Privacy Policy

Consultant Finder is run by Kingston Madlansacay (operating as FlowKM), based in Alberta, Canada. For privacy purposes, the operator is the data controller, and our Privacy Officer is accountable for how we handle personal information. You can reach us at any time at info@flowkm.com.

• Operator: Kingston Madlansacay (operating as FlowKM)
• Location: Edmonton, Alberta, Canada. We give a postal address on request by email.
• Privacy Officer: Kingston Madlansacay
• Email: info@flowkm.com

Our users come from several countries, so this policy is written to cover Canadian privacy law (PIPEDA, and Alberta's Personal Information Protection Act) as well as the rights people have under the GDPR in the UK and EU and under California privacy law.

We only collect what the product needs to function, and nothing is collected for advertising.

The one place the service builds up a picture of your preferences is the optional AI job agent on the paid plan. It writes short notes about the kind of work you seem to want and uses them when it scores jobs for you. It bases those notes on the decisions recorded about jobs: the thumbs-up or thumbs-down you give a match on your AI agent page, and others you tell the agent about in chat, such as applying, getting an interview, or winning the work. The agent writes notes only while you are on the paid plan. The notes are not hidden: they are shown to you on your AI agent page, under “What my agent learned”, and you can also ask us for a copy at any time at info@flowkm.com. See your AI job agent for the details.

Account information

• Signing up with an email and password: your name, email address, and password. Your password is stored only as a bcrypt hash. We never store, see, or have any way to recover the password itself.
• Signing up with Google: we receive your email address, your name, and the URL of your Google profile picture. That is all we request and all we store. We do not get access to your Gmail, Drive, contacts, or calendar, and nothing in this service ever sends email from your account.
• Account type:after signing up you choose whether you are a consultant or a firm owner. Firm owners also give us a company name, and can add the company's website and size in Settings.

Consultant profile

• Everything you type into your profile: headline, bio, city or location, country, work-type preference (remote, hybrid, onsite), years of experience, the ERP systems you work with, whether you are a functional or technical consultant, your hourly rate range, your availability, and your skills with years of experience for each.
• Whether you have turned on “open to work”, which is the only thing that puts your profile in our consultant directory. It is off by default, and only you can turn it on.

Your resume

• If you upload a resume (PDF, DOCX, or TXT, up to 10 MB), we store the file encrypted, along with its filename.
• We read the text of the resume to pre-fill your profile fields (name, headline, location, bio, years of experience, and skills) so you do not have to type them twice. We store that extracted summary alongside your profile. The file, and the summary we read from it, are stored as soon as you upload. Your profile fields change only when you press Save, and you can edit or clear anything we filled in.
• How the parsing is done:processing may happen on our own systems, or through AI service providers acting on our behalf and under contract to us. In either case it is used only to fill in your profile. It is never used to train anyone else's models, and never shared for any other purpose.
• Uploading a resume never turns on “open to work”, and never makes your resume file visible to anyone else. See who can see your information.
• Your resume file, and anything we read from it that you did not save into your profile, is never sent to the AI job agent described below.

Using the service

• Applications: when you apply to a role posted directly on the platform, we record the application, its status (received, viewed, shortlisted, rejected), and timestamps, so both sides can track it.
• Job postings created by firm accounts, including the role details, rate range, and description they enter. Hiring posts, a lighter way to publish hiring criteria, are switched off. The site no longer offers a way to create one, and any that exist are kept but are not shown to anyone.
• Roster invitations: if a firm invites your email address to the group of consultants it manages, we store that address and email it to tell you about the invitation, naming the firm. We also store your accept or decline decision. Before you accept, the firm sees only the address it typed and, if you decline, that you declined. A firm can invite an address again after a decline, and that sends a new email.
• Security information: if you turn on two-factor authentication, we store a hashed copy of each one-time code for email two-factor, an encrypted copy of your authenticator secret, and hashed single-use backup codes.
• Chats with the AI job agent: if your account is linked to the AI job agent, we store your conversations with it. See your AI job agent.

Technical information

• Our hosting and database providers generate ordinary server logs as part of delivering the site, such as IP address, browser user-agent, requested page, and timestamp. We use these for security and debugging, not to build a profile of you.
• When you sign up or ask for a password-reset link, our own database also records your IP address for a short time, to limit repeated attempts. These records are cleared automatically and are used for nothing else.

