Privacy Notice

Infinite Wraps LLC, trading as ShopFlow AI ("we", "us"), provides the ShopFlow AI shop operations platform. This notice explains what personal data we collect, why, who we share it with, and the rights you have.

1. Our role

We act as the data controller for account, billing, and support data relating to our customers and their users. Where you upload information about your own customers into your workspace, you are the controller of that data and we act as a processor on your behalf, in accordance with our Terms.

2. Data we collect and why

• Account data (name, email, password credentials, workspace and role) — to create and secure your account and provide the Service. Legal basis: performance of a contract.
• Workspace content (customers, jobs, estimates, photos, notes, schedules, time entries) — to deliver the features you use. Legal basis: performance of a contract.
• Support messages — to answer your questions and troubleshoot. Legal basis: legitimate interests.
• Usage and telemetry, device identifiers, IP address, log data — to keep the Service secure, prevent fraud and abuse, diagnose faults, and improve the product. Legal basis: legitimate interests.
• Marketing contact data — to send product updates where you have opted in. Legal basis: consent, which you may withdraw at any time.

Payment card details are collected and processed by our Merchant of Record, Paddle, not by us.

3. Who we share data with

• Service providers and subprocessors — cloud hosting, database and storage infrastructure, email delivery, error monitoring, and AI model providers used to power assistant features.
• Paddle.com, our Merchant of Record, for the sale of subscriptions, payments, subscription management, invoicing, and tax compliance.
• Professional advisers such as legal and accounting providers where necessary.
• Authorities where we are required to do so by law or to protect our rights.

We do not sell personal data.

4. International transfers

Our providers may process data in the United States and other countries. Where data is transferred from the UK or EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

5. Retention

We keep account and workspace data for as long as your workspace is active. After cancellation we retain data for up to 30 days to allow export and recovery, then delete or anonymise it, except where we must keep records longer for legal, tax, or fraud-prevention reasons. Security and audit logs are retained for up to 12 months.

6. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal data, to object to processing based on legitimate interests, and to withdraw consent. UK and EEA residents may also complain to their supervisory authority. We respond to requests within one month. Contact us at support@shopflow.ai.

7. Security

We apply appropriate technical and organisational measures, including encryption in transit, hashed credentials, row-level tenant isolation so workspaces cannot read each other's data, role-based access controls, and audit logging of sensitive actions.

8. Cookies

We use essential cookies and local storage to keep you signed in, hold your session, and remember preferences such as theme. These are required for the Service to work. If we introduce analytics or marketing cookies, we will ask for your consent first and give you a way to change your preferences. You can also clear or block cookies in your browser settings, though the Service may not function correctly without the essential ones.

9. Contact

Infinite Wraps LLC — support@shopflow.ai