Privacy Notice

1. Who we are

This Privacy Notice describes how Chidozie Frank Obilo ("we", "us", "our"), operating AssetFlow, processes personal data. We act as the data controller for personal data we collect about users of the Service.

2. Data we collect

• Account data: name, email address, password hash, organization details.
• Profile and content data: information you enter about buildings, assets, maintenance, and compliance.
• Support data: messages and attachments you send when contacting us.
• Usage and telemetry: pages visited, features used, error logs, approximate timestamps.
• Device and connection data: IP address, browser, operating system, device identifiers.

Payment card and billing details are collected and processed by Paddle (see Section 5) and are not stored on our systems.

3. Why we use your data

• Create and operate your account (legal basis: performance of a contract).
• Provide, maintain, and improve the Service (legitimate interests; contract).
• Provide customer support (contract; legitimate interests).
• Detect, prevent, and respond to fraud, abuse, or security incidents (legitimate interests; legal obligation).
• Send transactional communications about your account (contract).
• Comply with applicable laws, including accounting and tax obligations (legal obligation).

4. Cookies

We use essential cookies and local storage required to authenticate you and remember your preferences. We do not use third-party advertising cookies.

5. How we share data

We share personal data only with the categories of recipients below:

• Service providers (subprocessors): hosting, database, email, and analytics providers acting on our instructions.
• Merchant of Record — Paddle: we use Paddle.com as our reseller and Merchant of Record for the sale of subscriptions, subscription management, payment processing, tax compliance, invoicing, and refunds. Paddle's processing of your data is governed by Paddle's own privacy notice.
• Professional advisers: legal, accounting, or audit advisers where necessary.
• Authorities: when required by law, regulation, or valid legal process.

6. Data retention

We keep personal data only as long as needed for the purposes set out above, to comply with legal obligations, resolve disputes, and enforce our agreements. When no longer needed, data is deleted or anonymised.

7. Security

We use appropriate technical and organisational measures — including encryption in transit, access controls, and least-privilege practices — to protect personal data against unauthorised access, alteration, disclosure, or destruction. No system is perfectly secure; we cannot guarantee absolute security.

8. Your rights

Subject to applicable law, you may have the right to access, rectify, erase, restrict, or port your personal data, to object to certain processing, and to withdraw consent where processing is based on it. To exercise these rights, contact us through the support channels in the Service. You may also have the right to lodge a complaint with your local data protection authority.

9. International transfers

Our service providers may process personal data in countries other than yours. Where required, we rely on appropriate safeguards, such as Standard Contractual Clauses or adequacy decisions.

10. Changes to this notice

We may update this Privacy Notice from time to time. Material changes will be highlighted within the Service.

11. Contact

For privacy questions, contact us through the support channels available within the Service.