This is the part most people care about, so we are being specific rather than general.

• Nothing about you is visible to the public internet. Every page that shows information about users requires you to be signed in. The only public pages are the landing page, the About page, these legal pages, and the pages for signing up, signing in, resetting a password and confirming an email address. Consultant profiles are not reachable by logged-out visitors and are not indexed by search engines.
• Your profile is private until you opt in.A consultant profile appears in the Find Consultants directory only if you switch on “open to work”. We never scrape, buy, or infer consultant profiles. Every profile in the directory belongs to someone who created it and chose to be listed.
• Once you opt in, your profile is visible to registered firm owners. The consultant directory is shown only to accounts registered as hiring (firm owner or firm team member) whose email address is confirmed. Anyone can register as a firm owner. We check a firm by hand before its job postings are shown, but not before it can see the directory. Other consultants cannot see it, and signed-out visitors cannot reach it at all. What is shown is: your name, headline, bio, location and country, work type, years of experience, ERP systems, consultant type, hourly rate range, availability, and skills. Your email address is not shown in the directory.If you would rather not be listed, leave “open to work” off. You can switch it off again at any time, which removes you from the directory.
• Your resume file is never shared.There is no way for another user (firm or consultant) to download a resume you uploaded. A firm whose roster invitation you have accepted can see your name, your email address, the profile fields you saved, your resume's filename, and the jobs our site matches to your profile. If you signed up with Google, it can also get the link to your Google profile picture. It cannot see or download the resume file itself.
• Applying shares your name and email address with that company. When you apply to a role posted directly on the platform, the company that posted it sees your name, your email address and the status of your application on its dashboard. That is the purpose of applying. Applying does not show it the rest of your profile or your resume file.
• Roster access is consent-gated. A firm can add you to the consultants it manages only by inviting your email address, and only if you accept. Until you accept, the firm sees only the address it typed and, if you decline, that you declined. You can decline, and a membership can be ended by either side afterwards.
• The AI job agent, if your account is linked to it.The agent's systems and the companies that run them also handle some of your information. Exactly what, and why, is set out in your AI job agent. The agent's notes and scores about you are used only to choose and rank jobs for you and to answer you in chat. They are never shown to firms or other users, and neither are your chats with the agent: in the app, only you can see them.
• The site operator can see your data.As the person running the service, the operator has administrative access to the database, and to the AI job agent's database, and uses it for support, troubleshooting, handling abuse, and manually introducing consultants to companies. To introduce a consultant by hand, the operator can create an account record with the consultant's name, email address and skills, and record the introduction as an application. The company then sees the consultant's name and email address, as if they had applied.
• We do not sell your personal information, and we do not share it with advertisers, data brokers, or recruiters who are not users of the platform.

The paid plan adds an AI job agent. Paid plans are sold on the Pricing page; until they are on sale there, the operator can put an account on a paid plan by hand, at no charge. The agent scores jobs against your profile, explains each score, emails you about your best matches, and chats with you. It is part of Consultant Finder and run by the same operator, but on separate systems from the website, described below. If your account is not linked to the agent, nothing in this section applies to you.

Whose information goes to it

• Your account is linked to the agent from the moment the agent's record of you is created. That happens only when your email address is confirmed and you are on the paid plan (normally the first time you open your AI agent page while both are true), or when the operator links your account by hand, which the operator does only with your agreement. An account whose email address is not confirmed is never linked.
• Once linked, your account stays linked until your account is deleted, or until we delete the agent's copy of your information at your request, including if you later move off the paid plan. While it is linked, the website keeps sending your profile changes to the agent.
• If your account is not linked, nothing about you is sent to the agent. A free account is not linked unless it was on the paid plan before or the operator linked it by hand.
• For an account the operator linked by hand, “the paid plan” in this section means the plan the operator has set for that account's agent. If the operator set up your agent record directly, before linking it to your website account, it may also hold information the operator entered for you, with your agreement.

Your AI agent page

• Your matches: the jobs the agent has scored for you, each with its score, the reasons behind it and anything to check, and thumbs-up and thumbs-down buttons that record your decision about the job.
• Chat: a text chat with your agent, described below.
• What my agent learned:the agent's notes about your preferences, and the profile summary it currently scores jobs against.
• Email settings:the hour of the summary email, the score that triggers an instant alert on plans that include them, your time zone, and a switch to pause the agent's emails.
• Only you can see your AI agent page. Apart from your chat history, described below, the website keeps no copy of what the page shows: it fetches it from the agent each time you open the page.

