Your privacy matters
We're committed to protecting your personal data and being transparent about how we use it. This policy explains how we handle your personal data under GDPR, CCPA, and KVKK.
Last Updated: October 5, 2026 | Version 1.5
Introduction
ClientFlow ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Business OS platform. Our primary data processing occurs in the European Union (Germany), ensuring strong data protection standards. ClientFlow is business-management software, not a medical-records system: if you record health or other special-category information about your clients, you are the controller of it and we act as your processor under our Data Processing Agreement.
Information we collect
Information You Provide
- Account info (email, name, profile picture via OAuth)
- Customer data (names, phone numbers, emails)
- Payment records (amounts, dates, statuses)
- Communication content (templates, notes)
Automatic Collection
- Device info (browser type, operating system)
- Usage data (pages visited, features used)
- IP address (for security & fraud prevention)
- Cookies (session management, preferences)
How we use your information
Service Delivery
Providing client management, payment tracking, and reminder features
Account Management
Creating and managing your account
Communication
Sending service-related notifications
Security
Protecting against fraud and unauthorised access
Improvement
Analysing usage to improve our services
We will NEVER sell your personal data to third parties.
Legal bases for processing (GDPR Article 6)
We process your personal data based on the following legal grounds:
Contract Performance
Processing necessary to provide our services, manage your account, and fulfil our contractual obligations to you.
Account creation, payment tracking, reminder delivery
Legitimate Interests
Processing for our legitimate business interests, balanced against your rights and freedoms.
Service improvement, fraud prevention, security monitoring
Consent
Processing based on your explicit consent, which you may withdraw at any time.
Marketing communications, optional analytics, testimonial usage
Legal Obligations
Processing required to comply with applicable laws and regulations.
Tax records, regulatory compliance, responding to legal requests
Data sharing
We share data with trusted service providers who help operate our service:
| Provider | Purpose |
|---|---|
| iyzico | Payment processing |
| Authentication (OAuth) | |
| Resend | Email delivery |
| WhatsApp (Meta) | Message delivery (Pro) |
AI features and AI providers
Some ClientFlow features use AI — the chat assistant, message suggestions, note summaries and intake-form summaries. When you use one, the text you submit is sent to the AI provider that powers it. We label AI-generated output in the product, so you always know when you are looking at it. Notes, intake answers and messages may include health information about your clients. If an AI feature runs on them — some, such as intake-form triage and the website chatbot, run automatically once switched on — that text is sent to our AI provider. We automatically mask phone numbers, email addresses, card and IBAN numbers, and Turkish and US national ID numbers (pattern-based, so some may be missed), but not names or health details, so use AI features on such text only where your clients' consent covers it.
| Provider | Purpose |
|---|---|
| Anthropic | AI features: assistant, message suggestions, note and form summaries |
| OpenAI | Backup provider, used when another is unavailable |
| Groq | AI features: assistant, message suggestions, note and form summaries |
ClientFlow does not use your data to train AI models. Providers' own data-retention terms differ; the sub-processors page lists each one, together with the safeguards that apply to transfers outside the EEA.
AI output is advisory. Most features show it to you first, and you decide whether to keep, edit or discard it. A few — intake-form triage (summary, urgency, red flags such as a possible health or safety concern, sentiment, suggested actions and lead score), the weekly digest and website-chatbot replies — act on their own and write their result onto the record or reply directly; you can edit or delete a stored result at any time.
See all sub-processors and transfer safeguardsYour rights (GDPR & CCPA)
GDPR Rights (EU Users)
- Access your personal data
- Correct inaccurate data
- Request deletion of data
- Data portability (export)
- Restrict processing
- Object to processing
CCPA Rights (California)
- Know what data we collect
- Delete your data
- Opt-out of data sale (we don't sell)
- Non-discrimination
To exercise your rights, visit Settings or contact us at contact@clientflow.center
KVKK Rights (Turkish Users)
Personal Data Protection Law No. 6698
If you are located in Turkey, you have the following rights under the Personal Data Protection Law (KVKK):
- Learn whether your personal data is processed
- Request information about processing if data is processed
- Learn the purpose of processing and whether data is used accordingly
- Know third parties to whom data is transferred domestically or abroad
- Request correction if data is incomplete or inaccurate
- Request deletion or destruction of data under Article 7
- Object to results of automatic data processing that are against you
- Claim compensation for damages due to unlawful processing
Data Controller
ClientFlow acts as the data controller for your account, billing and website data. For the client data you store in ClientFlow, you are the controller and we act as your processor under our Data Processing Agreement. For KVKK-related inquiries, contact us at contact@clientflow.center.
