EQUITYFLOW PRIVACY POLICY

Effective Date: 14 May 2026

1. WHO WE ARE AND OUR ROLE

EquityFlow operates the platform located at appuk.equityflow.co.uk and www.equityflow.co.uk. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, EquityFlow (founded by Brian Reece) acts as the Data Controller for the personal data processed through this platform.

If you have any questions regarding this policy or how your data is handled, please contact our data compliance team at hello@equityflow.co.uk.

2. THE DATA WE COLLECT

To provide you with professional-grade administrative intelligence, we collect and process the following categories of data:

  • Account Identity Data: Name, email address, and secure password hashes required for authentication.
  • Administrative & Case Data: The facts, dates, and background information you input into the chat interface to build your case strategy.
  • Document Uploads: Any PDFs, DOCX files, or images you upload for the AI (Examinatus, TLB, etc.) to scan, extract, and analyse.
  • Consulting & Triage Data: Information submitted via the intake form for 1-on-1 Strategic Assessments, including your objectives and summaries of your disputes.
  • Payment & Financial Data: Billing information securely processed by our third-party payment gateway. EquityFlow does not store or process your full credit card details on our servers.
  • Telemetry & Security Data: IP addresses, session identifiers, browser characteristics, geolocation, and access timestamps used strictly for platform security, rate-limiting, and abuse prevention.

3. OUR LAWFUL BASIS FOR PROCESSING

We process your data strictly under the following lawful bases defined by the UK GDPR:

  • Performance of a Contract: Processing your account data, case inputs, and document uploads to deliver the SaaS features and AI outputs you have subscribed to.
  • Legitimate Interests: Monitoring telemetry data to prevent scraping, hacking, or system abuse; and reviewing anonymised platform usage to improve our AI prompting architecture.
  • Legal Obligation: Retaining payment records to comply with HMRC tax requirements.
  • Explicit Consent: Processing highly sensitive "Special Category" data (if you choose to upload it), facilitating 1-on-1 Strategic Assessment sessions, and sending promotional marketing materials.

4. SPECIAL CATEGORY DATA & USER REDACTION

Administrative and constitutional disputes frequently involve sensitive personal data (e.g., medical history, financial insolvency, union membership). We treat all uploaded case data with the highest level of security. However, as a fundamental rule of digital hygiene, we strongly advise all users to redact highly sensitive identifiers (such as National Insurance numbers, banking passwords, or the names of minors) from their documents before uploading them, unless strictly necessary for generating a specific legal notice.

5. WHO WE SHARE DATA WITH (SUB-PROCESSORS & THIRD PARTIES)

We will never sell your data to third parties, data brokers, or marketing agencies. We share data solely in the following circumstances:

  • Enterprise Sub-Processors: We utilise categories of secure, enterprise-grade infrastructure partners to operate the platform. These include:
    • Secure Database & Auth Providers (e.g., Supabase) to host our encrypted database and manage logins.
    • AI Processing Engines (e.g., Google Gemini AI SDK) to process prompts and generate outputs. Note: We use enterprise API endpoints; your private case data is NOT used by these providers to train their public AI models.
    • Cloud Hosting Infrastructure (e.g., Vercel) for secure serverless routing.
    • Payment Processors (e.g., Stripe) for PCI-DSS compliant subscription billing.
  • Compelled Disclosure & Legal Authorities: We may disclose your information to government agencies, law enforcement, or regulatory bodies if required to do so by a valid court order, subpoena, or statutory demand, or if we believe in good faith that such disclosure is necessary to protect the safety, rights, or property of EquityFlow or the public.
  • Business Transfers: In the event that EquityFlow undergoes a merger, acquisition, corporate restructuring, or sale of assets, your personal data may be transferred to the acquiring entity as part of that transaction, subject to the continuation of these privacy standards.

6. PLATFORM SUPPORT & CHAT ACCESS

As outlined in our Terms of Service, to ensure operational stability and resolve technical bugs, EquityFlow administrators may occasionally need to view encrypted chat conversations. This is done exclusively for (a) providing technical support when you report an issue, or (b) analysing AI performance to improve our proprietary system prompts. All reviews are conducted under strict confidentiality, and any data used for long-term system development is thoroughly anonymised.

7. PUBLIC CHAT SHARING

EquityFlow allows users to generate a temporary, 7-day shareable web link to their specific conversation threads. If you choose to utilise this feature, you act as the publisher of that data. You are entirely responsible for redacting all personal, financial, or sensitive information from the thread before generating the link. EquityFlow accepts no liability for any data exposure that occurs because you voluntarily shared your chat history with third parties.

8. DATA SECURITY & ROW LEVEL SECURITY (RLS)

EquityFlow is built on a mathematically isolated data architecture. We employ Row Level Security (RLS) at the database level. This means your profile, chat history, and uploaded documents are cryptographically walled off; no other user on the platform can access your data. Furthermore, all data is encrypted in transit (TLS/SSL) and at rest.