What the website sends to it

• Your login email address and display name, whether your email address is confirmed, and your plan (free or paid).
• A profile summaryin plain English, which our server writes from your saved profile: headline, bio, ERP systems, consultant type (functional or technical), years of experience, hourly rate range, location, work-type preference (remote, hybrid, onsite), country, availability, and your skills with years of experience for each. The summary also states the rate's currency, which is US dollars unless our records say otherwise, and a seniority level if our records hold one for you; the profile form does not currently ask for either. This summary is what the agent scores jobs against.
• Your resume is never sent to the agent. Neither the file itself nor anything we read from it that you did not save into your profile reaches it. If the resume pre-filled a profile field and you kept it, that field is part of your saved profile and goes into the summary like anything else you saved.
• What you do on your AI agent page: the thumbs-up and thumbs-down decisions you record, the email settings you change (only the ones you changed), and your chat messages, each sent together with the most recent part of that conversation so the agent can follow it.
• We keep the agent up to date while your account is linked. When you confirm your email address, change your login email or display name, or save your profile, the website sends the change to the agent, and when your plan changes we update the agent too.

What the agent does with it

• Job scoring. If you are on the paid plan, the agent scores jobs it collects itself, separately from the listings on this website, against your profile summary and its notes about you. Each job gets a score out of 100, and the agent records the reasons and concerns behind it.
• Learned notes.If you are on the paid plan, once a night the agent looks at the decisions you have recorded about jobs (such as marking one thumbs-up or thumbs-down, applying, getting an interview, or winning the work) and updates short notes about your preferences. It uses those notes when it scores jobs for you. They are shown to you on your AI agent page, under “What my agent learned”, and you can also ask us for a copy at any time at info@flowkm.com.
• Email. If you are on the paid plan, the agent emails you a summary of your matches: every day on most plans, or only on set weekdays on some plans (your email settings show which). On plans that include instant alerts, it also sends a separate alert when a new job scores at or above your instant alert score. You can see and change that score in your email settings. The agent scores new jobs several times a day, so an alert can arrive some hours after a job appears. These emails come from jobs@consultant-finder.com, not from the website's own address, noreply@consultant-finder.com. You can change the digest hour, the alert score and your time zone, or pause the agent's emails, in the email settings on your AI agent page; the website sends the changes you make there to the agent. You can also change the digest hour or the alert score by asking the agent in chat. Every email from the agent has an unsubscribe link, which pauses the agent's emails; the agent keeps scoring jobs for you, and you can turn the emails back on in your email settings. The agent adds no tracking pixels or tracked links to its emails, only the standard headers that let your email app offer a one-click unsubscribe. Our email provider, Resend, can also track opens and clicks, and we keep that switched off.
• Chat.If you are on the paid plan, you can chat with your agent, in text, on your AI agent page. You can send one message at a time, and a limited number of messages per hour. Your plan also sets how many chat messages and web searches you get each month; the chat page shows how many are left. During a chat the agent can make changes for you: record a decision about a job (such as applying, getting an interview, or winning the work), change your digest hour or alert score, or edit its copy of your profile summary, for example when you tell it about a change in what you are looking for. The chat shows you what it changed. If you later change your profile on the website in a way that alters the summary, the summary is rebuilt from your profile and replaces the agent's version.
• Your chat history is kept by the website.Each conversation's messages (what you wrote, the agent's replies, and a note of anything the agent changed) are stored in the website's own database, so the conversation can carry on. A message and its reply are saved only once the reply arrives. With each new message, the website sends the most recent part of the conversation to the agent, and so to Anthropic. In the app, only you can see your chats; the operator can access them in the database, as with the rest of your data, for support, troubleshooting and handling abuse. We keep your chats until you ask us at info@flowkm.comto delete them. They are also deleted when we delete your account, or when we delete the agent's copy of your information.
• Market notes.Once a week the agent writes notes about the job market, which every person's agent shares. For each source the agent collects jobs from, over the last 30 days, they count its collection runs, the jobs found and added, failed runs and the date of the last new job; its listings, and how many of their pages could be read and how many were blocked; and the total numbers of thumbs-up, thumbs-down and “pursued” decisions (applied, interview or won) recorded on its jobs. They also list job titles and companies posted more than once, and pay lines quoted from job ads. Your decisions are counted into those per-source totals, which every agent's market notes use, but they are never attributed to you. The notes hold no per-person counts, names or email addresses.

