Privacy Policy

Account information: Name, email address, and password when you register.

Organisation details: Business name and workspace configuration.

Social account OAuth tokens: Access tokens and profile data from LinkedIn, Facebook, Instagram, TikTok, and X when you choose to connect those accounts.

Payment information: Billing history and plan details. Card data is processed exclusively by Yoco — we never store card numbers.

Usage data: Scheduled posts, published content, media uploads, and analytics.

Technical data: IP address, browser type, device type, and session identifiers collected automatically via server logs and session cookies.

• To provide and improve the FlowSale Marketing service.
• To authenticate your identity and maintain your session.
• To publish social media content on your behalf using connected accounts.
• To process payments and manage subscriptions.
• To send transactional emails: account verification, welcome messages, subscription renewal reminders, and password resets.
• To detect and prevent fraud or abuse.
• To comply with legal obligations.

We process personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA).

Lawful basis: Contract performance (service delivery), legitimate interest (security, fraud prevention), and consent (marketing communications).

Data subject rights: You have the right to access, correct, and request deletion of your personal information. Contact support@flowsale.co.za.

Breach notification: In the event of a data breach we will notify the Information Regulator and affected data subjects within 72 hours as required by POPIA.

Retention: Active account data is retained while your account is open. Upon deletion, personal data is purged within 30 days. Payment records are retained for 5 years for SARS compliance.

We do not sell your personal information. We share data only with:

Yoco: Payment processing (South Africa).

Cloudflare R2: Media file storage.

Social platforms: LinkedIn, Meta (Facebook / Instagram), TikTok, X — only to publish content you have explicitly scheduled.

Law enforcement: If required by a valid court order or applicable law.

All data is transmitted over HTTPS/TLS. Passwords are hashed using bcrypt. OAuth tokens are encrypted at rest. We perform periodic security reviews to keep your data safe.

We use session cookies strictly necessary for authentication. We do not use third-party advertising or tracking cookies.

FlowSale Marketing is not intended for persons under 18 years of age. We do not knowingly collect data from minors.

We may update this policy from time to time. We will notify registered users by email at least 14 days before material changes take effect. Continued use of the service after the effective date constitutes acceptance.