9. SESSION MONITORING & ANTI-ABUSE

To protect the intellectual property of the platform and ensure stability for all users, we actively monitor sessions using fingerprinting and anomalous access detection. We log request frequencies, IP addresses, and access patterns to automatically block web scrapers, bots, and AI training pipelines. Unusual activity may result in automated account suspension to protect the network.

10. DATA RETENTION & ACCOUNT DORMANCY

  • Active Accounts & Unlimited History: We retain your data for as long as your account is active. Chat history retention is provided according to your specific subscription plan. Bolt-on credit balances are retained indefinitely for the life of your active account.
  • Inactive Accounts (12-Month Dormancy): Under the UK GDPR's Storage Limitation Principle, we cannot hold personal data on dormant accounts indefinitely. Cancelled subscriptions and Free accounts that go unused enter a 12-month dormancy window. This is counted from the date of your subscription cancellation, or, for Free accounts, from the date of your last sign-in. Any sign-in during the dormancy window automatically resets the 12-month clock. We will send reminder emails 30 days and 14 days before your dormancy window expires.
  • Automatic Permanent Deletion: After 12 consecutive months without activity, your account and all associated personal data (chat history, uploaded documents, profile) are automatically and permanently deleted from our active databases.
  • Manual Deletion: You can request the immediate deletion of your account at any time via your dashboard or by contacting hello@equityflow.co.uk. Once requested, your account and data are permanently removed within 30 days.
  • Financial Records: Basic transaction history and billing records are retained for 7 years to comply with HMRC and UK accounting laws.

11. COOKIES & TRACKING TECHNOLOGIES

In accordance with the Privacy and Electronic Communications Regulations (PECR), EquityFlow uses cookies and similar tracking technologies (such as local storage).

  • Strictly Necessary Cookies: We use essential cookies required for the fundamental operation of the platform, including maintaining secure user sessions (Supabase Auth) and preventing cross-site request forgery. These cannot be disabled.
  • Analytics & Performance Cookies: We may use non-essential cookies to analyse platform traffic and improve user experience. You have the right to consent to or reject these non-essential cookies via the banner presented upon your first visit to the site.

12. AUTOMATED DECISION-MAKING & PROFILING

EquityFlow provides advanced AI analysis and document drafting capabilities. However, we do not engage in automated decision-making (as defined by Article 22 of the UK GDPR) that produces legal or similarly significant effects concerning you. The AI acts strictly as an administrative drafting tool; the User serves as the final human decision-maker and must independently verify, approve, and execute any output before it is deployed in a legal or administrative setting.

13. CHILDREN'S DATA

The EquityFlow platform is intended strictly for adults managing civil, commercial, or administrative matters. We do not knowingly collect, process, or solicit personal data from anyone under the age of 18. If we discover that we have inadvertently collected data from a minor, we will delete that information immediately.

14. THIRD-PARTY LINKS

Our platform and AI agents may generate citations or provide links to third-party websites (such as Legislation.gov.uk, Companies House, or BAILII). EquityFlow is not responsible for the privacy practices, tracking technologies, or content of these external websites. We encourage you to read the privacy policies of any third-party site you visit.

15. INTERNATIONAL TRANSFERS

Some of our enterprise infrastructure providers may process data in data centres located outside the UK or European Economic Area (EEA). Where this occurs, EquityFlow ensures that appropriate legal safeguards—such as UK International Data Transfer Agreements (IDTAs) or Standard Contractual Clauses—are in place to protect your data to the exact standards required by the UK GDPR.

16. YOUR RIGHTS UNDER UK GDPR

You retain absolute control over your personal data. Under UK law, you have the right to:

  • Access: Request a copy of the data we hold about you.
  • Rectification: Correct inaccurate or incomplete data.
  • Erasure (Right to be Forgotten): Request the permanent deletion of your account via your dashboard or by email.
  • Portability: Export your generated documents and chat history.
  • Restriction & Objection: Object to how we process your data.
  • Marketing Opt-Out: You have the absolute right to opt out of promotional or marketing communications at any time by clicking the "unsubscribe" link at the bottom of our emails, or by updating your account preferences. (Note: You will still receive essential transactional emails, such as billing receipts and security alerts).

To exercise any of these rights, please contact hello@equityflow.co.uk. We will respond to all statutory requests within 30 days. You also maintain the right to lodge a formal complaint with the Information Commissioner's Office (ICO) if you believe your data has been mishandled.

17. CHANGES TO THIS POLICY

We may revise this Privacy Policy from time to time to reflect changes in our technology or legal obligations. If we make material changes, we will provide at least thirty (30) days advance notice via email or a prominent notification within your dashboard before the revised policy takes effect. Your continued use of the platform following the effective date constitutes acceptance of the updated policy.