VERBIS Status
Under KVKK, VERBIS registration is mandatory only for data controllers that exceed the thresholds set by the Personal Data Protection Authority (employee count, balance sheet total, or processing special categories of data as primary activity). ClientFlow currently operates below these thresholds and is therefore not required to register with VERBIS. All other KVKK obligations (lawful processing, data subject rights, breach notification, security measures) apply in full.
To exercise your KVKK rights, contact us at contact@clientflow.center with your request. We will respond within 30 days as required by law.
International data transfers
Our primary data processing occurs in the European Union (Hetzner, Germany). When data is transferred outside the EU/EEA, we rely on the safeguard shown for each recipient on our sub-processors page, which also shows where a safeguard is not yet in force:
EU-US Data Privacy Framework (DPF)
For transfers to US-based sub-processors certified under the DPF, including Google Cloud and Cloudflare.
Standard Contractual Clauses (SCCs)
For transfers to sub-processors not covered by an adequacy decision or DPF certification.
Adequacy Decisions
We rely on EU Commission adequacy decisions where applicable.
You can request information about the specific safeguards used for any particular transfer by contacting us.
Data retention
We retain your data for as long as your account is active. What happens when you delete your account depends on where you do it. In account settings on our website, deletion starts a 30-day grace period once you confirm it by email; you can cancel at any time during that period, and within a day after it ends your account and business data are permanently erased. In the iOS app, deletion takes effect immediately and cannot be cancelled or reversed: your profile and sign-in details are erased at once, and your business data within 3 days. Here are our retention policies, including what we keep after either kind of deletion:
| Data Type | Retention |
|---|---|
| Account data | Erased within a day after the 30-day grace period on our website ends, or immediately when you delete your account in the iOS app |
| Customer records | Erased with your account: within a day after the 30-day grace period on our website ends, or within 3 days in the iOS app |
| Your billing documents (invoices, receipts, estimates) | Erased with your account — the tax-retention duty for these is yours as the issuing business |
| Our own subscription and payment records | Kept anonymised (no personal data) for at least the 7 years our tax law requires |
| Security and admin audit logs | Indefinite — append-only and immutable, so they cannot be altered or erased |
| Record of the consents you gave | Kept after deletion, detached from your account, as proof of consent |
| Record of emails we sent | Kept after deletion as a delivery record, with the address and content removed |
| Accounting ledger entries (only if you set up the accounting features) | Kept after deletion — posted entries are append-only accounting records, so they cannot be altered or erased |
| Newsletter / marketing data | Anonymised 6 years after you unsubscribe |
| Encrypted backups | Deleted data leaves our backups as they rotate out, within 90 days |
| AI conversations and AI results | Copilot conversations: erased about 30 days after you delete them, or when your account is erased. Website-chatbot logs: kept until your account is erased. Intake-triage results: removed with their submission, on consent withdrawal, or when your account is erased |
Children's privacy
ClientFlow is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have inadvertently collected personal data from a child under 16, we will take steps to delete such information promptly. If you believe a child has provided us with personal data, please contact us immediately.
Security
We implement industry-standard security measures
Your data is protected by the security measures described below.
- TLS encryption in transit
- AES-256-GCM encryption at the application layer of session notes, outcome records, integration credentials, payment tokens and two-factor secrets
- OAuth 2.0 and JWT with refresh-token rotation
- Strict per-user data isolation at the application layer
- Payments processed by iyzico (PCI DSS certified) — card numbers are passed through to iyzico and never stored by us
Complaint procedures
If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority.
European Union
Local Data Protection Authority
EU residents can file complaints with their country's DPA.
Turkey
KVKK (Personal Data Protection Authority)
Turkish residents can file complaints at kvkk.gov.tr
United Kingdom
Information Commissioner's Office (ICO)
UK residents can contact the ICO at ico.org.uk
California, USA
California Attorney General
California residents can contact the AG for CCPA violations.
We prefer to resolve concerns directly. Please contact us first at contact@clientflow.center before escalating to authorities.
Third-party links
Our service may contain links to third-party websites, services, or applications. We are not responsible for the privacy practices of these third parties. We encourage you to read the privacy policies of any third-party services you access through our platform. This Privacy Policy applies only to ClientFlow and does not cover external websites.
Changes to this policy
We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' notice via email and/or a prominent notice on our platform before the changes take effect. We encourage you to review this policy periodically. Your continued use of the service after any changes constitutes acceptance of the updated policy.
Current version: 1.5