Privacy policy

Clientflow is a trading name of Clientflow Ltd, a company registered in England and Wales, company number 15042186, with its registered office at Limitless Martial Arts, Unit 5, The Old Dairy, Empress Road, Southampton SO14 0YT.

Clientflow Ltd is the data controller for the personal information described in this policy. You can reach us at hello@clientflow.ai.

When you send an application. The form collects your name, work email, company, role, what you tell us about the workflow you want to fix, your timing and your budget range. Your role and how you found us are optional. Everything else is needed in order to send the form. No law or contract requires you to give us any of it, but we cannot reply to an application that is not complete.

The application also carries the address of the page you first landed on and the site you arrived from, so we can tell which of our writing brings people here. That is read from your browser when the page loads, and put into the email when you send the form. It is not stored on your device and not kept anywhere else.

When you visit the website. Our hosting provider processes your IP address and browser user agent in order to route, secure and log requests, and keeps those runtime logs for one day. The application form also holds your IP address in memory for sixty seconds, so that the same address cannot submit the form over and over. It is not written down.

Emails and notes. We keep the correspondence and notes that follow from an enquiry or a client relationship.

We use your application to reply to you and to work out whether Clientflow is a sensible fit. Our lawful basis is legitimate interests, and the interest is running a small studio by responding to people who ask us to. We do not use it for marketing.

Where we go on to work together, we use your information to prepare, deliver and support what we have agreed. Where our agreement is with you as an individual, our lawful basis is performance of a contract. Where it is with your company, our lawful basis for handling your details is legitimate interests, and the interest is delivering the work we were engaged to do.

We use server logs and the form rate limit to keep the site working and to prevent abuse. Our lawful basis is legitimate interests, in keeping a small website secure and available.

We keep accounting and business records where the law requires it. Our lawful basis is legal obligation.

We use Google Analytics to see which pages people read and where they arrived from. Our lawful basis is legitimate interests, and the interest is knowing which of our writing is worth doing. Storing the analytics cookies is permitted by the statistical purposes exception in the Privacy and Electronic Communications Regulations, which is why you are told about it and can switch it off at any time rather than being asked to agree to it first.

We do not make decisions about you by automated means, and we do not profile you.

We use Google Analytics to count how many people visit each page, and to see where they arrived from. We use it for two things only: to work out which of our guides are worth writing, and to see which search engines and AI assistants send people here. It is on when you arrive, and you can turn it off at any time using the control below.

What is stored on your device. Google Analytics stores two cookies in your browser, named _ga and _ga_RP2TDH7H3X. They hold a randomly generated number that lets Google Analytics recognise the same browser on a later visit, for as long as the cookies last. They do not contain your name, your email address or anything you have typed, and we never use them to work out who you are. We have set them to expire after sixty days.

What we can see. The pages you looked at, the page you arrived on, the site or app you came from, an approximate location, your device type and browser, and whether you sent us an application. If you did, we can see which timing and budget options you chose. We do not send your name, your email address, your company name, or anything you wrote in your own words, to Google Analytics.

What we do not do. We do not use Google Analytics for advertising. Advertising storage, advertising personalisation and the sharing of user data for advertising are switched off permanently in the code that loads it, and we have no Google Ads account linked to it. We do not use it to identify, track or profile individual visitors.

What Google may do with it. We have switched off all four of Google’s data sharing settings, including the one headed “Google products and services”, and we have switched off Google Signals. With those off, Google acts as our data processor under the Google Ads Data Processing Terms and, in Google’s own words, the data is only used to provide and maintain the Analytics service. Google also reserves the right to use it as far as necessary to keep that service running and secure, and that reservation applies whatever our settings are. Google is not permitted to use it to improve Google’s own products, and we do not share it with anyone else.

Where it goes. Google states that Google Analytics does not log or store IP addresses from visitors in the United Kingdom, the European Union or Switzerland. For visitors elsewhere, Google says it collects IP addresses to run the service, never links them to a person, and discards them after use. The data is processed by Google, which may involve a transfer to the United States, and Google relies on the UK Extension to the EU-US Data Privacy Framework for that transfer.

How long it is kept. Two months, which is the shortest period Google Analytics allows. After that Google deletes the event and user level records automatically. Google's aggregated reports, which do not identify anyone, are not affected by that setting.

Turning it off. Use the control below. If you turn it off, we stop loading Google Analytics in this browser and delete those two cookies straight away. To remember that you asked us to stop, we store an item in your browser called cf-analytics. Dismissing the notice about analytics also stores cf-notice-seen, so the notice does not come back. Nothing else is stored once analytics is off.

