Legal and trust
Privacy policy
A plain description of the personal data the application handles and how it is protected.
Personal data the application handles
- Staff names, work email addresses and optional phone numbers, for sign-in and alerts.
- Role and branch assignment, so access can be limited correctly.
- Activity records: who reported, worked on, approved, verified or closed something, and when.
- Photos and evidence uploaded by staff, which may incidentally include people.
- Vendor contact details you enter, and shift and attendance records if you use the workforce features.
What it is not used for
- We do not sell personal data or share it for advertising.
- We do not use your operational records to train AI models.
- AI assistance is opt-in per organisation, suggests only, and is reviewed by a person before anything is saved.
- We do not send messages to staff or customers on your behalf unless you configure and authorise it.
Controller, retention and your rights
- Your organisation is the data controller; BranchFlow acts as processor.
- Hosting and AI subprocessors are listed on request and in your agreement.
- Retention periods for records, evidence and audit history are set per organisation.
- Access, correction and deletion requests are raised and tracked in the application.
- Cross-border transfers are described in your customer agreement.
What we will not claim on this page
- Contact us with any privacy question and we will answer directly.
- Deletion requests can already be raised and tracked inside the application, and the timescale is set in your customer agreement.
How your data is handled
How access and records are handled
Each organisation's records are separated in the database, and people only see the branches they are assigned to. Status changes, approvals, rejections and verifications are recorded with who did them and when. We do not claim any external certification or audit at this stage; if you need a formal security review, ask us and we will tell you exactly what exists today.