Privacy Policy

SaleFlowPoint ("we", "the platform") is point-of-sale and back-office software used by registered businesses ("companies") to run their shops. This page explains what data we collect, why, and how it's protected — for both the companies that use SaleFlowPoint and the customers those companies serve.

What we collect

• Company & staff accounts. Business name, address, contact details, and staff login credentials. Passwords are hashed with Argon2id — we never store or can recover the plaintext password.
• Sales & catalog data. Products, prices, stock levels, sales, refunds, and supplier records that a company enters to run its business.
• Customer records. Where a company chooses to keep them — name, contact details, purchase history — entered and controlled by that company, not by us.
• Audit trail. Actions that affect money or access (voided sales, price changes, permission changes) are written to an append-only log, for the company's own accountability — not shared outside that company.

Google Calendar integration and Google user data

A company can optionally connect a staff member’s Google Calendar, so that appointments booked in SaleFlowPoint appear in that calendar and times already busy in it are not offered for booking. This is off by default and needs that person’s own Google sign-in and consent.

• What we access. We request exactly one Google API scope — https://www.googleapis.com/auth/calendar.events. With it we read the busy times of the connected calendar, and create, update and delete the calendar events that mirror appointments booked in SaleFlowPoint. We do not request access to email, contacts, files or any other Google data.
• How we use it. Only to keep that company’s appointment bookings and the connected calendar in step. Google user data is never sold, never used for advertising, never used to build a profile of anyone, and never used to develop, improve or train artificial intelligence or machine learning models.
• What we store. The OAuth access and refresh tokens (encrypted, see below), the identifier of the connected calendar, and the identifier of each event we created, so that we can update or remove it later. Busy times are read when a booking is being made and are not stored. We do not copy or keep the calendar’s other events.
• Who we share it with. No one. Google user data is not transferred to any third party, and is never visible to any other company on the platform.
• Who can see it. No person at SaleFlowPoint reads your Google Calendar data, unless you give us explicit permission to do so to resolve a problem you have reported, or it is necessary for security purposes or to comply with the law.
• How to remove it. Disconnecting the integration (from the company’s Scheduling settings) revokes our access at Google and deletes the stored tokens straight away. You can also remove SaleFlowPoint’s access at any time from your Google Account’s security settings.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Paying for SaleFlowPoint: Paddle

Card payments for SaleFlowPoint plans are handled by Paddle (Paddle.com Market Limited), our reseller and Merchant of Record. Paddle sells the subscription to your company on our behalf, charges the card, works out and collects sales tax or VAT, and sends the receipts.

• What Paddle receives. Your company’s billing email address and name, the plan and price chosen, and the country, address or tax number you enter in Paddle’s checkout. You type your card details into Paddle’s own payment form; they go straight to Paddle and never pass through or stay on our servers.
• What we keep. The subscription’s status and dates, the payments made and Paddle’s invoice numbers, and the card’s brand, last four digits and expiry date, so that your Billing page can show which card is used. We never store a full card number or security code.
• Paddle’s own policy. Paddle is responsible for the payment data it holds, under its privacy policy.
• Paying by bank transfer instead. If you pay by local bank transfer, we keep the receipt you upload and the payment reference, only to confirm the payment.

WhatsApp connection

A company will be able to connect its own WhatsApp Business number to SaleFlowPoint, so that it can answer its customers’ WhatsApp messages from the back office. This is optional, off unless the company connects it, and works through Meta’s official WhatsApp Business Platform after the company signs in with Facebook and agrees in Meta’s own window.

• What we receive from Facebook Login. Only what Meta’s signup window hands over for the WhatsApp connection: the identifiers of the company’s WhatsApp Business Account and phone number, and the access token Meta issues for them. We do not receive or store the person’s Facebook profile, friends, posts, photos or Pages, and the Facebook sign-in is not used to sign in to SaleFlowPoint.
• What we receive. The messages the company’s customers send to that number and the replies the company sends, from SaleFlowPoint or from its phone; the customers’ WhatsApp names and phone numbers; and, once, at the moment of connecting, the company’s recent one-to-one chats and contacts (up to six months) if the company chooses to bring them in. Group chats are not received.
• How we use it. Only to show those conversations to that company’s own staff and to send the replies they write, which can draw on that company’s own products, stock and orders. Replies are written by the company’s staff; no message is answered automatically or by artificial intelligence. If such a feature is added, it will be off unless the company switches it on, and this section will say first which service processes the messages. It is never shown to another company, never sold, and never used for advertising.
• Meta’s part. Messages are carried by Meta (WhatsApp), which processes them under its own terms and business policies. The company is responsible for having its customers’ permission to message them. We use Meta’s platform in line with the Meta Platform Terms, and data we receive from Meta is used only as this section describes.
• What we store. The conversations and contacts above, and the access token Meta issues for that number, encrypted in the same way as Google tokens (below).
• How to remove it. The company can disconnect WhatsApp at any time; we then stop receiving messages and delete the stored token. To have the stored conversations deleted too, see Data deletion.