We store your choice of light or dark appearance, as cf-theme, so the site looks the way you left it. The site checks for that choice each time a page loads. It stays until you clear this site’s data, it is never sent to us, and it does not identify you.

On a guide, we note in your browser that the summary has already been shown, as cf-summary-seen, so the same short animation does not repeat while you are reading. That note is deleted when you close the tab.

When you dismiss the notice about analytics, we note that in your browser as cf-notice-seen, so it does not come back. It stays until you clear this site’s data, it is never sent to us, and it does not identify you.

Apart from these and the analytics described above, the website stores nothing on your device. There are no advertising cookies, no tracking pixels, and no third party scripts other than Google Analytics.

Three providers handle what you send us through the website. Each uses its own subprocessors to run its service, and each publishes that list. Nobody else acts for us.

• Vercel hosts the website. Vercel Inc is based in the United States.

• Resend sends the email that carries your application to us. Resend is based in the United States.

• Google provides the analytics described above, as our processor. Our agreement for Google Analytics is with Google Ireland Limited, in Dublin, which uses Google LLC in the United States to run the service.

We do not sell personal information and we do not share it with advertisers. We share it only where it is needed to provide a service, to meet a legal obligation, or to establish or defend a legal claim.

Separately from the website, our accountant and HM Revenue and Customs receive the accounting records we are required by law to keep.

This policy covers the website and enquiries made through it. Where we work together on a project, the engagement agreement governs how information is handled in that work.

Information you send us is processed in the United States, so it is transferred outside the United Kingdom.

Resend stores message content, delivery logs and related records in the United States and keeps them for thirty days, and its backups hold a copy for a further seven days. Our contracts with Vercel and Resend incorporate the Standard Contractual Clauses as amended by the Information Commissioner’s international data transfer addendum, and both companies certify to the EU-US Data Privacy Framework and its UK Extension.

Google Analytics works differently. Our agreement for it is with Google Ireland Limited, in a country the United Kingdom treats as adequate, and Google relies on its own certification to the UK Extension of the EU-US Data Privacy Framework when it moves the data on to the United States. You can ask us for a copy of the safeguards by writing to hello@clientflow.ai.

The website itself is served from a content delivery network, so the page you are reading may be delivered from a server nearer to you than the United Kingdom.

• Applications and the emails that follow from them: while we are in contact about a possible or actual project, and for two years after our last contact.

• Email sent through Resend, including its content and delivery logs: thirty days, after which Resend deletes it. Its backups hold a copy for a further seven days.

• Our hosting provider's runtime logs: one day.

• The IP address used by the form's rate limit: sixty seconds, in memory, never written to storage.

• Google Analytics records: two months, the shortest period Google allows.

• Records we are required to keep for accounting or legal reasons: as long as the law requires, and then deleted.

You have the right to ask us for a copy of the personal information we hold about you, to have it corrected if it is wrong, and to have it deleted. You can ask us to restrict how we use it, and you can object to our using it where we rely on legitimate interests, which covers most of what is described above. Where we rely on your consent for anything, you can withdraw it at any time, and that does not affect what we did before you withdrew it.

You also have the right to data portability, which means asking us for the information you gave us in a common electronic format, or asking us to pass it to someone else. That right applies where we hold information under a contract with you or with your permission. It does not apply to enquiries, because we rely on legitimate interests for those.

Your right to object. You have the right to object at any time to our using your information where we rely on legitimate interests, which covers most of what is described in this policy. Write to hello@clientflow.ai and we will stop, unless we have compelling grounds to carry on that override your interests.

To exercise any of these, write to hello@clientflow.ai. We will respond within one month. If a request is complex, or if you make several at once, the law lets us take up to two further months. If that happens we will tell you inside the first month and say why.

If you are unhappy with how we have handled your personal information, please tell us first, by writing to hello@clientflow.ai with “Data protection complaint” in the subject line. You have a right to complain to us under section 164A of the Data Protection Act 2018. We will acknowledge your complaint within thirty days, look into it, and tell you the outcome.

You also have the right to complain to the Information Commissioner’s Office under section 165 of the Data Protection Act 2018. You can do that at ico.org.uk/make-a-complaint or by calling the ICO helpline on 0303 123 1113. Complaining to us first does not stop you complaining to the ICO.

Questions about this policy can be sent to hello@clientflow.ai. We update it when the website, our services or the law change.