Anthropic (Claude), the AI models behind the agent

• The agent uses Anthropic's Claude models: Claude Sonnet 5.5 for chat, and Claude Haiku 4.5 for job scoring, nightly learning and the weekly market notes. If Anthropic's safety system declines a chat request, its automatic fallback may answer it with another Claude model. If you are on the paid plan, the agent sends Anthropic the information needed for job scoring(your profile summary, the agent's notes about you, and the text of each job), nightly learning(your job decisions, the jobs they relate to, your profile summary and the agent's current notes), and chat, described next. For the market notes it sends only the counted totals and job-ad details described above, nothing about any one person.
• What a chat sends to Anthropic.Every message sends your name and today's date (in the agent's instructions), your new message, and the earlier part of the conversation (the agent reads the last 30 turns). When the agent decides it needs more, it also sends the result of the tool it used:
  • your profile: your name, profile summary, alert threshold, digest hour, timezone and the agent's learned notes about you;
  • a job search: the matching jobs, with each one's title, company, location, link, score, top two reasons and your own decision on it;
  • a score explanation: the breakdown of that one job's score;
  • an opened web page: the page's text;
  • a web search: the search results.
  A chat never sends Anthropic your email address, your plan, any billing details, or anyone else's information.
• Web search during chat. To answer some questions, the agent can search the web during a chat, up to three searches per message. Anthropic runs these searches with its own search tool and returns the results, and it may pass the search terms to a search provider it uses to run them. The agent writes the search terms itself, and they can reflect what you asked about. It is instructed never to put your name, email address, phone number, address, employer or other personal details into a search.
• Opening web pages during chat.The agent can also open web pages during a chat, such as a job listing, up to five per message. These pages are downloaded by the agent's own server, at DigitalOcean in New York, so the sites see a visit from the agent's server, not from you. It refuses private network addresses, and it never opens pages on LinkedIn, Indeed, Dice, Glassdoor or ZipRecruiter, or lnkd.in links, whether linked directly or reached through a redirect. A page's text is used only to answer that message: it goes to Anthropic with the conversation, and the agent's server does not store it. It refuses to open a web address that contains your personal details.
• The agent calls Anthropic directly, under our own commercial account, and has not opted into any programme that shares data with Anthropic for training or feedback. Anthropic processes this information as our service provider. Under Anthropic's commercial terms, it does not use it to train its models. Anthropic deletes it within 30 days. If Anthropic's automated safety checks flag it as possibly breaking Anthropic's usage rules, Anthropic may keep it for up to 2 years, and it may keep information longer where the law requires.

Where it is kept

• DigitalOceanruns the agent's server, in New York, USA. The server keeps log files, which record the agent's id number for you and, rarely, an email address inside an error message about an email that failed to send. The logs are kept to a fixed size (four files of 5 MB each), so older entries are overwritten as new ones are written. DigitalOcean also keeps weekly backups of the server for 28 days; these contain the log files, not the agent's database.
• The agent has its own Supabase database, separate from the website's, in the US East region. It holds your agent record (email address, name, plan and email settings), your profile summary and a history of changes to it, your job decisions, the scores the agent has given jobs for you, and its learned notes. Supabase keeps daily backups of it for 7 days. It also keeps a record of each chat message, web search, job scoring, nightly learning run and email it handles for you: when it happened, which AI model it used and how much AI processing it took. They do not contain what you wrote or what was sent. It uses these records to apply your plan's monthly allowance and to work out what the service costs us. They are deleted with the rest of the agent's copy of your information.
• Your chat history is kept in the website's database, not the agent's, as described above.
• When we delete your account, we also delete the agent's copy of your information. See how long we keep things.

