Privacy Notice
Last updated: September 2026 · Controller: kam
1. Who we are
This Privacy Notice explains how kam ("kam", "we", "us", or "our"), the operator of the B2BFlow platform, handles personal data. kam is the data controller for the personal data described in this notice. If you have questions about this notice or your data, contact us through the Contact page.
2. Data we collect
We collect: (a) Account data — name, email address, password (stored only as a secure hash), company name, and role; (b) Billing-related identifiers — purchase history and subscription status (payment card details are collected and processed directly by our Merchant of Record, Paddle, not by us); (c) Usage and telemetry data — pages visited, features used, log data, device identifiers, IP address, and browser type; (d) Support and communications data — messages you send us and demo or contact-form submissions; (e) Business content you upload — contacts, companies, deals, campaign content, and files you store in the Service.
3. How we use it and legal bases
We use personal data to: (a) create and manage your account and provide the Service (performance of a contract); (b) secure the Service, prevent fraud and abuse (legitimate interests); (c) operate billing and subscription management through our Merchant of Record (performance of a contract, legal obligations); (d) provide customer support (performance of a contract, legitimate interests); (e) improve and develop the Service through aggregated analytics (legitimate interests); and (f) send product updates and marketing where permitted (consent or legitimate interests — you can opt out at any time).
4. Who we share data with
We share personal data only with: (a) Service providers and subprocessors who help us host, operate, analyze, and support the Service, under contractual data-protection obligations; (b) Paddle, our Merchant of Record, for the sale of our products, subscription management, payment processing, tax compliance, and invoicing; (c) professional advisers such as lawyers and accountants where necessary; and (d) public authorities where required by law. We do not sell your personal data.
5. International transfers
Some of our service providers process data in countries outside your own, including outside the UK/EEA. Where data is transferred internationally, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses.
6. Retention
We keep personal data only for as long as needed for the purposes above, including while your account is active and as required by legal, tax, or accounting obligations. When data is no longer needed, we delete or anonymize it.
7. Your rights
Depending on your location, you may have the right to: access your personal data; correct inaccurate data; request erasure; restrict or object to processing; data portability; withdraw consent at any time (without affecting prior processing); and lodge a complaint with your supervisory authority. We respond to verified requests within one month. To exercise any right, contact us through the Contact page.
8. Security
We apply appropriate technical and organizational measures to protect personal data, including encryption in transit, hashed credential storage, access controls, and row-level isolation of customer data. No system is perfectly secure; if a breach affects your data we will notify you and regulators as required by law.
9. Cookies
We use essential cookies required for sign-in and security, and may use analytics cookies to understand product usage. You can manage cookie preferences through your browser settings; blocking essential cookies may prevent the Service from functioning.
10. Changes
We may update this Privacy Notice from time to time. Material changes will be announced in the Service or by email. Continued use after changes take effect constitutes acknowledgment of the updated notice.