Privacy Notice

certflows LLC (trading as certflows.ai) decides how and why personal data is processed on this platform, which makes us the controller. For privacy questions, email admin@certflows.ai.

Where our customers upload tenant and broker contact details, they determine that content and we process it on their behalf to deliver the service.

• Account data (name, work email, company name, role, login credentials managed by our authentication provider) — to create and secure your account and administer your team. Legal basis: performance of our contract with you.
• Customer content (property and tenant records, tenant and insurance broker contact details, leases, certificates of insurance, notes) — to run compliance checks, reminders and reporting. Legal basis: contract performance and our legitimate interest in providing the service.
• Communications data (support messages, demo and contact requests, email delivery status) — to respond to you and prove notices were sent. Legal basis: contract performance and legitimate interests.
• Usage and device data (pages visited, actions taken, IP address, browser and device identifiers, error logs) — for security, fraud prevention, troubleshooting and product improvement. Legal basis: legitimate interests.
• Marketing preferences — to send product updates where you have opted in. Legal basis: consent, which you can withdraw at any time.

We also keep records we are legally required to keep, such as tax and accounting records. Legal basis: legal obligation.

Uploaded leases and certificates are sent to our AI processing subprocessor to extract coverage limits, dates and contacts. Extracted values are suggestions that your team reviews; we do not make legal or financial decisions about individuals automatically.

• Service providers and subprocessors — cloud hosting and database, document storage, AI document extraction, email delivery, error monitoring and analytics.
• Merchant of Record — Paddle.com, which handles the sale of our product, subscription management, payments, tax compliance and invoicing.
• Professional advisers — legal, accounting and insurance advisers where needed.
• Authorities — where required by law or to establish or defend legal claims.
• Successors — an acquirer, in the event of a merger or sale of the business.

We do not sell personal data.

We are based in the United States and our providers may process data in the US and other countries. Where data is transferred from the UK or EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

Account and customer content is kept for as long as your account is active. Deleted locations and tenants stay recoverable for 30 days, then are removed. After account closure we delete or anonymise customer content within 90 days, except records we must keep for legal, tax or dispute-resolution reasons. Security and delivery logs are kept for up to 12 months.

We use appropriate technical and organisational measures, including encryption in transit and at rest, row-level access controls that separate each company's data, private document storage with short-lived signed links, role-based permissions and audit logging of key actions.

Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, to receive a portable copy, to withdraw consent, and to complain to your data protection authority. UK and EEA residents can complain to their supervisory authority.

Email admin@certflows.ai to exercise a right. We respond within one month.

We use essential cookies and local storage to keep you signed in and to keep the service secure — these cannot be switched off. We use a limited amount of analytics storage to understand product usage. We do not use advertising or cross-site marketing cookies. You can clear or block cookies in your browser settings, though sign-in will stop working.

We will update this notice as the service changes and will tell you about material changes by email or in-app.