• When you buy a plan, Stripe (through Link) collects your payment details on Stripe's own checkout page. We never see or store your card number. Stripe is the seller, and its own privacy policy covers what it collects.
• We send Stripe your account's email address and an internal account number, so a payment can be matched to your account. We send nothing else about you: not your profile, resume, jobs or chats.
• We keep a record of your plan: your Stripe customer number, your subscription number, which plan it is, its status (for example active, trial or cancelled) and its dates (renewal, trial end, cancellation). We keep it to give you the plan you paid for, to show it on Settings, and to keep your AI agent on the right plan.
• We keep a note of each payment message Stripe sends us (its number, type and time), so each is handled once. It holds no personal details.
• If you delete your account, these records are kept as a record of what was sold, without the link to your account. Stripe keeps its own records for tax and legal reasons.
• We email you 3 days before a Pro free trial ends.

We use a small number of service providers to run the platform. Each one only receives what it needs to do its job. This table lists the companies that process your personal data to run the service, and where.

The job data sources described below receive no personal data, so they are not in the table. More detail on each provider:

• Supabase: hosts our PostgreSQL database, which holds all of the account and profile data described above, and stores the encrypted resume files. Our database is located in the United States (US East, Ohio region). The AI job agent uses a separate Supabase database, listed below.
• Vercel: hosts and serves the website itself, and carries the traffic between your browser and our application.
• Google: only if you choose “Continue with Google”. Google handles the sign-in and tells us your email, name, and profile picture URL. We send Google nothing about your activity on the platform. The information we receive from Google sign-in is used to authenticate you and to create and maintain your account and, if your account is linked to the AI job agent, to identify you to the agent (including by name in your chats with it) and send you its email. It is never sold, never shared outside the service providers listed on this page, and never used for advertising, and our use of it follows the Google API Services User Data Policy, including its Limited Use requirements.
• Resend: delivers our email, through its North Virginia (us-east-1) sending region in the United States: the website's own email, from noreply@consultant-finder.com, and, if your account is linked to the AI job agent, the agent's email, from jobs@consultant-finder.com. It receives the recipient address and the contents of each message, and keeps logs of the emails it sends.
• Anthropic (Claude): for the AI job agent, and only for accounts linked to it. Provides the AI models the agent uses for job scoring, nightly learning, weekly market notes, chat, and web search during chat. It does not train on this data. See your AI job agent for what it receives and how long it keeps it.
• DigitalOcean: only if your account is linked to the AI job agent. Runs the agent's server, in New York, USA, which also opens web pages during chat, and keeps weekly backups of that server.
• Supabase (AI job agent database): only if your account is linked to the AI job agent. A separate database from the website's, in the US East region, holding the agent's records about you.
• Job data sources (Adzuna and JSearch, and potentially Jooble and Careerjet) are read-only. We query them with fixed ERP-related search terms to collect public job listings. No user data of any kind is sent to them. They never receive your identity, your profile, your searches, or the fact that you exist. The same is true when the AI job agent collects its own listings; see job listings from other sources. The one exception is a chat with the agent, which can search the web and open web pages, as described in your AI job agent.

Because our database, our hosting, and the AI job agent's systems are in the United States, your information is stored and processed there regardless of where you live. If you are in the UK, EU, or elsewhere outside the US, using the service involves that transfer. Information held in the United States can be accessed by US courts, law enforcement and national security authorities under US law. We can explain how your information is protected when it is transferred, with written details available on request from info@flowkm.com.

Many of the roles you see on Consultant Finder were not posted here. They are aggregated from third-party job APIs, and those listings (including the job text, company names, and links) belong to their respective owners and sources. We display them for reference and link back to the source. We do not control them, cannot guarantee they are current or accurate, and applying to one usually means leaving our site. Roles posted directly by companies with accounts here are marked as such, and are applied to on the platform.

The AI job agent also collects job listings of its own, separately from the listings on this website, and they appear only on your AI agent page and in the agent's emails. It finds them in job-alert emails delivered to the operator's own mailbox, which it only reads, and in RSS feeds, and it opens each job's page by its link. No user data of any kind is sent when it does: no cookies, logins, names, email addresses, profiles or decisions. The only way anything you wrote can reach other websites is through a chat with the agent, described in your AI job agent. The same applies to these listings as to the others: they belong to their respective owners and sources, and we cannot guarantee they are current or accurate.

If you own a listing and want it removed from our index, email info@flowkm.com and we will remove it.

