Privacy notice

How OpsFlow Management uses personal data

Last updated: 15 July 2026. This notice should be reviewed by a qualified legal adviser before taking live customer payments.

Who we are

OpsFlow Management is operated by OpsFlow Group LTD, trading as OpsFlow Management. Registered office: [registered office address]. Company number: [company number]. Contact: [email protected]. ICO registration number: [add if applicable].

When we are controller and processor

We are the controller for account, billing, subscription, website, security and support data. Where a customer uses OpsFlow Management to store their own business records, such as their customers, staff, suppliers, invoices, job sheets, inventory and rental records, the customer is normally the controller and OpsFlow Group LTD acts as processor for that workspace data.

Personal data we collect

• Account details, including name, email address, business name, role, login details, password hash and authentication records.
• Company workspace data, including company settings, logo, VAT settings, email reminder settings, subscription status and audit history.
• Operational records entered by users, including CRM records, calendar events, inventory, rental desk entries, quotes, invoices, job sheets, payroll records, delivery notes, notes and attachments.
• Billing information from Stripe, including Stripe customer IDs, subscription IDs, price plan, payment status and invoice/payment references. Full card numbers are handled by Stripe and are not stored by OpsFlow Management.
• Technical and security information, including IP address, browser information, device information, login events, error logs, audit logs and cookie preferences.
• Support messages, emails, attachments and any information you send when asking for help.

Why we use personal data

• To create and manage user accounts and company workspaces.
• To provide the calendar, CRM, inventory, quote, invoice, accounting, payroll and rental desk tools.
• To process subscriptions, payments, trials, cancellations and plan access.
• To send service emails, document emails, reminders, account notices and support replies.
• To secure the service, prevent fraud, investigate misuse and maintain audit logs.
• To comply with legal, accounting, tax, regulatory and dispute obligations.
• To improve the reliability and performance of the website and service.

Lawful bases

We rely on contract where we need data to provide OpsFlow Management, legitimate interests for security, support, service improvement and business administration, legal obligation for tax and compliance records, and consent for optional cookies or optional marketing where used.

Sharing data

We do not sell personal data. We may share data with trusted service providers that help us run OpsFlow Management, such as hosting providers, database/back-up services, Stripe for payments, email delivery providers, domain/DNS services, support tools and accounting tools. If a workspace administrator connects Xero or another integration, data may be shared with that service according to the administrator's settings.

International transfers

Some providers may process data outside the UK. Where this happens, we use appropriate safeguards where required, such as adequacy regulations, approved contractual terms or the provider's lawful transfer mechanism.

How long we keep data

Workspace data is kept while the account is active. If a subscription expires or is cancelled, we may keep the workspace for a reasonable recovery period so the customer can restore access. Some records, including invoices, audit logs, tax/accounting records, security logs and dispute records, may be kept longer where needed for legal, tax, security or dispute reasons.

Your rights

Individuals may have rights to be informed, access their data, correct inaccurate data, request deletion, restrict processing, object to processing, move data and withdraw consent. Requests can be sent to [email protected]. If your data is held inside a customer's workspace, we may need to refer the request to that customer as the controller.

Security

We use access controls, password hashing, HTTPS in production, audit logs, role-based permissions, subscription checks and operational safeguards. No online service can be guaranteed completely secure, but we work to protect customer data and investigate suspected security issues promptly.

Children

OpsFlow Management is a business service and is not intended for children.

Complaints

Please contact us first so we can try to resolve the issue. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.