Privacy Policy
Last updated: 16 May 2026 · Effective: 16 May 2026
1. Who we are
InventoryFlo (the "Service") is operated by Managa Digital LTD("we", "us", "our"), a company incorporated in England and Wales (registered address: [REGISTERED ADDRESS]; Companies House number: [COMPANY NUMBER]).
For data-protection enquiries, contact privacy@inventoryflo.com.
2. Scope
This Policy describes the personal data we process when you visit our website, sign up for an account, use the Service, or otherwise interact with us. It applies to data processed in our capacity as data controller.
When you (our customer) use the Service to manage your own inventory operations, we act as a data processor on your behalf with respect to your end-users' data; the terms of that processing are governed by our Data Processing Agreement.
3. Personal data we collect
3.1 Account data
- Name, email address, password (stored hashed with bcrypt)
- Organization name, role within the organization
- Billing information processed by Stripe (we never store full card details)
3.2 Usage data
- IP address, browser type, device type, OS, language
- Pages visited, features used, click events (PostHog)
- Error reports including stack traces (Sentry)
3.3 Operational data
- Inventory data you enter (items, stock movements, suppliers, etc.) — see DPA
- Audit logs of actions taken within your organization
3.4 Communication data
- Support tickets, email replies, in-app messages
4. Lawful basis (UK / EU GDPR Article 6)
| Processing activity | Lawful basis |
|---|---|
| Providing the Service | Performance of contract (Art 6(1)(b)) |
| Billing and tax records | Legal obligation (Art 6(1)(c)) |
| Security and fraud prevention | Legitimate interests (Art 6(1)(f)) |
| Product analytics | Consent (Art 6(1)(a)) |
| Marketing emails | Consent (Art 6(1)(a)) — opt-in required |
5. How we use your data
- To create and manage your account
- To deliver the Service, including syncing inventory, sending notifications, supporting integrations
- To bill you and comply with tax law
- To detect and prevent abuse, fraud, and security incidents
- To improve the Service via aggregated analytics
- To communicate transactional information (account changes, billing receipts, security alerts)
- To respond to support requests
6. Data storage and location
Customer data is stored in the European Union, specifically in Roubaix, France, on infrastructure operated by OVH SAS. Backups are retained in the same region.
7. Subprocessors
We use the following subprocessors:
| Subprocessor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| OVH SAS | Hosting, database, backups | France (EU) | Intra-EU |
| Stripe Payments Europe Ltd | Billing and payments | Ireland (EU) | Intra-EU |
| Functional Software Inc. (Sentry) | Error tracking | USA | EU Standard Contractual Clauses |
| PostHog Inc. | Product analytics | EU instance preferred (Frankfurt) | Intra-EU when using EU instance |
| Resend Inc. | Transactional email | USA | EU Standard Contractual Clauses |
The current list of subprocessors is maintained at this URL and we will provide reasonable notice before adding or replacing a subprocessor.
8. International transfers
Where personal data is transferred outside the UK or the European Economic Area (EEA), we rely on adequacy decisions where available or on the European Commission's Standard Contractual Clauses (2021/914) supplemented by the UK International Data Transfer Addendum.
9. Data retention
| Category | Retention period |
|---|---|
| Account data (user, email, name) | Lifetime of subscription + 30 days after cancellation |
| Inventory and operational data | Lifetime of subscription + 30-day export window |
| Financial records (invoices, billing) | 7 years (UK Companies Act 2006, s.388) |
| Audit logs | 2 years |
| Backups | 30-day rolling, then purged |
| Error reports (Sentry) | 30 days |
| Analytics (PostHog) | 12 months, anonymised after 30 days |
| Marketing emails | Until you unsubscribe |
10. Your rights (UK / EU GDPR)
You have the right to:
- Access the personal data we hold about you
- Request rectification of inaccurate data
- Request erasure (subject to legal obligations such as tax-record retention)
- Object to or restrict processing
- Receive your data in a portable format (account → Export)
- Withdraw consent for processing based on consent
- Lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or your local EU supervisory authority
Exercise any of these rights by emailing privacy@inventoryflo.com. We respond within 30 days.
11. Cookies and similar technologies
We use the following categories of cookies:
- Essential: authentication, session, CSRF protection, Stripe checkout. Always on.
- Functional: theme, language preference. Always on (no personal data).
- Analytics: PostHog. Consent required.
- Diagnostics: Sentry error tracking. Legitimate interest, disabled on opt-out.
Manage your preferences via the cookie banner shown on first visit, or at any time via the "Cookie settings" link in the footer.
12. Security
- TLS 1.3 in transit
- AES-256 at rest (OVH-managed encryption)
- Passwords stored with bcrypt (cost factor 12)
- Two-factor authentication (TOTP) available
- Role-based access control within organizations
- Regular security reviews and dependency scanning
In the event of a personal-data breach affecting your information, we will notify the UK ICO within 72 hours where required, and notify affected individuals without undue delay where there is a high risk to their rights and freedoms.
13. Children
The Service is intended for use by businesses and is not directed to individuals under the age of 16 (EU) or 13 (UK / US). We do not knowingly collect personal data from children.
14. Changes to this Policy
We may update this Policy from time to time. When we do, we will update the "Last updated" date at the top and, for material changes, notify you by email or in-app at least 14 days before the change takes effect.
15. Contact
Managa Digital LTD
[Registered address]
Email: privacy@inventoryflo.com