How Northflo collects, uses, and protects your information. Last updated: 29 September 2026.
About this Privacy Policy
This policy explains how Northflo collects, uses, stores, and shares your information when you use our service, and explains your rights regarding your data.
Northflo is the data controller for the personal information you provide. For questions, contact privacy@northflo.com.
What information we collect
Account information: name, email address, business name, business type, and securely hashed password. Payments are processed by Stripe; Northflo does not store card details.
Marketplace connections: account identifiers, encrypted authorisation tokens, and the permission scopes you grant.
Business data: listings, inventory, images, pricing, cost, sales, order data, analytics, and custom notes.
Usage and support information: device and session information, error logs, performance data, and messages you send us for support.
How we use your information
We use your information to manage your account, process business data, connect marketplaces, generate AI listing content, provide analytics, process payments, send service notifications, support you, protect against fraud, and meet legal obligations.
We use aggregated usage patterns to improve Northflo. Marketing communications and case-study participation happen only with your consent.
Who we share information with
We share data only with trusted service providers required to operate Northflo, including payment processing, hosting, transactional email, error monitoring, and support services. Each is contractually required to protect your data.
We share data with Etsy, Shopify, Instagram, and Pinterest only where needed for the connected functionality you choose. We may also disclose information if required by law. We never sell your data, share it with advertisers, or use it to train external AI.
How long we keep your data
We retain data while your account is active to provide the service. After cancellation, we retain data for 90 days in case you reactivate, then delete personal data unless a legal obligation requires longer retention. Deleted data may remain in backups for up to 12 months. Transaction and tax records may be retained for seven years where required by UK law.
Your privacy rights
Under UK GDPR, you have rights to be informed, access your data, correct inaccurate information, request erasure, restrict processing, receive portable data, object to certain processing, and request human review of automated decisions.
To exercise these rights, email privacy@northflo.com. We respond within 30 days. If you believe your data has not been handled correctly, you may complain to the UK Information Commissioner’s Office at ico.org.uk.
Cookies and tracking technologies
Northflo uses essential cookies for session management, authentication, and security; optional analytics cookies to improve the service; and preference cookies to remember settings. We do not use advertising cookies, third-party marketing pixels, or cross-site tracking.
Contact information
Privacy requests: privacy@northflo.com — response within 30 days.
Security concerns: security@northflo.com — response within 48 hours.
General support: support@northflo.com — response within 24 hours on business days.
Company registration, registered address, ICO registration, and any appointed data-protection officer details will be published here before launch.