Last updated: July 2026
This Privacy Policy explains how SellFlow ("we," "us") collects, uses, discloses, and safeguards personal data when you use our hosted storefronts, checkout and booking forms, and mobile seller app. We serve sellers and buyers globally, and we aim to comply with the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act as amended by the CPRA, and other applicable data-protection laws.
For data about a seller's own account (email, store profile, catalog, billing), SellFlow acts as a data controller. For personal data that buyers submit through a seller's storefront (buyer name, contact, address, order details), the seller is the controller of that data and SellFlow acts as a processor on the seller's behalf. Buyers with questions about a specific order should contact the seller they purchased from; we will assist where required.
From buyers at checkout or booking: name, phone number, email (where provided), shipping address, city, state, postal/ZIP code, country, selected product or variant, appointment or inquiry details, order notes, and payment preference.
From sellers: email, WhatsApp/phone number, store name and username, profile details, catalog and listing content, payment-profile details (stored encrypted), subscription and billing status, and support correspondence.
Automatically: device and browser type, IP address, approximate location derived from IP, referring pages, storefront views and interactions, and analytics events used to compute conversions and traffic. Some of this is collected via cookies and similar technologies described in our Cookie Policy.
We use personal data to: operate storefronts and process orders, leads, and appointments; route buyer messages to sellers (primarily via WhatsApp deep links); provide analytics to sellers; manage seller accounts, subscriptions, and billing; send transactional email; provide customer support; detect and prevent fraud, abuse, and security incidents; and comply with legal obligations. We do not sell buyer or seller personal data, and we do not "share" it for cross-context behavioral advertising as defined under the CPRA.
Where GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the service you request); legitimate interests (to secure, improve, and operate the platform and prevent abuse); consent (for non-essential cookies and certain communications, which you may withdraw at any time); and legal obligation (to meet tax, accounting, and law-enforcement requirements).
We share personal data with the seller you transact with, and with service providers who process data on our behalf under contract, including Google Firebase (database and authentication), Vercel (hosting and custom domains), Lemon Squeezy (subscription billing), Resend (transactional email), and Arcjet (security and abuse prevention). We may disclose data to comply with law, enforce our terms, or protect rights and safety. We do not sell your data to third parties.
Our providers may process data in countries other than yours, including the United States. Where required, such transfers are protected by appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an equivalent mechanism recognized under applicable law.
We retain personal data only as long as necessary to provide the service, comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. Order records may be retained for statutory periods. When data is no longer needed, we delete or anonymize it. You may request deletion as described in Section 9 and in our Data Deletion process.
We apply technical and organizational measures to protect personal data, including encryption in transit, encryption of sensitive fields such as payment profiles, access controls, and bot/abuse protection. No system is perfectly secure. Learn more in our Security Policy.
Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal data; to object to or restrict certain processing; and to withdraw consent. Under the CCPA/CPRA, California residents may request to know, delete, and correct personal information and may not be discriminated against for exercising these rights; because we do not sell or share personal data, no opt-out of sale is needed. To exercise any right, email support@sellflow.bio or use our data deletion request page. We will verify your request and respond within the timeframe required by law. You may also lodge a complaint with your local supervisory authority.
The platform is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.
We may update this Policy; material changes are indicated by the "Last updated" date above. For any privacy question or request, contact us at support@sellflow.bio.