Privacy Policy
Last updated: 8 October 2026.
This policy explains how AuditFlow, run by [Auditflow], Plot 36 Citadel Phase 2 WTC Estate, Enugu State, Nigeria. ("we", "us"), handles personal data. Contact: WhatsApp or auditflow.help@gmail.com.
Our two roles
- Tradespeople and trade businesses (our customers): for your own account details we are the controller.
- Your customers' data: names, phone numbers, addresses, quotes, invoices, photos and enquiries you put into AuditFlow. The business using AuditFlow is the controller and we are the processor, acting only on that business's instructions.
What we collect
- Account: email, business name, trade, phone, payment details you choose to show on invoices, and your plan.
- Your customers' details and job records that you enter, including photos you upload.
- Enquiry form details a member of the public sends to a business (name, phone, issue, address). These go to that business.
- How you heard about us (optional, if you tell us) and the sign-up security check, which looks at your browser and connection to tell people from bots.
- Technical error reports: if the app hits a fault we record the error message, the page and your browser type (never customer details) so we can fix it. They are deleted after 30 days.
- Public pages: if you publish a business web page, what you write on it (business name, services, phone, email, areas) is public. Do not include anything you do not want shown.
- Subcontractor details you choose to add (name, phone, email, day rate, insurance expiry). CIS calculator figures are not saved.
- Payments: handled by Polar. We do not store card numbers.
- Technical data needed to keep the service secure and working.
- Reviews you choose to post about AuditFlow (rating, comment, the name you choose, and your business type). These are shown publicly on our website. You can edit or delete your review in the app.
Why we use it
- To provide the service and your account (contract).
- To keep the service secure and prevent abuse (legitimate interests).
- To meet legal duties such as tax and record keeping.
We do not sell personal data and we do not use it for advertising.
Who we share it with
Only service providers that help us run AuditFlow: Cloudflare (website hosting and the sign-up security check), Supabase (database, login, file storage), Polar (payments), auditflow.help@gmail.com. When you tap a WhatsApp button, the message and the number you send to are handled by WhatsApp (Meta) under its own policy. If you choose email, the message goes through your own email app and provider. We do not send messages for you or read them. We may also share data if the law requires it.
Where it is kept
Data is stored with Supabase in west Europe, London.. We operate from Nigeria, so we may access data from outside the UK. We use contractual safeguards for this relying on the standard contractual clauses and data processing addendums provided by our cloud infrastructure partners, Supabase and Cloudflare..
How long we keep it
While your account is open. When you delete your account (Home, then Your details) we delete your business data and photos. Job photos are automatically deleted 12 months after upload. Backups may keep copies for up to 30 days. We may keep basic payment records as the law requires.
Security
Each business can only see its own data. Photos are stored privately. Data is encrypted in transit. You can turn on two-step sign-in in the app.
Your rights
You can ask to see, correct, delete or export your data, restrict or object to its use. If you are a customer of a business that uses AuditFlow, please contact that business first; we will help them respond. You can complain to the Information Commissioner's Office at ico.org.uk.
Cookies
We only use browser storage that is essential to keep you signed in. If you arrive from a referral or partner link we also keep that code in your browser so the right person is credited when you sign up. We do not use advertising cookies.
Children
AuditFlow is for businesses and is not aimed at under-18s.
Changes
We will update this page if our practices change.