Privacy Policy

FlowSync ("FlowSync", "we", "us", "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and share personal data when you use our website, software platform, and related services (the "Service"). It applies to visitors, prospective customers, registered business users, their staff members, and end customers of businesses that use FlowSync.

FlowSync acts as a data controller in respect of personal data we collect directly from you, and as a data processor on behalf of business users who use FlowSync to manage their own customer data. This policy covers both roles.

1. Who we are

FlowSync is the trading name of Jack Arran Sandison, who operates the Service. For the purposes of the UK GDPR and the Data Protection Act 2018, Jack Arran Sandison is the data controller responsible for your personal data.

If you have any questions about this policy or how we handle your data, you can contact us at info@flow-sync.co.uk.

2. Personal data we collect

2.1 Information you give us

• Lead enquiries: your name, phone number, email address, business type, and jobs-per-week estimate when you request a demo or contact us.
• Account registration: your name, email address, and password when you register for a FlowSync account.
• Business profile: company name, contact details, logo, and branding assets that you upload to the Service.
• Customer records: names, phone numbers, email addresses, addresses, and notes that business users enter about their own customers.
• Staff management: email addresses of team members you invite to your FlowSync workspace.

2.2 Information collected automatically

• Usage data: pages visited, features used, timestamps, and device/browser information.
• Authentication data: login tokens and session identifiers used to keep you signed in securely.

2.3 Information from payment processing

When you subscribe to a paid plan, payment is processed by our payment provider (Base44 Payments, powered by Wix). We receive a confirmation of the transaction, your buyer email, and the product and amount paid. We do not collect or store full card numbers or sensitive card data — that is handled entirely by the payment provider.

3. How we use your personal data

We process your personal data for the following purposes and under the following lawful bases:

• Providing the Service (performance of a contract) — creating and managing your account, jobs, invoices, customers, and staff records.
• Processing payments (performance of a contract) — setting up and managing your subscription and fulfilling paid orders.
• Communicating with you (consent or legitimate interests) — responding to enquiries, sending booking confirmations, reminders, invoices, review requests, and follow-ups on behalf of business users.
• Improving the Service (legitimate interests) — analysing usage patterns, fixing bugs, and developing new features.
• Security and fraud prevention (legitimate interests) — monitoring for misuse, protecting accounts, and verifying identity.
• Legal compliance (legal obligation) — meeting record-keeping, tax, and regulatory requirements.

4. Sharing your personal data

We may share your personal data with the following categories of recipients:

• Payment providers — Base44 Payments (Wix) for subscription checkout and fulfilment.
• Communication providers — email and (where enabled) SMS gateways used to send automated messages on behalf of business users.
• Cloud infrastructure — hosting, database, and file storage providers that support the Service.
• Analytics providers — tools that help us understand how the Service is used, where you have consented.
• Professional advisors and authorities — where required for legal, regulatory, or accounting reasons.

We do not sell your personal data. Where we share data with processors, we do so under written contracts that require them to protect it to a standard consistent with the UK GDPR.

5. International transfers

Some of our service providers may process personal data outside the United Kingdom. Where this happens, we ensure appropriate safeguards are in place, such as UK International Data Transfer Agreements, Standard Contractual Clauses, or reliance on the UK adequacy regulations for the relevant country.

6. How long we keep your data

We keep personal data only for as long as is necessary for the purposes set out in this policy. Account and business data is retained while your account is active and for a reasonable period after closure to allow for reconciliation, legal compliance, and dispute resolution. Lead enquiry data is retained for up to 24 months unless you ask us to delete it sooner.

7. Your rights under UK GDPR

You have the following rights in relation to your personal data:

• The right to be informed about how we use your data (this policy).
• The right of access to your personal data.
• The right to rectification of inaccurate or incomplete data.
• The right to erasure (also known as the right to be forgotten).
• The right to restrict or object to processing.
• The right to data portability.
• The right to withdraw consent at any time, without affecting processing already carried out.
• The right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, email us at info@flow-sync.co.uk. We will respond within one month, as required by law.

8. Security

We use technical and organisational measures to protect your personal data, including encryption in transit and at rest, access controls, and regular security reviews. However, no system is completely secure, and we cannot guarantee absolute security.

9. Cookies

The Service uses essential cookies and similar technologies to keep you signed in and to operate correctly. We may also use optional analytics cookies to understand usage. You can control cookies through your browser settings; disabling essential cookies may affect functionality.

10. Children's data

The Service is intended for businesses and is not directed at individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with data, please contact us and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will publish the updated version on this page with a revised "Last updated" date. We encourage you to review it periodically.

12. Contact us

If you have any questions, requests, or concerns about this Privacy Policy or your personal data, please contact us at info@flow-sync.co.uk.