Privacy Policy
Effective 11 August 2026
Data we process
Account and team details; customer and lead records; orders and inventory; meeting transcripts and summaries; payment status; connection metadata; and security and diagnostic events.
Why we process it
To perform the service contract, follow business-customer instructions, synchronize authorized sources, generate requested AI output, send operational notifications, secure and improve the service, prevent abuse, support users, and meet legal obligations. A business customer must identify its own lawful basis for the customer and prospect data it asks Paidflow to process.
Our privacy roles
Paidflow generally acts as a processor or service provider for customer, lead, meeting, and marketplace data controlled by a business customer. Paidflow acts as a controller for account administration, billing, security, support, service analytics, and its own legal obligations. The business customer remains responsible for its notices, lawful bases, consent records, and data-subject responses.
Website lead capture
The Paidflow widget uses a random first-party visitor ID. It does not fingerprint visitors. Page-view tracking should run only after the site's consent manager grants consent. Contact details are collected when a visitor submits the form.
Providers
Data can be processed by Supabase, Cloudflare, Gemini, Recall.ai, payment processors, email providers, and the commerce or social services a business connects. Each provider receives only the data required for its function.
AI processing
When an AI feature is enabled, relevant meeting, lead, sales, or commerce context is sent to the configured AI provider to produce the requested result. Businesses must review outputs and should not submit unnecessary sensitive information. Paidflow does not permit solely automated legal or similarly significant decisions based on an AI score.
Meeting recordings
Meeting audio, transcripts, participant names, summaries, objections, decisions, and action items may be processed when an organizer enables the notetaker. The organizer must provide notice at or before the meeting and obtain any consent required in each participant's location. Participants should be given a practical way to decline where required.
Credentials and security
Provider secrets are encrypted and accessible only to server-side services. Never put secret provider tokens into the public website widget.
Retention and deletion
Workspace content (customers, tasks, chat, commerce sync, meetings, and AI logs) is kept while the workspace subscription is active. After a deletion request we remove live workspace rows within 30 days, except records we must keep for tax, dispute, or security reasons. Meeting recordings and transcripts are kept until the organizer deletes them or the workspace is closed. Provider credentials are deleted when disconnected. Security and abuse logs are kept for 90 days. Encrypted backups may persist up to 30 days after live deletion.
International transfers
Paidflow and its providers may process data in countries different from the business or individual. Where required, Paidflow will use an approved transfer mechanism and contractual safeguards. Businesses serving the EEA, United Kingdom, Canada, or other regulated regions should execute the applicable data-processing and transfer terms before importing personal data.
Security and incidents
Paidflow uses access controls, tenant isolation, encryption for provider credentials, signed webhooks, audit records, and abuse controls. No system is completely secure. We will investigate suspected incidents and notify affected businesses or authorities where legally required.
Business responsibilities
Each business controls the customer data it imports and must provide required notices, obtain consent, respect opt-outs, and respond to data-subject requests.
Your rights
Depending on location, individuals may request access, correction, deletion, restriction, portability, or objection by contacting Paidflow or the relevant Paidflow business customer.
Children
Paidflow is a business service and is not intended for children. Businesses must not intentionally submit children's personal data unless they have confirmed an appropriate lawful basis and all required safeguards.
Affiliate and creator partners
When you apply for or participate in the Paidflow Creator and Affiliate Partner Programme, we collect your name, creator handle, channel or website profile URLs, contact information, audience demographics, and payout banking details (including bank name, bank account number, account holder name, and payout routing codes). We process this data to evaluate partner applications, track referral links and audience discount redemptions, calculate recurring commissions, disburse payouts via banking institutions and payment gateways, prevent fraudulent or self-referral activity, and satisfy financial accounting and tax compliance obligations. Payout details are encrypted in storage and accessible only to authorized administrators and payment processors.
Corporate transactions and IPO
If Paidflow undergoes an initial public offering, merger, acquisition, financing, reorganization, or sale of assets, account and workspace data may be disclosed to advisors, underwriters, lenders, and prospective buyers under confidentiality obligations, and may be transferred to a successor that remains bound by this policy or that provides notice and comparable protection. You will be told of a material change of operator where required by law.
Complaints and contact
The operator of Paidflow is the business that publishes paidflow.online. Privacy requests for Paidflow account, billing, and security data: privacy@paidflow.online. Requests about customer or prospect records held in a workspace should first go to that business customer. Individuals may also complain to the data-protection authority in their jurisdiction.
Operator: Paidflow, the service at paidflow.online. Privacy contact: privacy@paidflow.online. Subprocessors currently include Supabase, Cloudflare, Google Gemini, Recall.ai, Paystack, and Flutterwave, plus any commerce or email provider a workspace connects. This notice is not a substitute for counsel review of regional DPA or SCC paperwork.