Privacy Policy

1. Introduction

CellFlow respects the privacy of its users. This policy describes how we collect, use, store and protect your personal data, in line with applicable data protection law (including the EU/UK GDPR for customers in those regions and Brazil's LGPD — Law No. 13.709/2018).

2. Data We Collect

We collect the following data:

• Registration data: name, email, phone, tax ID, business address
• Usage data: access logs, features used, system logs
• Business data: information on products, services, sales, repair jobs and customers you register
• Payment data: processed exclusively by the Stripe platform; we do not store credit card details
• Browsing data: pages visited, clicks, device and browser type, approximate region and where the visit came from (ad, search or link), collected by the tools described in section 9

3. Purpose of Processing

Your data is used to:

• Provide the management service (system features)
• Process payments and billing
• Communicate about the service (updates, maintenance, alerts)
• Continuously improve the system
• Measure visits to the website and the results of our ads
• Comply with legal obligations

4. Data Isolation

Each business has its data completely isolated. We use database security policies to ensure each business accesses only its own data. No business can view, edit or access another business's data.

5. Storage and Security

Data is stored on secure cloud infrastructure with the following security measures:

• Encryption in transit (TLS/SSL)
• Encryption at rest
• Automatic daily backups
• Per-business data isolation
• Secure authentication
• Passwords stored with cryptographic hashing

6. Data Sharing

Your data may be shared only with:

• Payment processor (Stripe): for billing and financial management (name, email, tax ID)
• Database (Supabase): cloud storage infrastructure
• Hosting (Vercel): delivery of the website and the system, aggregate visit counts and page speed measurement
• Email delivery (Resend): access codes, welcome messages and notices about your account (name and email)
• Google (Google Analytics) and Meta (Facebook and Instagram): browsing data to measure visits and ads, as described in section 9
• Tax authorities (Brazilian state tax offices and the national NFS-e system): the details of the tax invoices you issue through the system, as required by law

We do not sell or rent your data. The only sharing related to marketing is the one in section 9: browsing data sent to Google and Meta to measure visits and ads.

7. Your Rights (GDPR)

Under the GDPR, you have the right to:

• Confirm whether your data is being processed
• Access your personal data
• Correct incomplete or out-of-date data
• Request erasure of unnecessary data
• Data portability
• Withdraw consent at any time

To exercise any of these rights, write to the contact email shown at the top of this policy.

8. Data Retention

Your data is kept while your account is active. After cancelling the subscription, data is kept for up to 90 days to allow reactivation. After that period, data may be permanently removed.

Data required to comply with legal obligations (such as accounting records) may be kept for longer periods as required by law.

9. Cookies and measurement tools

We use cookies and browser storage for three purposes:

• Essential: your login session, your language preference, the referral code of whoever referred you (kept for 30 days), a note that you have already left your contact details (30 days, so the site does not ask again) and system preferences such as the completed tutorial and print settings. Without them, login and parts of the system stop working.
• Measurement and ads: Google Analytics, from Google, sets cookies on the cellflow.com.br website and in the system's dashboard. The Meta Pixel (Facebook and Instagram) runs only on the public pages that present CellFlow, at sign-up and on the plan subscription page. They count visits, show which pages and features are used most and measure how many people arrive from an ad, sign up and subscribe. With this data, Google and Meta may also show CellFlow ads to people who have visited the website.
• Cookie-free measurement: Vercel, our hosting provider, counts visits and measures page speed in aggregate, without setting cookies.

At sign-up and login, the Meta Pixel may send Meta your email and phone number in encrypted (hashed) form, to identify whether the sign-up came from an ad. It does not run on the dashboard screens where you register customers, repair jobs and sales: your customers' data is not sent to Meta or Google. Google and Meta also process this data under their own privacy policies.

You can delete or block measurement and ad cookies in your browser or with an ad blocker without losing access to the system. Google offers an add-on to opt out of Google Analytics (tools.google.com/dlpage/gaoptout), and Meta lets you control how your data is used for ads in the ad settings of Facebook and Instagram.

10. Changes to This Policy

This policy may be updated periodically. Significant changes will be communicated by email. We recommend reviewing this page periodically.

11. Contact

If you have any questions about this privacy policy or about the processing of your data, write to the contact email shown at the top of this policy or use the support available in the system.