Your information, handled with care.

Flow is made by Pexally, 2001 S Heather St, Cornelius, OR 97113, United States. This policy explains what personal information we handle when you visit our sites, use a Flow workspace, or pay a business that uses Flow — and the choices you have.

Two roles. For our own visitors, account holders and buyers on a Pexally checkout, Pexally decides how information is used (we are the “controller”). For the clients and contacts a business keeps in its own workspace, that business decides, and we process the information on its behalf.

• Account details — your name, email address, profile picture, time zone and the preferences you set, and the details of the workspace you create.
• Identity and payout details — information we ask for before paying you, and the bank account you add. Bank details are encrypted before they are stored, and every time they are read it is recorded.
• Workspace content — the clients, projects, invoices, messages, files links, forms and emails you and your team put into Flow.
• Buyer details at checkout — name, email address and billing country (for tax only; never a shipping address), and, to prove delivery if a payment is disputed, the time of purchase, IP address and browser details.
• Payment details — card numbers are entered with our payment processors and never reach our servers. We receive a record of the payment, not the card.
• Website chat and sign-ups — the name, email address and messages you send in the chat, and the email address you type to start a trial.
• Usage and security records — sign-ins, actions taken in a workspace (its activity log), and technical logs that keep Flow running and safe.

• To provide Flow: run your workspace, send your emails, and take and pay out payments.
• To act as seller of record: process payments, deliver what was bought, handle refunds and disputes, and meet tax and accounting duties.
• To keep Flow and its users safe: check identities, review listings, prevent fraud and abuse, and secure accounts.
• To support you: answer the chat and your emails, and send messages about your account, payments and payouts.
• To tell you about Flow, only where you have agreed or the law allows — every marketing email lets you unsubscribe.
• To improve Flow, using information that is aggregated wherever we can.

Where laws such as the GDPR apply, we rely on: performing our contract with you; our legitimate interests in running, securing and improving Flow, balanced against your rights; legal obligations, such as keeping payment and tax records; and your consent, for example to marketing email and to advertising cookies — which you can withdraw at any time.

We do not sell personal information. We share it only with services that help us run Flow, under contracts that limit what they may do with it:

• Hosting and database — Supabase, and our servers and network provider.
• Payments — Stripe and PayPal to take payments; Airwallex and our banking partners to send payouts.
• Email — Resend for account and transactional email, and Amazon SES for campaigns.
• AI assistant — Google’s Gemini API, for the features you or the website chat ask it to perform.
• Advertising measurement — Meta and Google, on Pexally’s own pages only and only after you allow it. Never on a business’s checkout.

We also share information when the law requires it, to protect people or Flow, or as part of a sale or merger of our business — with notice to you where we can give it.

• Needed to work — your signed-in session, your chosen theme and your time zone.
• Kept in your browser — the key to your website-chat conversation, so you can come back to it, and whether you have dismissed the chat’s greeting.
• Advertising — the Meta Pixel and Google tag load on our own pages only after you agree, and never on a business’s pages.

Pexally is based in the United States, and our service providers may process information in the United States and other countries. Where the law requires, we use safeguards such as standard contractual clauses for information transferred out of your country.

We keep information while your account is open and for as long as needed to provide Flow. Records of payments, payouts and our ledger are kept for as long as tax, accounting and anti-fraud laws require, and cannot be deleted before then. Other information is deleted or anonymised when it is no longer needed.

• Update your details from your profile and workspace settings at any time.
• Unsubscribe from our campaigns using the link in any of them; account emails still arrive.
• Depending on where you live, ask us to access, correct, delete, restrict or move your information, or object to how we use it.
• If you are a client or contact of a business that uses Flow, please ask that business first; we will help them respond.

Write to [email protected] to make a request. You may also complain to your local data protection authority.

Every workspace’s information is kept apart from every other’s by rules in the database itself. Bank details and connected payment keys are encrypted, staff reach our console only with two-step sign-in, and what staff do there is logged. No system is perfectly secure; if something goes wrong that affects you, we will tell you as the law requires.

Flow is for businesses and is not meant for anyone under 18. We do not knowingly collect information from children; if you believe we have, contact us and we will delete it.

We will change the date at the top when we update this policy, and tell you by email or in your workspace about changes that matter. Questions? Email [email protected], use the chat on our contact page, or write to Pexally, 2001 S Heather St, Cornelius, OR 97113, United States.