, and can be revoked at any time; each delivery is recorded against the report.

A workspace administrator may connect third-party tools (e.g. Slack, Google Calendar, Google Drive, Dropbox, Microsoft Teams, Outlook, GitHub, Jira, Linear, Zoom, Figma). Integrations are off by default and are enabled per workspace. When connected and configured to deliver on chosen events, Miso Flow sends data to that provider:

• Slack — a short message containing the case/work-item serial and status only (no claimant or insured identity).
• Google Calendar — an all-day event titled with the case serial and its due date (no claimant identity).
• Google Drive — when file mirroring is enabled, the uploaded file itself (which may contain personal data) is copied to the connected account, keeping its original file name, which may itself identify the case, claimant, or insured party.
• Dropbox, Microsoft Teams, Outlook, GitHub, Jira, Linear, Zoom and Figma — can be connected, but no event delivery to them is implemented, so no case data is sent. Connecting one exchanges an OAuth authorization with that provider and stores an encrypted access token, so the provider learns that your account authorized Miso Flow.
• Outbound webhooks — if a workspace administrator registers a webhook URL, event notifications are POSTed to it. Payloads are minimized and personal-data fields (names, descriptions, file names, emails) are stripped before sending; the destination URL is operator-chosen.

OAuth access tokens for connected accounts are encrypted at rest. A workspace can disconnect an integration at any time, which stops further delivery.

Miso Flow stores data on your own device. All of it is functional: none is used for advertising, cross-site tracking, or profiling, and no third-party analytics or advertising cookies are set.

• Session cookies — set when you sign in, to keep you signed in. Removed when you sign out.
• Language cookie — remembers the interface language you chose.
• Trusted-device cookie — set only if you choose to trust this device after two-factor sign-in, so you are not asked for a code again on it for 30 days. It holds a signed token, not your code.
• Guest-link cookie — set if you open a shared link as a guest, so the shared item stays open as you read it. It lasts up to 14 days, matching the link, and gives access to nothing else.
• Last-used email — your email address, kept for 24 hours so the sign-in screen can be pre-filled after your session expires. Removed when you sign out.
• Local storage — your workspace selection, view and filter preferences, accessibility and theme settings, and short-lived caches of lists you have already been shown.
• Unsaved drafts — if you are part-way through creating a case or inviting colleagues, that draft is held on your device so it is not lost. It may contain the details you have typed so far.

Everything tied to your account or workspace — including drafts and cached lists — is erased from the browser when you sign out, and also when a different account signs in on the same browser. Only device preferences that contain no personal or case data, such as theme and accessibility settings, are kept. You can clear the rest at any time through your browser settings.

• Data is transmitted over encrypted connections (TLS).
• Stored third-party API keys are encrypted at rest (AES-256-GCM).
• Access is governed by role-based permissions and per-organization isolation.
• Optional two-factor authentication and session controls are available.
• Activity is recorded in an audit log.

No method of transmission or storage is perfectly secure; we cannot guarantee absolute security.

Account and case data is retained for as long as the workspace maintains an active account, and afterwards as needed to meet legal, accounting, or security obligations. Workspaces can delete or archive cases and evidence; deleted records are removed from active systems, though residual copies may persist in backups for a limited period. To request deletion of an account or specific data, contact the workspace administrator or use the contact below.

Some data is deleted automatically on a schedule a workspace owner controls in Settings. By default, backup records are kept 30 days, audit-log entries 365 days, and the identifiers an AI extractor read out of an intake document 365 days after that extraction has been accepted or rejected — extractions still awaiting review are never deleted automatically. File attachments are not deleted on a schedule, because age alone does not indicate a case is closed.

Depending on your jurisdiction, you may have rights to access, correct, export, or delete personal data, and to object to or restrict certain processing. Because workspaces control the case data they upload, requests about case data should be directed to the relevant workspace (the controller); we will assist controllers in responding.

We may update this notice as the product evolves. Material changes will be reflected by updating the date above.

Questions about privacy or this notice can be directed to your workspace administrator, or to the Miso Flow operator at the support contact provided in your agreement.