Legal
Privacy policy
Last updated: 15 July 2026 · Placeholder draft — not final legal advice. Replace with counsel-reviewed text before production marketing claims.
1. Who we are
Nexoform Ltd ("Nexoform", "we") provides Flow, a business workspace for kitchen, bedroom and bathroom companies. Contact details for privacy requests will be published here when finalised (placeholder: privacy@nexoform.io).
2. Data we process
Depending on how you use Flow, we may process:
- Account data (email, name, authentication factors)
- Organisation and business content you enter (customers, quotes, catalogues, etc.)
- Billing and subscription data via Stripe
- Technical logs and performance metrics (see cookies & analytics)
3. Cookies & similar technologies
We use cookies and browser storage as set out below. Strictly necessary and functional items work without consent. Optional analytics only run if you Accept on our cookie banner (or re-enable via Cookie settings in the footer).
| Name | Purpose | Type | Category |
|---|---|---|---|
| sb-*-auth-token | Supabase sign-in session (access / refresh tokens) | Cookie | Strictly necessary |
| nexoform_active_org | Caches organisation id for signed-in app performance | Cookie (30 days) | Functional |
| nexoform_cookie_consent | Remembers Accept / Reject for analytics | Cookie + localStorage | Strictly necessary |
| color-theme | UI colour theme preference | localStorage | Functional |
| theme-fonts-enabled | Whether theme fonts load | localStorage | Functional |
| sidebar-mode | Dashboard sidebar layout mode | localStorage | Functional |
| marketing-theme-preview | Temporary marketing theme sampler preview | sessionStorage | Functional |
| Vercel Speed Insights | Anonymous Web Vitals / performance metrics (route, device, browser, country). Loaded only with analytics consent. | Script / beacon | Analytics (optional) |
4. Processors & third parties
- Vercel — hosting and optional Speed Insights
- Supabase — authentication and application database
- Stripe— payments and billing portal (cookies may be set on Stripe's domains when you pay)
- Resend — transactional email (e.g. invites), where used
- Google Fonts— may receive your IP when fonts load from Google's CDN
5. Your rights
Depending on applicable law (including UK GDPR / EU GDPR), you may have rights to access, rectify, erase, restrict, object, or port your personal data, and to withdraw consent where processing is based on consent. You may also complain to your supervisory authority (e.g. the ICO in the UK).
6. Cookie choices
Use the cookie banner on first visit, or Cookie settings in the site footer, to change your analytics preference. Necessary cookies for sign-in cannot be disabled if you use the product.
7. Changes
We may update this page as the product and processors change. Material cookie-category changes may prompt the banner again (consent version bump).