Privacy Policy

Effective date: November 10, 2026

We are committed to protecting your privacy. This Privacy Policy outlines how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

1. Information we collect

1.1 Personal Information

We may collect personal information that you voluntarily provide when you:

Register or create an account on our site
Subscribe to our newsletters or other communications
Make inquiries or request information about our services
Participate in surveys or promotions

Personal information may include your name, email address, phone number, company name, and any other details you provide.

1.2 Collected automatically

Visiting a page on this site records the following, and nothing else:

The page you viewed and the page that referred you to it
Your browser and operating system family, for example “Safari on macOS”, not a version fingerprint
Your country, derived by our content delivery network. Not your city, and not your IP address, which is used to route the response and is not retained by us
Page performance timings, so we can tell whether the site is slow for real visitors

These are aggregate counts. There is no identifier tying one page view to another, which means we cannot reconstruct an individual visitor’s path through the site, by design, not by policy.

2. How we use your information

To answer you. If you send an enquiry, we use what you wrote to reply to it and to prepare for the conversation. That is the only reason we hold it. We keep an enquiry for 24 months after you send it, then delete it.
To see which pages are worth keeping. Aggregate page-view counts tell us what people read and what loads slowly. They cannot tell us who, because nothing here identifies a visitor.
To keep the site up. Abuse prevention and rate limiting by our content delivery network.

We do not personalise the site to you, do not build a profile from your browsing, and do not sell, rent or share anything with advertisers or data brokers. We run no marketing list. If that changes, you will be asked to join it rather than added to it.

3. Cookies

Our cookie policy lists what this website stores in your browser. It uses no marketing cookies today. If we add any, they will stay off unless you accept them, and you will be able to change your choice at any time. Page-view analytics are cookieless.

4. Sharing and disclosure of information

We do not sell, trade, or otherwise transfer your personal information to third parties without your consent, except in the following cases:

Service Providers: We may share your information with trusted third-party vendors and partners who assist us in providing our services.
Legal Requirements: We may disclose your information if required by law or to protect our rights, property, or safety, or that of others.
Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the new owner.

5. Data security

We implement a variety of security measures to protect your personal information. These include secure servers, encryption, and restricted access controls. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

6. Your rights and choices

You have the following rights regarding your personal data:

Access: You can ask to see the personal information we hold about you.
Correction: You have the right to correct or update your information.
Deletion: You can request the deletion of your personal data under certain circumstances.
Opt-Out: You can opt-out of marketing communications or restrict how we use your data.

To exercise these rights, please contact us at [email protected].

7. Children's privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal information from children.

8. Changes to this privacy policy

We may update this Privacy Policy from time to time. Any changes will be reflected on this page, and the updated policy will indicate the effective date.

9. Your rights under GDPR

If you are located in the European Economic Area (EEA), the following additional provisions apply to the processing of your personal data:

9.1 Legal Basis for Processing

We process personal data under the following legal bases:

Legitimate Interest: For service delivery, operating Powoflow, and security monitoring necessary to provide the Powoflow service, and for answering enquiries you send us.
Consent: For marketing cookies, if we add any, and marketing email you sign up for. You may withdraw consent at any time.
Contractual Necessity: To fulfill our obligations under your subscription agreement.

9.2 Data Subject Rights

Under the GDPR, you have the right to:

Access: Obtain confirmation of whether your personal data is being processed and request a copy.
Rectification: Request correction of inaccurate or incomplete personal data.
Erasure: Request deletion of your personal data where no compelling reason for continued processing exists.
Portability: Receive your personal data in a structured, commonly used, machine-readable format.
Restriction: Request limitation of processing under certain circumstances.
Objection: Object to processing based on legitimate interests or for direct marketing purposes.

9.3 Data Processing Agreements

Every customer, on every plan, can have a Data Processing Agreement (DPA) with us for the personal data they put into Powoflow. Contact [email protected] for a copy.

9.4 International Data Transfers

Powoflow infrastructure is hosted in the United States. For data transferred from the EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission. Copies of the applicable SCCs are available upon request.

Where your data is processed

We run the service from the United States, wherever you are. If you are in the European Economic Area, including Norway, your personal data is transferred to the United States under the European Commission’s Standard Contractual Clauses. Ask us for a copy at [email protected].

10. CCPA/CPRA compliance

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights:

Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
Right to Delete: You may request that we delete personal information we have collected from you, subject to certain exceptions.
Right to Opt-Out: You may opt out of the sale or sharing of your personal information.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

Do Not Sell or Share My Personal Information

Powoflow does not sell personal information. We do not share personal information for cross-context behavioural advertising. If our practices change, we will update this policy and provide a mechanism to opt out.

Categories of Personal Information Collected

Identifiers: Name, email address, phone number, company name, IP address.
Commercial Information: Subscription tier, billing history, service usage records.
Internet Activity: Browser type, pages visited, interaction data, device information.
Professional Information: Job title, company affiliation, industry.
Geolocation Data: Approximate location derived from IP address (precise location only from IoT devices with explicit consent).

11. IoT & telemetry data

Powoflow collects and processes telemetry data from IoT devices, sensors, and locally installed hardware. This section describes how that data is handled.

11.1 Types of Sensor Data Collected

GNSS Locations: GPS coordinates from fleet trackers and mobile assets.
Environmental Readings: Temperature, humidity, pressure, wind speed, and other environmental sensor data.
Device Telemetry: Battery levels, connectivity status, signal strength, firmware versions, and device health metrics.
Operational Data: Equipment run hours, fuel consumption, vibration readings, and other operational parameters.

11.2 Data retention

Sensor readings are kept for as long as the workspace exists. Tracker positions and SOS events are kept for 90 days, and alarm history for one year. Changing plan does not shorten any of these. A workspace administrator can delete a tracker, which removes its position history, or ask us to remove data sooner.

11.3 Workspace separation

Each workspace's data is kept separate from every other workspace's. It is visible to that workspace's users, and to our staff when they support the service.

11.4 Tags carried by people

If your employer or a site you visit gives you a tag, that organisation decides why and how it is used, and it is responsible for telling you. We process the tag's location and SOS data on its behalf. Ask that organisation first if you want to see or remove your data, or contact us and we will pass your request on.

12. Sub-processors

We use the following third-party sub-processors to deliver our services:

Amazon Web Services (AWS): Cloud infrastructure, compute, storage, and database services (US regions), including Amazon Bedrock, which analyses camera images for customers who turn that on.
Cloudflare: Content delivery network (CDN), DDoS protection, serverless compute (Workers), cookieless page-view counts, and Turnstile, which checks that a website form was sent by a person.
Auth0: Authentication, identity management, and single sign-on (SSO).
Mapbox: Mapping, geocoding, and spatial data visualisation.
Stripe: Subscription billing and payments.
Meta, LinkedIn and Reddit: Not in use today. If we add advertising measurement, it runs only if you accept marketing cookies.

We maintain data processing agreements with all sub-processors and evaluate their security practices regularly.

13. Contact

If you have any questions or concerns about this Privacy Policy, please contact us at: [email protected]

For data protection inquiries, data subject access requests, or DPA requests, email: [email protected]

Last Updated: September 5, 2026