How we protect your data

These are the measures in place to protect sensitive data, including Google user data, the records companies keep in SaleFlowPoint, and account credentials.

• Encryption in transit. Every connection between your browser and SaleFlowPoint, and between SaleFlowPoint and Google’s APIs, is encrypted with HTTPS (TLS).
• Encryption at rest for Google tokens. Google OAuth access and refresh tokens (and, once WhatsApp can be connected, Meta’s access tokens) are encrypted before they are stored, using authenticated symmetric encryption (Fernet: AES in CBC mode with an HMAC-SHA256 signature). The encryption key is held in the server’s configuration, separately from the database, so a copy of the database alone does not reveal a token. Tokens are never written to logs and are never shown in the application, to you or to our staff.
• Passwords. Passwords are stored only as Argon2id hashes. We never store a password in readable form and cannot recover one.
• Separation between companies. Each company’s data is kept apart from every other company’s. Every request is checked against the company of the signed-in user, and an attempt to reach another company’s record is answered as “not found”.
• Access control. Within a company, each staff member signs in as themselves and can do only what their role allows. Access to our servers and database is limited to the people who operate the service, and the application itself connects to the database with an account that can read and write records but cannot alter or remove the database’s structure.
• Sessions. Sign-in sessions use short-lived access tokens. The longer lived token that renews a session is kept in a cookie that scripts cannot read, is sent only over HTTPS and only to our own site, and is protected against cross-site request forgery. Repeated failed sign-in attempts are rate limited.
• Audit trail. Actions that affect money or access are recorded in an append-only log, so changes can be traced.
• Data minimisation. We ask for the narrowest access that does the job (one Google scope), and we store only what the feature needs.
• Backups. The database is backed up before every software release, and backups are kept on our own servers under the same access restrictions.
• If something goes wrong. If we become aware of a security incident that affects your data, we will tell the affected company without undue delay, with what happened and what we are doing about it.

Advertising measurement on our own website

We advertise SaleFlowPoint on Google. To see which adverts bring visitors, and whether a visitor goes on to register a shop, our own public pages (the home page, the guide, contact, registration and these policy pages) carry a Google Ads tag. It reports a visit only for someone who is not signed in.

• What it records. That one of those pages was opened, and, if you arrived by clicking one of our adverts, an identifier for that click. Google may store that identifier in a cookie in your browser. We do not send Google your name, email address or anything you type into a form.
• Where it never runs. Not in the back office, not at the till, not on any company’s public shop or booking pages, and not in customer accounts. On our own public pages nothing is reported for anyone who is signed in. A company’s staff and a shop’s own customers are never reported to our advertising account.
• Your choice. If your browser sends a Global Privacy Control signal, the tag reports nothing about your visit. For visitors in the European Economic Area, the United Kingdom and Switzerland, the tag runs with consent denied: it sets no advertising cookies. You can also control advertising cookies in your browser and at Google’s Ads Settings.
• The video on our home page. It is hosted by YouTube. Nothing is loaded from YouTube until you press play; when you do, the video comes from YouTube’s privacy-enhanced player and YouTube’s own policy applies to it.
• What it has nothing to do with. Company data, customer records and Google Calendar data (above) are never used for advertising and are never sent to this tag.

What we don't do

• We don't sell personal data, to anyone, ever.
• We don't use company or customer data to train third-party AI models. Where a company opts into AI-assisted product import, the file it uploads is sent to Google's Gemini API only to map that one import, not stored by us or Google beyond processing the request.
• One company's data is never visible to another — every query is scoped by company, and a cross-company lookup returns "not found," not an error that would confirm the record exists.

Data retention & deletion

A company can request full data export or permanent erasure of its account at any time through its platform contact. Erasure removes personally identifying data and anonymizes historical financial records that must be retained for accounting integrity, rather than leaving a hole in the ledger.

Google user data is kept only for as long as the calendar stays connected. Disconnecting it deletes the stored Google tokens immediately, and erasing a company’s account deletes any that remain. To ask us to delete Google user data, write to the address below.

Billing records (payments, invoices, the card’s last four digits) are kept for as long as the law requires for accounting, even after a plan ends. WhatsApp conversations are kept while the number stays connected, and deleted on request or when the company’s account is erased. How to ask for deletion, step by step: Data deletion.

Contact

Questions about this policy, or a request to access, export, or delete your data: privacy@saleflowpoint.com.