Privacy Policy

ClientFlows is a booking and client-management platform for service professionals, operated by Sole Trader T/A ClientFlows, CB6 1HE, United Kingdom. For the purposes of data protection law, the operator is the data controller for account and billing data, and a data processor for the client data that businesses store in the platform.

• Name, email address and phone number
• Appointment history (bookings, services, dates, status)
• Intake form responses submitted before appointments
• Payment records (subscription status; card data is held by Stripe, not by us)
• Product usage and performance data, such as pages visited, feature interactions, browser/device details and approximate location

We process account and customer data to provide the booking and client-management service — creating and managing appointments, maintaining client records, taking subscription payments, and sending booking-related emails. We also use cookieless analytics to understand how the service is used, diagnose performance issues and improve the product. We process that analytics data on the basis of our legitimate interests in operating and improving ClientFlows.

Subscription and account data is retained for the duration of your service plus 12 months. Client data is deleted when an account is closed, or earlier on request.

Under UK GDPR / GDPR you have the right to access, rectify, erase, and port your personal data, and to object to or restrict its processing. To exercise any of these rights, contact us using the details below.

Account owners can also do this themselves at any time from Settings → Your data & privacy: download a complete export of your data, or permanently delete your account (which removes your business and its data and cancels any active subscription).

If you use ClientFlows as a client of a business (a booking or portal account), deleting your account removes your login and anonymizes the personal details held about you — your name, email, phone number, notes, and intake form answers. Businesses retain only anonymized, non-identifying booking records for their own accounting.

• Stripe — payment processing and card data storage
• Supabase — database and file storage (EU/UK region)
• Resend — transactional email delivery
• Vercel — application hosting, cookieless product analytics and performance monitoring
• Upstash — rate limiting (short-lived per-IP request counters to prevent abuse)

Each provider processes data only as needed to deliver their part of the service, under their own data-processing terms.

We use essential cookies for session management (keeping you signed in). Product analytics and performance monitoring are cookieless. We do not use advertising cookies.

For any privacy question or to exercise your rights, contact us at privacy@clientflows.uk.