Privacy Policy

Effective date: November 14, 2026

Powoflow is provided by Powotech LTD. (“we”, “us”). We are committed to protecting your privacy. This Privacy Policy outlines how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

1. Information we collect

1.1 Personal Information

We may collect personal information that you voluntarily provide when you:

Register or create an account on our site
Subscribe to our newsletters or other communications
Make inquiries or request information about our services
Participate in surveys or promotions

Personal information may include your name, email address, phone number, company name, and any other details you provide.

If you arrive from a campaign link and send us a form, the form records which campaign the link belonged to, so we can tell which of our messages people respond to. Until you send it, that stays in the page’s memory, not in a cookie, and is forgotten when you close or reload the page.

1.2 Collected automatically

Visiting a page on this site records the following, and nothing else:

The page you viewed and the page that referred you to it
Your browser and operating system family, for example “Safari on macOS”, not a version fingerprint
Your country, derived by our content delivery network. Not your city, and not your IP address, which is used to route the response and is not retained by us
Page performance timings, so we can tell whether the site is slow for real visitors

These are aggregate counts. There is no identifier tying one page view to another, which means we cannot reconstruct an individual visitor’s path through the site, by design, not by policy.

2. How we use your information

To answer you. If you send an enquiry, we use what you wrote to reply to it and to prepare for the conversation. That is the only reason we hold it. We keep an enquiry for 24 months after you send it, then delete it.
To see which pages are worth keeping. Aggregate page-view counts tell us what people read and what loads slowly. They cannot tell us who, because nothing here identifies a visitor.
To keep the site up. Abuse prevention and rate limiting by our content delivery network.

We do not personalise the site to you, do not build a profile from your browsing, and do not sell, rent or share anything with advertisers or data brokers. We run no marketing list. If that changes, you will be asked to join it rather than added to it.

3. Cookies

Our cookie policy lists what this website stores in your browser. It uses no marketing cookies today. If we add any, they will stay off unless you accept them, and you will be able to change your choice at any time. Page-view analytics are cookieless.

4. Sharing and disclosure of information

We do not sell, trade, or otherwise transfer your personal information to third parties without your consent, except in the following cases:

Service Providers: We may share your information with trusted third-party vendors and partners who assist us in providing our services.
Legal Requirements: We may disclose your information if required by law or to protect our rights, property, or safety, or that of others.
Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the new owner.

5. Data security

We implement a variety of security measures to protect your personal information. These include secure servers, encryption, and restricted access controls. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

6. Your rights and choices

You have the following rights regarding your personal data:

Access: You can ask to see the personal information we hold about you.
Correction: You have the right to correct or update your information.
Deletion: You can request the deletion of your personal data under certain circumstances. Copies in our event archive expire on their own, after up to 30 days (see 11.2).
Opt-Out: You can opt-out of marketing communications or restrict how we use your data.

To exercise these rights, please contact us at [email protected].

7. Children's privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal information from children.

8. Changes to this privacy policy

We may update this Privacy Policy from time to time. Any changes will be reflected on this page, and the updated policy will indicate the effective date.

9. Your rights under GDPR

If you are located in the European Economic Area (EEA), the following additional provisions apply to the processing of your personal data:

9.1 Legal Basis for Processing

We process personal data under the following legal bases:

Legitimate Interest: For service delivery, operating Powoflow, and security monitoring necessary to provide the Powoflow service, and for answering enquiries you send us.
Consent: For marketing cookies, if we add any, and marketing email you sign up for. You may withdraw consent at any time.
Contractual Necessity: To fulfill our obligations under your subscription agreement.

9.2 Data Subject Rights

Under the GDPR, you have the right to:

Access: Obtain confirmation of whether your personal data is being processed and request a copy.
Rectification: Request correction of inaccurate or incomplete personal data.
Erasure: Request deletion of your personal data where no compelling reason for continued processing exists.
Portability: Receive your personal data in a structured, commonly used, machine-readable format.
Restriction: Request limitation of processing under certain circumstances.
Objection: Object to processing based on legitimate interests or for direct marketing purposes.

9.3 Data Processing Agreements

Every customer, on every plan, can have a Data Processing Agreement (DPA) with us for the personal data they put into Powoflow. Contact [email protected] for a copy.

9.4 International Data Transfers

Powoflow infrastructure is hosted in the United States. For data transferred from the EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission. Copies of the applicable SCCs are available upon request.

Where your data is processed

We run the service from the United States, wherever you are. If you are in the European Economic Area, including Norway, your personal data is transferred to the United States under the European Commission’s Standard Contractual Clauses. Ask us for a copy at [email protected].

10. CCPA/CPRA compliance

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with additional rights:

Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
Right to Delete: You may request that we delete personal information we have collected from you, subject to certain exceptions.
Right to Opt-Out: You may opt out of the sale or sharing of your personal information.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

Do Not Sell or Share My Personal Information

Powoflow does not sell personal information. We do not share personal information for cross-context behavioural advertising. If our practices change, we will update this policy and provide a mechanism to opt out.

Categories of Personal Information Collected

Identifiers: Name, email address, phone number, company name, IP address.
Commercial Information: Subscription tier, billing history, service usage records.
Internet Activity: Browser type, pages visited, interaction data, device information.
Professional Information: Job title, company affiliation, industry.
Geolocation Data: Approximate location derived from IP address (precise location only from IoT devices with explicit consent).

11. IoT & telemetry data

Powoflow collects and processes telemetry data from IoT devices, sensors, and locally installed hardware. This section describes how that data is handled.

11.1 Types of Sensor Data Collected

GNSS Locations: GPS coordinates from fleet trackers and mobile assets.
Environmental Readings: Temperature, humidity, pressure, wind speed, and other environmental sensor data.
Device Telemetry: Battery levels, connectivity status, signal strength, firmware versions, and device health metrics.
Operational Data: Equipment run hours, fuel consumption, vibration readings, and other operational parameters.

