Legal · draft for counsel review
Privacy Policy
CROWNPEAK TECHNOLOGY LIMITED (冠峰科技有限公司) explains how ExportFlow handles personal data.
1. Scope and roles
This policy covers the ExportFlow website, accounts and SaaS workspace. We act as a data user/controller for account, billing, security and support data. For customer-uploaded prospect and contact data, we generally act as a service provider/processor following the workspace customer’s instructions.
2. Data we process
We may process account identifiers, email address, authentication records, subscription and payment references, workspace content, prospect and contact records entered by users, AI instructions and outputs, quotation drafts, usage records, device and security logs, and support communications. Stripe handles full payment-card details; ExportFlow should not store them.
3. Purposes and lawful use
We use data to provide and secure the service, authenticate users, maintain workspaces, generate user-requested drafts, administer subscriptions, prevent abuse, respond to support requests, meet legal obligations and improve reliability. Customers are responsible for having a lawful basis to upload and contact prospects.
4. Providers and international processing
ExportFlow currently uses Supabase for database and authentication, Cloudflare for hosting and delivery, Stripe for test-mode billing, and DeepSeek for user-requested AI drafting. These providers may process data outside Hong Kong. We aim to limit fields shared with each provider and will document production regions and safeguards before launch.
5. Retention and security
We retain data only as needed for the purposes above, account administration, disputes and legal obligations. Final retention periods require approval before production. We use access controls, workspace isolation, encrypted transport, restricted service credentials and human review gates, but no system can guarantee absolute security.
6. Your choices and rights
Subject to applicable law, individuals may request access to or correction of their personal data and may ask about deletion or account closure. Direct marketing will require any consent or opt-out mechanism required by applicable law. Requests must be sent to the approved privacy contact shown below once activated.
7. Changes
We may update this policy as the service, providers or legal requirements change. Material updates will be identified by a revised effective date and, where appropriate, an in-product notice.