Privacy Policy

1. Who we are

PrimeFlow is a multi-tenant SaaS ERP service for supply-chain and wholesale businesses, operated at https://www.primeflow.so.

For questions about this Policy or personal data matters, email privacy@primeflow.so. For general product support, contact support@primeflow.so.

2. Scope

This Policy applies to the following people and situations:

• Visitors to our marketing website (for example primeflow.so);
• Authenticated users who sign in and use PrimeFlow ERP / workspace features (for example organisation members and admins);
• Storefront customers who log in or place orders via a merchant organisation’s shop (for example {slug}.primeflow.so/shop).
• Merchant organisations may provide their own privacy notices or consent mechanisms to end consumers; those notices are the merchant’s responsibility and do not replace this Policy’s description of data we process as platform operator.

3. Data we collect

Depending on how you use the Service, we may process the following categories of data. Not every category applies to every user.

• Account and identity: authentication and identity data processed via Clerk, such as name, email, auth identifiers, and data related to sign-in / sessions.
• Organisation and business data: business content you or your organisation enter or import into the system, such as contacts, customers and suppliers, orders, inventory, finance documents, reports, and (if the organisation enables the relevant modules) human-resources data.
• Storefront customers: authentication-related data when phone or email OTP login is enabled; and customer profiles and transaction-related data scoped to a specific merchant organisation. Storefront customer accounts are org-scoped and are not shared across organisations.
• Usage and logs: application usage records, security and system logs, and AI feature usage events (for example for billing reconciliation / chargeback review and service operations).
• Device and cookies: cookies or similar technologies needed to maintain signed-in sessions, security, and essential operation; and interface preferences such as language. We do not rely on third-party advertising analytics networks as a core part of the Service; if we add additional analytics tools later, we will update this Policy as appropriate.

4. How we use data

We use personal data for reasonable and lawful purposes, including mainly:

• Providing, maintaining, and improving the Service (including ERP, storefront, integrations, and AI features);
• Authentication, access control, fraud prevention, and security monitoring;
• Customer support and troubleshooting;
• Billing, usage reconciliation, AI usage chargeback review, and related account administration;
• Sending service-related notices (for example security, material feature changes, policy updates);
• Processing AI prompts and relevant business context at your request to generate the outputs you ask for;
• Complying with applicable law, responding to lawful requests, and protecting the rights and safety of us, our users, and the public.

5. Legal framework and the PDPO

The Service is primarily operated with reference to the laws of the Hong Kong Special Administrative Region. When we process personal data, we take into account core principles under Hong Kong’s Personal Data (Privacy) Ordinance (“PDPO”), including:

• Collecting personal data for lawful and directly related purposes, and taking practicable steps to notify data subjects of the purposes of collection and related matters;
• Using personal data for purposes consistent with or directly related to the purpose of collection, unless consent is obtained or the law permits otherwise;
• Taking practicable steps to ensure accuracy and not retaining personal data longer than necessary for the purpose;
• Taking practicable security safeguards against unauthorised or accidental access, processing, erasure, loss, or use;
• Where applicable, allowing data subjects to make data access and correction requests regarding their personal data.
• Please send data access / correction requests to privacy@primeflow.so. We may need to verify your identity and will handle requests to the extent permitted by law. If a request concerns business data controlled by your organisation, we may direct you to that organisation’s administrators.

6. AI processing

PrimeFlow provides AI-assisted features (for example document, template, analysis, or generation features). When you or your organisation use those features:

• Prompts / inputs you submit, and business context reasonably needed to fulfil the request, may be sent to model providers to generate outputs. Providers that may be involved include Anthropic (Claude), DeepSeek (fallback), MiniMax (document / template AI and similar), and image / video generation providers when enabled by the organisation.
• Those providers process relevant data as our processors / subprocessors to deliver the feature; we do not sell your AI prompt content for third-party advertising.
• AI outputs may be inaccurate or incomplete; users should review them before relying on them for business decisions.
• Do not submit unnecessary sensitive personal data in free-text AI prompts (for example government ID numbers, full payment card details, or health or children’s data unrelated to the feature). Organisations should set internal guidance limiting how much personal data staff paste into AI features.
• We may log AI usage events (for example usage volume, timestamps, organisation identifiers) to support billing reconciliation, abuse prevention, and service improvement.

