Last updated 18 October 2026
Privacy Policy
This policy explains what information Subham Bhattacharya ("we") collects when you use OrderFlow, why we collect it, and the choices you have.
Who this applies to
OrderFlow is used by suppliers (who create a workspace) and by their business clients (who are invited by a supplier to place orders). A supplier decides which clients to invite and what data to add about them; for that data the supplier is responsible and we process it on their behalf.
What we collect
- Account details: your name, email address, company name, and optionally a phone number. We store a one-way hash of your password, never the password itself.
- Business data you add: products, prices, tax rates, announcements, client details, and orders with their line items, notes and status history.
- Enquiries: if you use the contact form on our website, the name, email, company and message you send.
- Technical data: your IP address is used briefly to limit repeated sign-in attempts and to protect the service. Our hosting provider keeps standard server logs.
Cookies
We use only the cookies needed to run the service: a session cookie that keeps you signed in and protects forms against cross-site request forgery, and, if you choose "Keep me signed in", a remember-me cookie. We don't use advertising or tracking cookies.
How we use information
- To provide the service: show catalogs, place and manage orders, and send the emails the service depends on (confirming your email, password resets, invitations and order updates).
- To keep the service secure and to fix problems.
- To reply to enquiries you send us.
We don't sell personal information and don't use it for advertising.
Who we share it with
Data in a supplier's workspace is visible to that supplier's team and, for their own orders, to the client who placed them. We use a small number of service providers to run OrderFlow: a cloud hosting provider for the application and database, and an email delivery provider for transactional email. They process data only to provide those services to us.
Our pages use fonts from Google Fonts. When your browser shows a page, it downloads the fonts from Google's servers, so Google receives your IP address and details of your browser. Google Fonts doesn't set cookies; Google explains what it does with this data.
How long we keep it
We keep account and business data while the workspace is active. Orders are kept as business records. Enquiries sent through the contact form are kept for up to 12 months after we receive them and then deleted; ask us and we'll delete yours sooner. When a workspace owner asks us to delete their workspace, we delete its data within 30 days, except where we must keep it by law.
Your choices
You can update your name and password from your account settings. To get a copy of your data, correct it, or delete your account, email us at hello@subhambhattacharya.com. If you're a client of a supplier, you can also ask the supplier directly.
Security
Connections are encrypted with HTTPS, passwords are hashed, and each supplier's data is kept separate from every other supplier's. No system is perfectly secure, so please use a strong, unique password.
Changes
If we change this policy in a way that matters, we'll update the date above and, for significant changes, tell workspace owners by email.
Contact
Questions about privacy? Please email us at hello@subhambhattacharya.com.