Last updated: September 2026
Who controls the information
SMEFLOW controls information used to provide accounts, subscriptions, security and support. Each subscribing organisation controls the customer and business information its users place in its workspace; SMEFLOW processes that information on the organisation’s instructions.
Information we process
We process account details, workspace configuration, customer and operational records entered by users, subscription and billing references, support communications, audit events, device and security logs, and service usage information.
Why we process it
We use information to provide and secure the service, authenticate users, operate requested workflows, administer subscriptions, deliver support, prevent abuse, meet legal obligations and improve reliability. Marketing communication requires an appropriate lawful basis and applicable consent.
Sharing and subprocessors
Information may be processed by vetted hosting, email, monitoring, storage and payment providers needed to operate SMEFLOW. We do not sell tenant business data. A current subprocessor list and applicable data-processing terms will be supplied to customers before paid production use.
Retention and deletion
Account and tenant data is retained while the service is active and for defined legal, security and recovery periods afterwards. Workspace administrators may request export or closure. Backups expire according to the backup retention schedule.
Your choices and rights
Depending on applicable law, individuals may request access, correction, restriction, objection or deletion. Requests concerning a tenant’s customer data should normally be directed to that tenant. Contact the service operator using the support details provided in your agreement.
Security and international processing
SMEFLOW uses access controls, tenant separation, private file storage, audit logging, encryption in transit and operational safeguards. Information may be processed where approved providers operate, subject to contractual and legal safeguards.
Changes
Material changes will be communicated through the service or the registered account email. This notice must be reviewed by qualified counsel and updated with the operator’s legal name, address, contact details and confirmed subprocessors before public launch.