Privacy Policy

1. About this notice

This privacy notice explains how PlantFlow (“PlantFlow”, “we”, “us”, “our”) processes personal data when you visit our website at plantflow.co.uk, register a hire company, use the PlantFlow operations platform as a staff member of a hire company, or use the customer portal of a hire company that runs on PlantFlow.

PlantFlow is a multi-tenant SaaS platform for plant and machinery hire companies in the United Kingdom. For most personal data on the platform (equipment records, hire requests, invoices, customer accounts) the hire company that operates the relevant workspace is the data controller, and PlantFlow acts as a data processor on their behalf. For data relating directly to our relationship with you (marketing emails, account creation on our marketing site, analytics on plantflow.co.uk), PlantFlow is the data controller.

2. Who we are and how to contact us

PlantFlow
United Kingdom
Privacy enquiries: [email protected]

You have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

3. The personal data we collect

3.1 Information you give us

• Account and company details – name, business email address, company name, role and password (stored only as a one-way hash).
• Hire and operations data – equipment records, hire requests, delivery / collection addresses, agreed rates, inspection notes, service schedules and engine hours.
• Billing information – subscription tier, invoice records and a Stripe customer ID. Card details are entered directly on Stripe-hosted pages and are never seen or stored by PlantFlow.
• Communications – emails sent through our notification system (invoices, signup alerts) and any messages you send to our support team.

3.2 Information collected automatically

• Authentication cookies set by NextAuth so you remain signed in.
• Security data such as IP address, browser user-agent and access timestamps used to detect abuse and for audit logging.
• Usage analytics via Google Analytics 4 – only when you have accepted analytics cookies (see Section 7).

4. How and why we use your data

• To provide the service (legal basis: contract, or legitimate interest for portal customers of our tenants) – manage your account, run your fleet, process hire requests and generate invoices.
• To take payments and manage subscriptions (legal basis: contract) – process Stripe Checkout, billing and the customer portal.
• To keep the service secure (legal basis: legitimate interest) – detect fraudulent sign-ups, prevent abuse, maintain audit logs.
• To send operational emails (legal basis: contract) – invoice delivery, password resets, important service notices.
• To improve PlantFlow (legal basis: consent) – aggregated analytics about how the public marketing site is used.

5. Third-party services we share data with

PlantFlow only shares personal data with the carefully selected processors below, and only to the extent strictly necessary to provide our service. We do not sell your personal data.

• Stripe Payments Europe, Ltd. – processes subscription payments and invoices. When you enter card details, you do so on Stripe’s servers. Stripe acts as an independent data controller for fraud prevention. Stripe privacy policy.
• Google LLC – Google Analytics 4 – only if you have given analytics consent. GA4 collects an anonymised client ID, pages viewed, screen size, approximate location and referrer. IP addresses are not stored by GA4. Google privacy policy.
• Abacus.AI, Inc. – our hosting and platform provider in the United States. Data is transferred under appropriate safeguards (UK International Data Transfer Addendum / SCCs).
• Email delivery – we send operational emails (invoices, notifications) using our hosting provider’s SMTP infrastructure.

6. International transfers

Some of our processors (Stripe, Google, Abacus.AI) are based outside the United Kingdom. Where data is transferred outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses to ensure your data receives an equivalent level of protection.

7. Cookies and similar technologies

We use three categories of cookies on plantflow.co.uk and any custom domain running on PlantFlow:

• Strictly necessary – authentication, CSRF protection, the “remember my cookie choice” preference itself. These do not require consent under PECR.
• Analytics – _ga and _ga_* from Google Analytics 4. Loaded only after you accept analytics cookies.
• Payments & fraud prevention – __stripe_mid, __stripe_sid from Stripe, only on pages where a checkout or billing portal is initialised.

You can change your cookie choices at any time via the “Cookies” link in the footer or by clearing your browser storage.

8. Data retention

• Active accounts – retained for as long as you (or the tenant that controls your account) maintain a relationship with PlantFlow.
• Billing and tax records – retained for at least 7 years (HMRC requirement).
• Operational logs – typically 90 days.
• Analytics – GA4 default retention of 14 months.

When a tenant closes its account, personal data within that workspace is deleted or anonymised within 90 days, except where we are required by law to retain it.

9. Your rights under UK GDPR

You have the right to:

• request a copy of the personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• ask us to erase personal data where there is no good reason for us to continue processing it;
• object to processing based on legitimate interests;
• request restriction of processing;
• request portability of data you have provided to us;
• withdraw consent at any time (for example by toggling analytics cookies off);
• lodge a complaint with the UK Information Commissioner’s Office.

To exercise any of these rights, please email [email protected]. If your account is operated by a hire company on PlantFlow, please contact that company first, as they are the controller of most of your data.

10. Security

PlantFlow uses TLS encryption in transit, encrypted storage at rest, hashed and salted passwords, role-based access control, tenant data isolation and routine security reviews. No system is perfectly secure, but we work hard to protect your information.

11. Changes to this notice

We may update this notice from time to time. Material changes will be highlighted on the website. The effective date at the top of this page tells you when the notice was last updated.