Privacy Policy

1. Who we are and what this policy covers

TrueFlow is operated by Trueflow Limited (we, us or our). This policy covers our website, web application, WhatsApp service and related support. Contact us at hello@gettrueflow.com about privacy or your information.

TrueFlow helps people, families and businesses organise financial records, plans and important dates. Features depend on your plan, permissions and the services currently available. This policy also covers people whose details are submitted through a TrueFlow form or added to a workspace by its authorised users.

2. Our role and your workspace’s role

We decide how account, billing, security and service-support information is used to run TrueFlow. For client, employee, household and form-response information that a workspace chooses to collect, the workspace may decide the purpose and act as the data controller; we process that information to provide the service on its instructions. The relevant organisation should give its own privacy notice and have authority to collect and share the information.

If an organisation controls the record you want to access, correct or delete, contact its workspace owner first. You can also contact us and we will help identify the appropriate route. A workspace’s notice does not remove our own obligations for processing we control.

3. Information we handle

Information you provide may include your name, email, WhatsApp or phone number, profile image, workspace or business details, role and invitations; receipts and uploaded images; expense, income, invoice, payment, budget, inventory, savings-goal and tax-estimate records; client and contact details; reminders and relevant dates; form answers and attachments; chat messages, corrections and support enquiries. Optional voice features process the audio you submit and its transcription.

When you use the service, we may receive IP addresses, device/browser details, request and error logs, authentication/session information, timestamps, permission changes and activity/audit records. If you opt into browser notifications, we handle the browser’s push subscription and delivery information. Your browser also stores session, appearance and application-cache information.

Our payment processor handles payment credentials at checkout. TrueFlow receives information needed to reconcile your purchase, such as payer details, transaction references, amount, currency, status, billing period and subscription identifiers. Do not send passwords, verification codes, full card details, bank login credentials or unnecessary sensitive information in chat, uploads or support messages.

4. Why we use information

We use information to create and authenticate accounts, link authorised channels, provide and store your records, apply workspace permissions and plan limits, process requested AI assistance, send requested reminders or service messages where delivery is available, manage subscriptions, respond to support and rights requests, investigate misuse, maintain audit trails and meet applicable legal obligations.

Our lawful bases depend on the activity: performing our agreement with you; legitimate interests in operating, securing and improving the service where those interests do not override your rights; compliance with legal obligations; and consent where required for optional communications, browser permissions or particular sensitive-data processing. We do not treat acceptance of our Terms as blanket consent to every use of personal information. You can withdraw consent for consent-based processing; that does not undo lawful processing already completed.

5. AI, images and voice

When you request AI assistance, relevant messages, images, uploaded documents, audio/transcripts and authorised workspace context may be sent to our configured AI providers, including Anthropic and OpenAI, to generate the requested response or extraction. Only use these features for information you are authorised to share. Manual features remain an option where available.

AI can make mistakes. Check extracted amounts, dates, identities and suggested actions before relying on them. Provider processing and retention are subject to the applicable service arrangement; this policy does not promise that every provider immediately deletes submissions or that provider retention is zero. Contact us for information about the provider arrangement relevant to your request. We do not make lending, employment or similar legally significant eligibility decisions about people solely through TrueFlow AI.

6. Workspace access, invitations and public forms

Workspace owners and authorised members can access information according to their roles and permissions. An owner may change access or remove a member. Removing a member does not automatically erase the records that person created for the workspace. Invitations use the recipient’s name, email and proposed access; membership begins only after the applicable acceptance steps.

Public forms collect the questions and files chosen by their workspace owner. Answers may be reviewed by authorised members and, where configured and approved, converted into workspace contact or business records. A published form link can be used by people who receive it; avoid entering information beyond what is needed. Ask the form owner how they intend to use your answers.

Authorised support personnel may access relevant account or workspace information to investigate a problem, enforce security or carry out an authorised support request. Use of support tools and access to records should be limited to those purposes. We do not promise that administrators can never access data required to operate the service.