7. Sharing and subprocessors

We do not sell personal data. We may share or allow processing of personal data in the following situations:

• Clerk: authentication and account management.
• Supabase: database, related storage, and hosting-related backend services.
• AI model providers: as described in section 6 (Anthropic, DeepSeek, MiniMax, and image / video providers when enabled).
• Infrastructure: for example Vercel and similar hosting and edge delivery services to operate the website and application.
• Optional integrations (only when an organisation connects them): Meta (social-related), Shopify, QuickBooks Online, WHEREorder OMS, WhatsApp Business, Twilio (storefront OTP and similar), merchant.where, GitHub App (org-module related), and similar connectors. Once connected, relevant data is exchanged within the organisation’s scope according to that integration’s configuration and purpose.
• Professional advisors and service providers: assisting with legal, accounting, security, or operations under confidentiality obligations.
• Law and safety: where required by law, court order, law-enforcement request, or to protect rights, property, or safety.
• Business transfers: in connection with a merger, acquisition, or asset transfer, handled under applicable law and reasonable notice arrangements.
• We do not introduce undisclosed advertising networks as a core data-sharing path under this Policy for ad targeting purposes.

8. International transfers

The Service uses cloud, authentication, AI, and infrastructure providers that may be located outside Hong Kong. Personal data may therefore be processed or stored outside Hong Kong.

We take reasonable contractual and/or technical and organisational security measures to protect personal data in cross-border processing. Organisations that export personal data into the Service (including via integrations or AI features) remain responsible for their own compliance obligations (including applicable cross-border and notice requirements).

9. Retention

We retain personal data while an account or organisation is active, and for as long as needed to provide the Service, resolve disputes, enforce agreements, comply with law, meet accounting / billing needs, and support security.

When data is no longer needed, we delete, anonymise, or restrict access according to reasonable procedures. Actual retention periods may vary by data category due to legal requirements, business needs, and technical backup cycles; this Policy does not prescribe fixed day counts for every field.

10. Security

We implement reasonable technical and organisational measures to protect personal data, including (as applicable): multi-tenant organisation isolation, role-based access controls, encryption in transit (for example TLS), and operational and security logging.

That said, no method of transmission over the Internet or electronic storage is absolutely secure. You should also protect your credentials, enable available security features, and grant organisation access only to authorised people.

11. Children

The Service is directed at business users and is not intended for children under 16. We do not knowingly collect personal data from children. If you believe we have collected a child’s data in error, contact privacy@primeflow.so and we will delete or otherwise handle it as reasonably practicable.

12. Your rights

To the extent permitted by applicable law (including the PDPO), you may have the following rights:

• Access personal data we hold about you;
• Request correction of inaccurate personal data;
• Request erasure or restriction of processing where applicable;
• Raise questions or complaints about our processing (you may also seek assistance from the Office of the Privacy Commissioner for Personal Data, Hong Kong).
• Please send requests to privacy@primeflow.so. If you are an organisation employee or storefront customer, some data is controlled by that organisation; the organisation’s admins may be the appropriate contact for your request, and we will help refer you where reasonable.

13. Storefront and merchant responsibility

When merchants use the PrimeFlow storefront or related tools to serve their customers, merchants are typically the “data user” (or a similar controller role in other jurisdictions) for their shoppers’ / customers’ personal data. PrimeFlow provides technical tools and hosting capabilities.

Merchants must provide appropriate privacy notices, consent mechanisms (where required), and lawful bases for their jurisdictions, and remain responsible for how they collect and use customer data. If you are a storefront customer, you should also review that merchant’s own terms and privacy notices in addition to this Policy.

14. Changes

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised effective date. For material changes, we may provide notice by reasonable means such as in-product notice or email. Continued use of the Service after an update indicates you are aware of the revised Policy to the extent permitted by applicable law.

15. Contact

Privacy-related questions, data access, or correction requests: privacy@primeflow.so.

General support: support@primeflow.so.

Use of the Service is also governed by our Terms of Service. Use the links at the bottom of this page or in the site footer to open the Terms, keeping your current language parameter (?lang=zh or ?lang=en).

Again: this Policy is intended to describe our practices and improve transparency; it is not legal advice. If you have specific compliance needs, please consult a qualified legal advisor.