• Service email. We send email that is part of the service working correctly, and it cannot be turned off while you have an account. Today that is: a welcome message when you sign up and, for email-and-password accounts, a separate email with the link that confirms your address; a link to reset your password whenever you ask for one; a sign-in code each time you sign in, if you have turned on email two-factor; and an email telling you that a firm has invited your email address to its roster, if one does. As the product develops we may also send service notices about your matches and applications.
• Confirming your address. If you sign up with an email and password, we ask you to click a link we email you before you can apply to roles, post them, browse the consultant directory, take part in a staffing roster, or use the AI job agent. This is to establish that the address belongs to you. You can still sign in and look around before confirming. If you sign up with Google we skip this, because Google has already verified the address. If you later change your login email, however you signed up, the AI job agent treats the new address as unconfirmed, and does not use it, until you confirm it. To confirm it, ask for a confirmation link on your AI agent page, or complete a password reset.
• Password resets. Asking for a reset link always produces the same response from us whether or not the address has an account, so that this page cannot be used to find out who is registered here. The link expires after one hour, works once, and completing it also confirms your address.
• AI job agent email, if you are on the paid plan. The AI job agent sends its summary emails and, on plans that include them, match alerts from jobs@consultant-finder.com. The website's own email, described above, comes from noreply@consultant-finder.com. Every email from the agent has an unsubscribe link. Using it pauses the agent's emails only; the agent keeps scoring jobs for you, and you can turn the emails back on, or change when they arrive, in the email settings on your AI agent page. See your AI job agent.
• Product email, if we send any. We may occasionally send product updates and platform news. If and when we do, every such email will include an unsubscribe link, and unsubscribing from it will not affect the service email above.
• We do not sell or rent your email address, and we do not send third-party ads.

We use only the cookies needed for signing in: the session cookie that keeps you signed in, and short-lived cookies our sign-in system sets to protect the sign-in itself, including during Google sign-in. They are strictly necessary. Without them, the site cannot sign you in.

We do not run any analytics, advertising, or tracking software. There is no Google Analytics, no tag manager, no advertising pixel, no session recorder, and no third-party script of any kind on this site. Our fonts are served from our own servers rather than a font CDN, so simply loading a page does not tell anyone else that you visited. This is a deliberate choice, and if it ever changes, this page will say so first.

The same goes for our email. Neither the website nor the AI job agent adds tracking pixels or tracked links to the email we send. Our email provider, Resend, can also track opens and clicks, and we keep that switched off.

• We keep your account and profile data for as long as your account exists, because that is what makes the profile work.
• Deletion is handled by request, by a person. There is no automated delete button, and nothing deletes your account, profile, applications or resume on a schedule. When you email us from the address on your account, we verify it is you and then delete your account and the data attached to it (your profile, skills, applications, any resume file you uploaded, and your chat history with the AI job agent) within a reasonable period, and no later than 30 days. Some short-lived security records are handled differently, in your favour. The counters behind our rate limits clear themselves automatically. Confirmation and password-reset links are stored only as a hash and stop working once they are used or expire, and an old link is deleted when you ask for a new one.
• If your account is linked to the AI job agent, when we delete your account we also delete the agent's copy of your information, within the same 30 days. That removes your agent record from the agent's database, and with it every score, decision and learned note belonging to you, your usage records, and your profile summary with its history of changes. What stays is not about you: the job listings the agent collected, which everyone's agent shares; its market notes, which hold counted totals and details from job ads, and nothing about any one person; and statistics about its job collection runs.
• Some copies are not deleted by us, but expire on their own: the agent database's daily backups, after 7 days; anything the agent sent to Anthropic, on Anthropic's own schedule (described in your AI job agent); Resend's logs of the emails sent to you, on Resend's own schedule; the agent server's log files, as they are overwritten; and DigitalOcean's weekly backups of the agent's server, after 28 days.
• Because the process is manual rather than automatic, an uploaded resume file stays in our storage until we act on a deletion request. It remains encrypted, and no other user can reach it, but we are not going to describe it as automatically erased when it is not.
• Also in your favour: if you upload a replacement resume, the previous file is deleted from our storage as soon as the new one is safely stored. We only ever keep the most recent one.
• If your account is linked to the AI job agent, the agent keeps its copy of your information until your account is deleted or you ask us to delete it, including if you later move off the paid plan. If you are not on the paid plan, you can ask us at info@flowkm.comto delete the agent's copy without closing your website account. As with account deletion, a person handles this by request, within the same 30 days: we delete the same agent information listed above, unlink your account from the agent, and delete your chat history with the agent, so that an old conversation is never sent to the agent again.
• Records of roster invitations may retain the email address they were sent to, since that address is how the invitation was addressed.
• Our database provider maintains backups, so deleted data may persist in those backups for a period after we remove it from the live service. The AI job agent's database is backed up daily, and those backups are kept for 7 days.
• Job listings collected from third-party sources are hidden once they go stale rather than deleted, so we can recognise the same listing if it reappears. These contain no personal information about our users.

