Privacy Policy

Last updated: 15 May 2026

This Privacy Policy explains how eTechFlow Ltd ("we", "us", "our") collects, uses and protects information you provide when you use modules.etechflow.com (the "Service"). We are the data controller for personal data collected through the Service.

1. Who we are

eTechFlow Ltd is a company registered in England and Wales. Our registered office and a postal address for data-protection enquiries is available on request via legal@etechflow.com. For data protection matters our designated contact is the same address.

2. What we collect

Account data — email address, name (optional), authentication tokens. Stored when you sign in with Google or via a magic-link email.
Order data — billing country, currency, items purchased, payment confirmation IDs. We do not store full payment-card numbers; Payoneer handles that.
License data — license keys we issue, the domain you install them on, validation timestamps.
Usage data — pages viewed and basic interaction events, collected via PostHog only after you accept analytics cookies.
Server logs — IP address, user-agent, request URL, retained for up to 30 days for security and operational debugging.

3. Why we use it (lawful bases)

Contract performance — to fulfil your purchase, deliver license keys, provide support and process refunds.
Legal obligation — to comply with tax, accounting and consumer-protection law.
Legitimate interest — to detect fraud, prevent abuse, and improve the Service. We balance this against your privacy rights.
Consent — for analytics cookies and marketing emails. You can withdraw consent at any time.

4. Who we share it with

We share the minimum necessary data with these processors, each bound by a data-processing agreement:

Payoneer — payment processing (Israel/EU; SCCs in place where applicable).
Resend — transactional and marketing email delivery (United States; SCCs in place).
PostHog — product analytics (European Union region). Used only with your explicit consent.
OpenAI — used solely to translate product descriptions; no customer personal data is sent.
Google — when you sign in with Google, Google handles authentication and shares your verified email with us.

We never sell your personal data. We may disclose data when required by law, court order, or to protect the safety of our users.

5. International transfers

Where data is transferred outside the UK or EEA we rely on Standard Contractual Clauses (SCCs) or equivalent safeguards. Servers themselves are located within the United Kingdom or European Union.

6. How long we keep it

Account data: while your account is active, then 12 months after closure.
Order and tax records: 7 years (UK statutory retention).
License keys: lifetime of the license plus 12 months.
Server logs: 30 days.
Marketing-email engagement: 24 months after last interaction.

7. Your rights

Under UK GDPR you have the right to:

Access the personal data we hold about you.
Rectify inaccurate data.
Erase your data (where one of the legal grounds applies).
Restrict or object to processing.
Receive your data in a portable format.
Withdraw consent at any time without affecting prior processing.
Complain to the Information Commissioner's Office (ICO, ico.org.uk) or the supervisory authority in your country.

To exercise any right email privacy@etechflow.com. We respond within 30 days.

8. Cookies

We use a small number of essential cookies (sign-in, cart, locale, currency) and, with your consent, analytics cookies. See our Cookie Policy for the full list and a way to change your preferences at any time.

9. Security

We use TLS for all traffic, encrypt secrets at rest, restrict access with role-based controls, and review logs for unusual access. No system is perfectly secure — if you spot an issue please email security@etechflow.com rather than disclosing it publicly.

10. Changes

We'll post any material change at least 14 days before it takes effect and email account-holders when the change affects them. The "Last updated" date above always reflects the current version.

2. What we collect

Account data — email address, name (optional), authentication tokens. Stored when you sign in with Google or via a magic-link email.

Order data — billing country, currency, items purchased, payment confirmation IDs. We do not store full payment-card numbers; Payoneer handles that.

License data — license keys we issue, the domain you install them on, validation timestamps.

Usage data — pages viewed and basic interaction events, collected via PostHog only after you accept analytics cookies.

Server logs — IP address, user-agent, request URL, retained for up to 30 days for security and operational debugging.

3. Why we use it (lawful bases)

Contract performance — to fulfil your purchase, deliver license keys, provide support and process refunds.

Legal obligation — to comply with tax, accounting and consumer-protection law.

Legitimate interest — to detect fraud, prevent abuse, and improve the Service. We balance this against your privacy rights.

Consent — for analytics cookies and marketing emails. You can withdraw consent at any time.

4. Who we share it with

We share the minimum necessary data with these processors, each bound by a data-processing agreement:

Payoneer — payment processing (Israel/EU; SCCs in place where applicable).

Resend — transactional and marketing email delivery (United States; SCCs in place).

PostHog — product analytics (European Union region). Used only with your explicit consent.

OpenAI — used solely to translate product descriptions; no customer personal data is sent.

Google — when you sign in with Google, Google handles authentication and shares your verified email with us.

We never sell your personal data. We may disclose data when required by law, court order, or to protect the safety of our users.

7. Your rights

Under UK GDPR you have the right to:

Access the personal data we hold about you.

Rectify inaccurate data.

Erase your data (where one of the legal grounds applies).

Restrict or object to processing.

Receive your data in a portable format.

Withdraw consent at any time without affecting prior processing.

Complain to the Information Commissioner's Office (ICO, ico.org.uk) or the supervisory authority in your country.

To exercise any right email privacy@etechflow.com. We respond within 30 days.