7. Service providers and other disclosures

We share information needed to operate the service with providers for hosting and deployment (such as Vercel and Railway), authentication/database/storage (Supabase), AI (Anthropic and OpenAI), WhatsApp messaging (Meta/WhatsApp and Twilio), configured email delivery (such as Resend and our authentication-email provider), checkout (currently Flutterwave where enabled), and technical support/security. A provider may be involved only when the relevant feature or channel is used. External font requests can also disclose browser/IP information to Google Fonts.

We may disclose information to comply with a lawful request, protect people or the service, investigate fraud, or manage a business transfer with appropriate safeguards and notice where required. We do not sell your personal information. Other websites and providers have their own privacy notices; this policy does not govern their independent processing.

8. Processing outside Nigeria

Cloud, messaging, AI and payment providers may process information in countries outside Nigeria. Applicable law requires a lawful transfer basis and appropriate protection. Where required, we must use an adequacy basis, contractual safeguards or another permitted mechanism for the relevant transfer. Contact us for information about the applicable destination and safeguards; using TrueFlow is not blanket consent to unrestricted international transfers.

9. Cookies, browser storage and notifications

We use session cookies or similar storage to keep you signed in, and local storage to remember choices such as light/night mode. The application may cache interface assets or pages for installation/offline use. Clear site storage on a shared device and sign out when finished. Browser controls can remove cookies and cached information, but some features may then stop working.

Browser notification permission is optional and can be revoked through browser settings. You can decline optional permissions and contact us about communication preferences. Required account, billing and security notices may still be sent where appropriate. If we introduce non-essential tracking that requires consent, we will provide the relevant notice and choice before enabling it.

10. How long information is kept

We retain account and workspace information while needed to provide the service and for relevant legal, accounting, security and dispute purposes. Workspace records, form answers and attachments follow the workspace’s authorised use and deletion instructions, subject to those obligations. Invitation, support, technical-log and audit information is retained for the relevant operational/security purpose rather than indefinitely merely because storage is available.

Account closure, subscription cancellation, removal from a team and deletion of a particular record are different actions. A record may remain where an organisation has a lawful reason to retain it, and restricted backups may expire through their recovery cycle. Third-party retention can also differ. Contact us for the retention period and deletion route applicable to your data. We do not promise immediate removal from all systems or a fixed deletion period that has not been established for that category.

11. Security

We use technical and organisational measures intended to protect information, including authentication, access restrictions and service-provider safeguards. No online service can guarantee absolute security. Keep your credentials and verification codes private, review teammate access and report suspected compromise promptly. We will assess security incidents and notify affected people and regulators where applicable law requires.

12. Your privacy rights

Subject to applicable law and its conditions, you may request information about processing, access and a copy of your personal data, correction, deletion, restriction, portability, objection to certain processing, withdrawal of consent, and human review of a solely automated decision with legal or similarly significant effects. We may verify identity proportionately before disclosing or changing information. Some requests may be limited by another person’s rights or a legal retention obligation; we will explain an applicable limitation.

Email hello@gettrueflow.com with the subject “Privacy request”, the account email/phone or relevant form/workspace, and what you want us to do. Do not include passwords or verification codes. You may complain to the Nigeria Data Protection Commission at ndpc.gov.ng, and to another competent authority where applicable. You do not have to complete our internal process before exercising a statutory complaint right.

13. Children and changes to this policy

TrueFlow accounts are intended for adults aged 18 or over who can enter an agreement. Household or business records may include another person’s details; the uploader must have an appropriate lawful basis, including any required guardian consent for a child’s information. Do not use public forms to collect unnecessary sensitive information about children. Contact us if you believe a child has created an account or information was submitted without appropriate authority.

We may update this policy as the service or legal requirements change. We will show the updated date and provide an appropriate notice for material changes. If a change requires new consent, an updated notice alone does not supply that consent.