Privacy notice for the Clientflow portal
Published 5 September 2026. Last updated 6 September 2026.
This notice covers portal.clientflow.ai, the portal where our clients read and sign proposals, pay deposits, track their project and send us feedback. Our website, clientflow.ai, has its own privacy policy. This one is written to be read in five minutes.
Who we are
Clientflow Ltd, company number 15042186, registered in England and Wales at Limitless Martial Arts, Unit 5, The Old Dairy, Empress Road, Southampton, England, SO14 0YT. We are the controller of the personal data in the portal. Questions and requests: hello@clientflow.ai. Registered with the Information Commissioner's Office as a fee payer: ICO reference 00015400575.
Who this covers
People at a client or prospective client who are invited into the portal: the person who signs, their colleagues who collaborate, and anyone named in the notes we keep about a deal. Your company gave us your name, work email, phone number and role, usually through the person who signed or the contact we set the project up with, and we sent you the invitation.
What we collect, why, and on what basis
| What | Where it comes from | Why | Lawful basis |
|---|---|---|---|
| Your name, work email, phone number, role and company, and your company's address | You, or your company when the project was set up | To give you a sign-in, show you the right project and reach you about it | Performing our contract with your company; our legitimate interest in running a business relationship |
| Sign-in records: the magic-link emails we send you, the session cookie on your device, and the IP address and browser of each session | Created when you sign in | Passwordless sign-in and keeping sessions secure. A device that comes back after 30 days without a visit is signed out | Legitimate interest in security |
| What you put in the portal: answers to scoping questions, comments on proposals, feedback items and anything you attach, files you upload, approvals you give | You | To scope, propose, build and support your project | Performing the contract |
| Signing evidence: the name you type, your email, the exact version you signed and a cryptographic hash of it, the time in UTC, your IP address and browser, and the one-time code you enter when you accept a proposal | Created when you sign a proposal or an agreement | To make your acceptance evidential and to give both of us a copy of exactly what was agreed | Performing the contract; our legitimate interest in being able to prove what was agreed |
| Payment records: the amount, method, payment reference, receipt number and status of each deposit or balance | Created when you choose to pay by bank transfer in the portal, and when we mark the transfer received | To take the deposit and balance and issue receipts. A bank transfer goes from your bank to ours; we never see your account details. When card payments start they will go through Stripe, and this notice will say so first | Performing the contract; legal obligation to keep accounting records |
| Proposal views (from when proposals are published in the portal): which contact opened which proposal version, when, and whether on a phone or a desktop | Created when you open a proposal | To time our follow-up. It is internal only: we do not show it to you, quote it to you, or record how long you spent on any section | Legitimate interest in running our sales process |
| The pre-call note (from when deals live in the portal) on your business: what you told us when you enquired, plus public information such as your website and Companies House entry | You, and public sources | So a first call is useful. You can ask for a copy | Legitimate interest in preparing for a call you asked for |
| Call notes and correspondence we attach to a deal, including information you share by email or in other correspondence | You, and us | So the proposal reflects what was discussed | Legitimate interest in keeping an accurate record |
| The activity log: an append-only record of what happened in the portal, who did it and when | Created by the portal | It is the contract log: every approval and signature is in it. The portal cannot edit or delete an entry; only a database migration can, and those are recorded in our source history | Performing the contract; legitimate interest in an accurate record |
| Technical logs and error reports: the address, browser and URL of requests for one day (seven on a paid database plan); error reports with the page and technical detail, with secrets removed and no cookies or IP address | Created by our hosting and monitoring providers | To keep the portal running and fix faults | Legitimate interest in security and reliability |
You do not have to give us anything. But without a name and work email we cannot give you a sign-in, and without your typed legal name we cannot record a signature, so a proposal cannot be accepted through the portal.
What we do not do
No advertising, no analytics trackers, no cookies beyond the two the portal needs (your session, and a timestamp for the 30-day inactivity rule). We do not track whether you opened or clicked an email. We do not sell or share your data with anyone for their own purposes. The portal has no live chat service. Client communication uses proposal comments, project questions and requests, which are stored in the portal as described above. Unsent discussion text is saved in this browser tab to recover from a reload or interrupted sign-in. It is tied to your account and the discussion, and is not sent to us until you submit it. Drafts clear when sent or discarded; after 24 hours they stop restoring and are removed the next time a draft is saved. The draft stays only in the browser’s tab session. Files, sign-in codes and signature fields are not saved this way.
Where your data lives
The portal's database, sign-in service and files are hosted in London (Supabase, AWS
eu-west-2), and the portal's own code runs in London (Vercel); the one small step that
refreshes your session on each request runs at Vercel's network edge nearest to you. Error reports go to Sentry's
EU region in Frankfurt. The emails we send through Resend are stored by Resend in the United
States for 30 days. Card payments, when they start, will go through Stripe; a bank transfer today
involves no provider beyond our bank. Each provider, what it
processes, where, and the legal safeguard for anything that leaves the UK, is listed on our
subprocessors page; transfers outside the UK rely on the UK Addendum to the
EU standard contractual clauses, the International Data Transfer Agreement, or the UK–US data
bridge where the provider states that it is certified under it.
How long we keep it
Our retention policy has a row for every class of data. In short: your account and what you put in the portal for as long as your company is a client and for a period after; the signing evidence and the activity log for six years after the contract ends, because they are the record of what was agreed; sign-in logs for a day; emails and error reports for 30 days; proposal views and pre-call notes for twelve months after a deal closes without a project.
Your rights
You can ask us for a copy of your personal data, ask us to correct it, ask us to delete it, restrict or object to how we use it, and ask for a portable copy. Write to hello@clientflow.ai; we answer within one month. Two things we will keep even if you ask us to delete the rest: the signing evidence and the activity log for a contract that is still enforceable, and records we must keep by law. If we delete your account, your name is removed from the activity log and the entries stay. If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office, ico.org.uk, 0303 123 1113.
Changes
We change this notice when the portal changes what it collects, and we change it first. Each version carries the date it was published, and the headings stay the same so you can compare.