Privacy Notice

1. Who we are

Flow is operated by Chimerical Ventures Limited, a company registered in England and Wales. Contact us at [email protected] for any privacy-related enquiry or request.

2. What data we collect

When your organisation subscribes to and uses Flow, we collect:

• Account data — your name, email address, and role within your organisation.
• Subscription & licence data — which seats are assigned to which users, your billing period, pricing tier, purchase order numbers, and invoice records.
• Business data your organisation enters — projects, customers, crew, equipment, quotes, invoices, contracts, timesheets, and similar records your organisation creates while using Flow. This data belongs to your organisation, not to us; we process it on your organisation's behalf. Sensitive fields including customer and crew email addresses, phone numbers and postal addresses are encrypted at rest; some operational and contact fields — such as customer and user names, and supplier contact details — are not yet.
• Communications — emails we send you (invitations, notifications, invoices) and, where a reply is matched back to a record, the content of that reply.
• Usage data — login events, classified only by coarse device type (desktop/mobile/tablet). Login events themselves do not store IP addresses or raw browser user-agent strings. A small number of other records do, for security and evidentiary purposes only: our API request audit log (IP address and user-agent, used to detect abuse of API keys), the last IP address an API key was used from, and the IP address recorded against a customer's contract or document signature (kept as evidence the signature is genuine). We do not retain user-agent strings from the anonymous in-app feedback tool.
• Feedback and support requests — anything you submit via the in-app feedback tool (optionally anonymously) or by raising a support request from inside the product, together with any replies exchanged with our team about it. A support request is always attached to your account and to your organisation, because we need to know who to reply to; feedback submitted anonymously is not.

We do not collect payment card details directly — subscription invoicing is handled through our accounting system (QuickBooks), described below.

3. Lawful basis

We process your data on the basis of contract (UK GDPR Article 6(1)(b)) — your account, subscription, and business data are necessary to provide the Flow service your organisation has subscribed to — and, for billing and fraud-prevention purposes, on the basis of legitimate interests (Article 6(1)(f)).

4. Who can see your data

• You — your own profile and subscription/seat status are visible to you within the app.
• Your organisation's administrators — can view team membership, seat assignments, and subscription status to manage your organisation's account.
• Chimerical Ventures staff — a small number of staff can access the platform-administration panel to provide support, manage billing, and fulfil data-subject requests. Access requires authentication and, for administrative accounts, two-factor authentication.
• Third-party processors — see section 8. We never sell, rent, or share your personal data with third parties for marketing or analytics purposes.

5. How long we keep it

6. Your rights

Under UK GDPR you have the right to:

• Access — request a copy of the data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data.
• Portability — receive your data in a structured, machine-readable format.
• Object or restrict processing — in circumstances defined by UK GDPR.

Where your organisation has enabled it, you may be able to confirm, update, or request deletion of your own contact details directly from a link on a quote, invoice, or customer portal page, without needing to email us. Otherwise, to exercise any right, email [email protected]. We will respond within 30 days. If you are not satisfied with our response, you can complain to the ICO.

7. Security

All data is transmitted over HTTPS. Passwords are hashed and never stored in plaintext. Selected sensitive fields — including customer and crew email addresses, phone numbers and postal addresses — are individually encrypted at rest (application-level encryption, distinct from disk encryption); other business-record fields, such as names and some operational and contact fields, are not yet, and we're working through extending this coverage over time. Access to the platform-administration panel requires staff credentials and two-factor authentication. Changes to records are logged in an audit trail.

8. Third-party processors

We use a small number of third-party services to operate Flow, each strictly for the purpose stated:

• Resend — delivers transactional emails (invitations, notifications, invoices), and receives inbound replies routed back to the record they concern.
• QuickBooks Online (Intuit) — our own accounting system, used to invoice your organisation for its Flow subscription. Only your organisation's name and billing/invoice data is shared with it, never your organisation's own customer data.
• Xero — only if your organisation chooses to connect its own Xero account. Your organisation's own invoice data, and your customers' name and email address (as an accounting contact), then sync there under your organisation's own control, not ours.
• OpenStreetMap / Nominatim — optional address geocoding for maps, disabled by default.
• Twilio — if enabled by your organisation, sends SMS shift-reminder text messages to crew members' mobile numbers (checked hourly for upcoming shifts).
• Microsoft Teams — if your organisation configures an incoming webhook URL, we post notification cards (e.g. project or quote updates) to it.
• Your own webhook integrations — if your organisation configures a custom webhook endpoint, we deliver event notifications to the URL you provide (which may include project names, quote/invoice references, and — for crew-assignment events — a crew member's name). Your organisation is the controller for where that data then goes; see your Settings page for what's configured.
• Gitea — configured in our infrastructure to receive automated bug reports when the application encounters an unexpected error, including diagnostic details about the request that failed. Not currently active in production.
• Stripe — built in to support taking card payments against an invoice. Not currently wired up to any button or flow in the product, so no data is sent to it today.
• Booqable — if your organisation has this integration enabled, customer name, email, phone and address are synced in from your Booqable account.
• Rentman — if your organisation has this integration enabled, customer and crew contact details are synced in (read-only) from your Rentman account.

Some of these processors may transfer data outside the UK; where they do, appropriate safeguards (such as Standard Contractual Clauses) are in place.