Data Processing Policy

1. Scope and contact

ExportFlow supports purchasing and export shipments. For questions about processing, access, correction or deletion, use the email below. Registered users may also ask in a request chat for their enquiry to be forwarded to the administrator.

The seller and other parties to a transaction are identified in its agreement. They may independently process information needed for their obligations. This policy does not replace their notices and is not blanket consent to every use of information.

2. Information used

Account information includes your name, work email, company affiliation, role, activation status and authentication information. Passwords are stored as protected hashes. Company profiles may contain addresses, registration and tax numbers, representatives' contacts, bank details, signatures and stamps.

Request information includes products, specifications, quantities, packaging and carton-marking requirements, delivery addresses and dates, offers, contracts, invoices, payment evidence, photographs, attachments, messages, translations, approvals and change history. Business documents may contain signatories' and contact persons' personal information.

Website operation uses session identifiers, language preferences, activity and technical error information. The infrastructure receives an IP address and browser information when you contact the server. The region supplied by that infrastructure and the browser language help select the interface language; precise device geolocation is not requested for this purpose.

3. Sources and necessary information

Information comes from you, authorised company employees, managers and participants in the relevant shipment. You must have a lawful basis for supplying another person's information or a document signed by them.

Fields needed for an action are marked in the form; the action cannot be completed without them. Do not upload passwords, card security codes, electronic-signature private keys or unrelated medical, identity or other sensitive records. Remove unnecessary information from files where possible.

4. Purposes and grounds

Information is used for registration and access checks, reviewing requests, approving offers, preparing documents, messaging, recording payment confirmations, coordinating production and delivery, support, preventing misuse, and meeting applicable recordkeeping obligations.

The ground depends on the purpose and applicable law: entering into or performing a contract with the individual concerned, a legal obligation, consent or another legally available ground. A company contract does not itself replace the required ground for processing its employees' information. Accepting website terms or reading this policy does not replace separate consent where required.

5. Who can access information

The server checks access to requests and files according to role, company and manager assignment. Clients can access information permitted for their account; assigned managers and administrators have access to handle the work and manage the service. Request chats are not hidden from administrators. An administrator's viewing does not change the manager's read indicator.

Factories, inspectors, carriers, customs representatives and other shipment participants may receive information needed for the agreed work. Banks and public authorities receive information where there is an appropriate basis. Unrelated documents or other clients' data must not be shared with them.

6. Technical services and international processing

The current hosted version uses Sites and Cloudflare infrastructure for the application, database and file storage. Technical providers may process information needed to supply these services. Account sign-in uses email and password and does not require a ChatGPT account.

When translation is configured, the selected message text and target language are sent to the OpenAI API. Translation is a separate user action: generating an ordinary document from a template does not itself send that document to the translation service. Exclude information that should not be sent to an external provider.

Work with suppliers and managers in China and international shipment participants may involve cross-border transfers. Hosting countries, technical providers' retention periods and applicable safeguards depend on the services and their settings; you may request details relevant to your processing using the contact below. This policy does not itself permit a transfer without the required lawful basis or separate consent where necessary.

7. Cookies and browser storage

A session cookie provides access to protected areas. In the current hosted version, a normal session lasts up to 12 hours and ends on logout or revocation. The language preference cookie lasts up to one year; the preference may also be stored locally in the browser.

The browser may store request drafts and viewed-notification markers. Local storage has no general automatic expiry; it is cleared by the relevant application action or by clearing site data in the browser. Clearing it may remove an unsaved draft but does not delete information already sent to the server. Sign out and clear local data on shared devices.

The application code does not include advertising pixels or optional advertising analytics. If optional tracking technologies are added, their purposes and required choices must be disclosed before use.

8. Retention and deletion

Accounts, requests, messages and files are kept for working with orders and documents. Necessary retention depends on the transaction's status, applicable accounting, tax and customs requirements and the handling of disputes. Retention must not continue without an appropriate basis.

Archiving does not delete a request. Completing an order or closing an account does not automatically delete all documents. The current application has no single automatic expiry period for all requests and files; deletion requests are considered individually. Ask the contact below about periods for particular data categories and backups.

Where law requires particular records to be kept, deletion may be limited for the necessary period and further use must be limited to that purpose. Removing an item from the working interface does not confirm removal of all copies held by transaction participants or in backup storage.

9. Protection and automated functions

The application uses authentication, access controls, upload checks and HTTPS in the hosted version. These measures reduce risk but do not guarantee absolute security. Report suspected disclosure or unauthorised access to the administrator promptly without sharing passwords or secret keys.

Document population, calculations and translations are assistance features. Account activation and workflow approvals are performed by authorised people. Ask the manager to review an incorrect automated result.

10. Your rights and requests

Subject to applicable law, you may request information about processing, access or a copy, correction, deletion, restriction or portability, object to processing or withdraw consent where it is the basis. Withdrawal does not invalidate earlier lawful processing or remove another valid retention ground.

Identify the work email associated with your account, the information concerned and your requested action. Proportionate identity and authority checks may be needed to protect information. Requests must be handled within the period required by applicable law, with any lawful restriction explained. You may complain to a competent data protection authority or pursue other available remedies.

11. Policy updates

The current version is available here with its revision date above. A text update does not replace a separate notice or consent required for a new processing purpose. Send questions about differences between language versions to the contact below.