11.2 Data retention

Sensor readings, tracker positions, SOS events and alarm history are kept for as long as the workspace exists. A workspace administrator can choose a shorter period for positions, SOS events and alarm history in Settings, no less than 90 days, and it applies to records made after the change. Changing plan does not shorten any of these. Positions and SOS events recorded before November 10, 2026 may still carry the expiry that applied when they were recorded, and are removed when it passes. A workspace administrator can delete a tracker, which removes its position history, or ask us to remove data sooner.

Event archive. The service also keeps an archive of the events that pass between its parts, such as an alarm being raised, a work order changing or a lone-worker check-in starting. Some events carry personal data: a name, an email address, the first 140 characters of a comment, or the contact details given for a lone-worker check-in. Single events cannot be deleted from the archive, so each one is removed when it expires, after up to 30 days. When we delete your data, a copy can stay in the archive until then.

11.3 Workspace separation

Each workspace's data is kept separate from every other workspace's. It is visible to that workspace's users, and to our staff when they support the service.

11.4 Tags carried by people

If your employer or a site you visit gives you a tag, that organisation decides why and how it is used, and it is responsible for telling you. We process the tag's location and SOS data on its behalf. Ask that organisation first if you want to see or remove your data, or contact us and we will pass your request on.

12. Our apps

Powoflow has two apps: the Powoflow mobile app, available to selected customers until its store release, and Powoflow Ops, which runs wall screens on Apple TV, iPad and iPhone. Both work with a Powoflow workspace; Powoflow Ops can also show sample walls without one (12.2). What they send goes to that workspace and is kept separate from every other workspace (see 11.3).

12.1 The mobile app

Your location. If you allow it, the app sends your phone’s location to your workspace while you are signed in, a few minutes at a time, and stops when you sign out. Your workspace uses it to show you on its map, to alert you near its sites, to stop you before you enter a zone you need a permit for, and to see afterwards where people were. The people your workspace allows can see this trail. It is kept with your workspace’s data until it is deleted.
Photos, recordings and notes you add to assets, work orders or inventory are stored in your workspace.
Voice input. When you dictate, your phone’s own speech recognition turns your speech into text (on an iPhone, Apple’s). We receive only the text you keep.
Notifications. To send you alarms and other notifications, the app registers your phone’s notification token with us. Notifications are delivered through Google Firebase Cloud Messaging and Apple’s push notification service.
Crash reports. If the app fails, it sends us the error and where in the app it happened, with your account, so we can fix it.
Kept on your phone. Face ID, and the camera and Bluetooth when they scan a code or set up a printer or sensor, work on the phone. What they read reaches us only as part of a record you save.

12.2 Powoflow Ops (Apple TV, iPad and iPhone)

A wall screen shows your workspace’s data and never changes it. It has no sign-in of its own: it shows a code, and a workspace administrator approves it. We record who approved it and when, and the workspace’s screen settings show both. After that, the screen sends us:

a random identifier made when the app is installed, and a key the screen uses to prove it is the same screen;
the device’s model, and its operating system and app versions.

Before it is added, a screen can show sample walls (“Try a demo”). They are made-up data built into the app, and showing them sends nothing to us.

It collects nothing about the people in the room. What it shows, such as the positions of tagged people or vehicles, is your workspace’s data (see 11). The screen’s record stays in the workspace, marked as removed, after an administrator removes the screen.

12.3 Network addresses

Our servers log the network (IP) address of each request the apps make, for security and troubleshooting. These logs are deleted after 30 days.

13. AI features

Some features use a third-party AI service: the assistant, reading photos (equipment for a new asset or work order, gauges, nameplates and documents), searching documents, help writing a work order or a checklist, and analysing camera images.

Only when you allow it. In the mobile app, nothing is sent to the AI service until you allow it. With “Not now” the AI features stay off and nothing is sent. You can change your choice at any time in Settings → AI features. Camera image analysis runs only for workspaces that turn it on.
What is sent. Only what the request needs: what you type or say, the photos and documents you include, and details of the assets, work orders and alarms the request is about. For a new asset made from photos, that includes its location, usually where you are.
What it is used for. Only to do what you asked: answer your question, read the photo or document, or draft the text.
Never for training. Your data is never used to train AI models without your permission.
Who provides it. A third-party AI service, under a data processing agreement. Ask us at [email protected] and we will tell you which.
Files in your workspace. Separately from the choice in the app, files attached to assets and work orders may be read by the same AI service, on our servers, so that they can be searched.

14. Sub-processors

We use the following third-party sub-processors to deliver our services:

Amazon Web Services (AWS): Cloud infrastructure, compute, storage, and database services (US regions).
AI service: The third-party AI service behind the features in section 13, under a data processing agreement. Ask us and we will tell you which.
Cloudflare: Content delivery network (CDN), DDoS protection, serverless compute (Workers), cookieless page-view counts, and Turnstile, which checks that a website form was sent by a person.
Auth0: Authentication, identity management, and single sign-on (SSO).
Mapbox: Mapping, geocoding, and spatial data visualisation.
Stripe: Subscription billing and payments.
Google Firebase Cloud Messaging and Apple Push Notification service: Delivering notifications to the mobile app.
Meta, LinkedIn and Reddit: Not in use today. If we add advertising measurement, it runs only if you accept marketing cookies.

We maintain data processing agreements with all sub-processors and evaluate their security practices regularly.

15. Contact

If you have any questions or concerns about this Privacy Policy, please contact us at: [email protected]

For data protection inquiries, data subject access requests, or DPA requests, email: [email protected]

Last Updated: November 14, 2026