How PropFlow collects, uses, and protects personal information.

Account and registration data: name, email address, business name, phone number, and password (hashed — never stored in plaintext).

Workspace operational data (processed on behalf of workspace operators): tenant and resident records, applicant data, property and lease records, payment histories, maintenance records, and documents stored in Supabase Storage.

Technical data: session tokens managed by Clerk, IP address (used for rate limiting only — not retained for profiling), request timestamps, error reports captured anonymously by Sentry, and browser or device type.

Communications: messages submitted via contact forms, support requests, newsletter subscriptions, and in-platform communications.

To provide, operate, and improve the Service: account management, workspace provisioning, billing, feature delivery, and onboarding.

Security and fraud prevention: rate limiting, anomaly detection, Cloudflare Turnstile CAPTCHA verification, and platform abuse prevention.

Communications: transactional service emails (essential), responses to support enquiries, and newsletters where you have given consent.

Legal compliance: retaining records as required by applicable law and responding to lawful requests from regulatory authorities.

Contract performance (GDPR Art. 6(1)(b)): processing required to deliver the subscription service you have signed up for.

Legitimate interests (GDPR Art. 6(1)(f)): platform security, rate limiting, error monitoring, and product improvement using aggregate anonymised analytics.

Legal obligation (GDPR Art. 6(1)(c)): financial record-keeping, tax compliance, and responses to lawful authority requests.

Consent (GDPR Art. 6(1)(a)): newsletter subscriptions and optional analytics. You may withdraw consent at any time without affecting the lawfulness of prior processing.

We do not sell personal data. We share data only as necessary to provide the Service with the following sub-processors: Supabase (database and storage, SOC 2 Type II), Clerk (authentication, SOC 2 Type II), Stripe (billing, PCI DSS Level 1), Resend/Brevo (email delivery, GDPR-compliant), OpenAI (AI assistant API — do not enter sensitive personal data in chat), Sentry (error tracking, SOC 2), and Vercel (hosting, SOC 2 Type II).

All sub-processors are bound by Data Processing Agreements (DPAs). International transfers outside the EEA or UK are covered by EU Standard Contractual Clauses (SCCs) or UK International Data Transfer Agreements (IDTAs).

Depending on your jurisdiction, you have the right to access, correct, delete, restrict, or port your personal data; object to processing; and withdraw consent. Under CCPA/CPRA you also have the right to opt-out of sale (we do not sell data) and non-discrimination.

Under PDPA (Singapore): right to withdraw consent, access, and correction. Under APPI (Japan): right to disclosure, correction, deletion, and cessation. Under DPDP (India 2023): right to access, correction, erasure, and grievance redress. Under PIPL (China): right to access, copy, correction, deletion, and withdrawal of consent.

To exercise any right, contact us via the support channel at propflowhq.com/contact. We will respond within the timeframe required by applicable law (typically 30 days; CCPA: 45 days; PIPL: 15 working days).

Account and billing data is retained for the subscription term plus 7 years for financial compliance. Workspace operational data is retained while the subscription is active and deleted within 90 days of account termination on written request.

The Service is not directed to persons under 18. We do not knowingly collect data from children. Contact us immediately if you believe a child has submitted data.

We may update this policy to reflect changes in the Service or applicable law. Material changes will be notified by email at least 30 days in advance. Continued use of the Service after the effective date constitutes acceptance.

For privacy enquiries, contact us at propflowhq.com/contact. If you are unsatisfied with our response, you have the right to lodge a complaint with your national supervisory authority (e.g., ICO in the UK, your EU Data Protection Authority, PDPC in Singapore).