Legal · version 1.0
Privacy Policy
CROWNPEAK TECHNOLOGY LIMITED explains how ExportFlow handles personal data.
1. Scope and roles
This policy covers the ExportFlow website, accounts and SaaS workspace. We act as controller for account, billing, security and support data. For customer-uploaded prospect and contact data, we generally act as a service provider following the workspace customer’s instructions.
2. Data we process
We may process account identifiers, email address, authentication records, subscription references, workspace content, prospect and contact records, AI instructions and outputs, quotation drafts, usage records, device and security logs, and support communications. Stripe handles full payment-card details; ExportFlow does not store them.
3. Purposes
We use data to provide and secure the service, authenticate users, maintain workspaces, generate requested drafts, administer subscriptions, prevent abuse, respond to support requests, meet legal obligations and improve reliability. Customers are responsible for having a lawful basis to upload and contact prospects.
4. Providers and international processing
ExportFlow uses Supabase for database and authentication, Cloudflare for hosting and delivery, Stripe for subscription billing, and DeepSeek for user-requested AI drafting. These providers may process data outside Hong Kong. We limit information shared to what is needed for each service.
5. Retention and security
Workspace content is retained while an account is active and is deleted following a completed account-deletion request, except where retention is required for security, dispute or legal reasons. Billing and audit records may be retained for up to seven years where legally required. Operational error records are normally removed within 90 days. We use workspace isolation, encrypted transport, restricted service credentials and human review gates.
6. Access, correction, export and deletion
Signed-in users can download a portable copy of workspace data and permanently close an account from Account and data. Requests for access or correction can be sent to privacy@getexportflow.com. We may verify identity before acting.
7. California Residents' Rights
California residents may request to know or access personal information we collect, request correction or deletion, and receive information about our disclosure practices, subject to applicable exceptions and identity verification. ExportFlow does not sell personal information and does not share personal information for cross-context behavioural advertising. You may nevertheless submit a request to opt out of any future sale or sharing through our Do Not Sell or Share My Personal Information page or by emailing privacy@getexportflow.com. We will not discriminate against you for exercising applicable privacy rights. Authorised agents may submit a request, but we may require proof of authority and verification of the consumer's identity.
8. Essential storage and advertising controls
ExportFlow uses authentication and security storage needed to keep users signed in and protect accounts. Non-essential advertising cookies, Google Analytics, Meta Pixel and similar advertising trackers are not activated during the beta. If we introduce non-essential analytics or advertising technology, we will provide notice and appropriate choices before enabling it where required.
9. Changes
Material updates will be identified by a revised effective date and, where appropriate, an in-product notice.