Whatever country you are in, you can ask us to do the following, and we will:

• See what we have. Ask for a copy of the personal information we hold about you.
• Correct it. Most of it you can fix yourself in Settings at any time. If something is wrong that you cannot edit, tell us and we will correct it.
• Delete it. Ask us to delete your account and your data. There is currently no self-service delete button, so email info@flowkm.comfrom the address on your account. Once we have confirmed the request came from you, we will delete it within a reasonable period and no later than 30 days, including your chat history and the AI job agent's copy if your account is linked to it.
• Stop being visible.Turn off “open to work” in your profile and you immediately stop appearing in the consultant directory, without deleting anything.
• Withdraw consent.Decline or leave a firm's roster, unsubscribe from product email, or close your account. The unsubscribe link in the AI job agent's emails pauses those emails only; the agent keeps scoring jobs for you. To stop the agent holding your information without closing your account, ask us to delete the agent's copy, which also deletes your chat history with it. If you are on the paid plan, ask us in the same email to move your account off it, because the agent cannot run without its copy of your information.

If you are in the UK or EU, the GDPR also gives you the right to object to or restrict certain processing, the right to data portability, and the right to complain to your local data protection authority. If you are in California, you have the right to know what we collect, to request deletion, and not to be treated differently for exercising those rights. Note that we do not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of there. In Canada, Alberta's Personal Information Protection Act and PIPEDA give you the right to see and correct your personal information. If you are not happy with how we handled a request or a complaint, you can complain to the Office of the Information and Privacy Commissioner of Alberta (oipc.ab.ca) or to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Send any of these requests to info@flowkm.com. We will respond within 30 days. We may need to confirm that you control the account's email address before acting on a request.

No service can promise perfect security, and we are not going to. Here is specifically what we do:

• Passwords are stored as bcrypt hashes, never in a readable form.
• Uploaded resume files are encrypted at rest with AES-256-GCM.
• Authenticator (TOTP) secrets are encrypted at rest. One-time codes for email two-factor and backup codes are stored hashed.
• Links we email you to confirm your address or reset your password are stored only as a hash. Anyone reading our database sees the hash, not a working link.
• Changing your login email, setting a first password, or turning off two-factor authentication requires your password (or an authenticator code) again, even while you are already signed in, so a moment at an unattended screen is not enough to take an account over.
• Sign-up, password-reset requests, password changes, two-factor attempts, and the chat messages, decisions and settings changes made through the AI job agent are rate limited, to make guessing and bulk abuse impractical.
• Two-factor authentication is available on every account, by email code or with an authenticator app. We recommend turning it on in Settings.
• All traffic to the site is served over HTTPS.
• Our website connects to the AI job agent only from our own servers, over HTTPS; the key that connects them never reaches your browser.
• Every request that reads or writes data checks that the data belongs to the account making the request.

If we become aware of a breach affecting your personal information, we will notify you and the appropriate regulator as required by law.

Consultant Finder is a professional service for working ERP consultants and the companies that hire them. It is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe a child has created an account, email info@flowkm.com and we will delete it.

If we change how we handle personal information, we will update this page and change the “last updated” date at the top. Where a change materially affects your rights or how your data is used, we will take reasonable steps to tell account holders before it takes effect, for example by notice on the site or by email. Checking this page is the reliable way to see the current version.

For any privacy question, request, or complaint, email info@flowkm.com. A person reads it. The same email address handles reports about content on the platform: a listing or profile that looks fake or abusive, a copyright concern, or a job listing you own and want removed from our index. Tell us what you found and where, and we will look into it.

You can address any request to our Privacy Officer, Kingston Madlansacay, at the same email address. If you need to send something by post, ask by email and we will give you a postal address.