Home→Privacy Policy

Privacy Policy

Effective date: August 27, 2026 · Last updated: August 27, 2026

This Privacy Policy explains how DistributionFlow Technologies Limited collects, uses, and protects personal information across our website, platform, and installed app.

On this page

1. Who We Are

DistributionFlow ("DistributionFlow", "we", "us", or "our") is a cloud-based business management and point-of-sale (POS) platform, operated by DistributionFlow Technologies Limited. DistributionFlow provides software for inventory and stock management, sales and point of sale, customer and supplier management, purchasing, orders and delivery/distribution tracking, reporting and analytics, staff accounts and permissions, receipt generation, barcode generation and scanning, offline POS functionality, multi-branch operations, subscriptions, and in-app support.

This Privacy Policy explains what personal information we collect, how and why we use it, who we share it with, and the choices and rights available to you.

Website: https://distribution-flow.com. If you have questions about this Policy or how your information is handled, contact us at support@distribution-flow.com.

2. Who This Policy Applies To

This Privacy Policy applies to website visitors, registered business users and business owners, POS users and staff/employees using a business account, installed-app (PWA) users, people who contact our support team, and other individuals whose information may be processed through the platform.

Businesses that use DistributionFlow may also enter information about their own customers, suppliers, staff, and other contacts as part of using the software (for example, adding a retail customer's name and phone number for credit tracking). This Policy explains how DistributionFlow itself handles personal information; it does not replace a business's own responsibilities toward the people whose data it enters — see Section 4.

Controller and processor roles

Depending on the information in question, DistributionFlow acts in different roles:

  • As data controller — for account and registration data, subscription and billing records, website and marketing data, support interactions, and platform-administration and security logs, DistributionFlow determines the purposes and means of processing and is the controller.
  • As data processor / service provider — for business records a merchant enters about its own customers, suppliers, or staff (for example, POS customer credit records or supplier contacts), the merchant business is the controller of that data, and DistributionFlow processes it on that business's behalf, and in accordance with its instructions, to provide the software.

3. Information We Collect

We collect the categories of information described below. Not every category applies to every user — for example, an anonymous website visitor will not have POS/business records, and a staff member added by a business will not have subscription/billing information tied to them personally.

3.1 Account information

  • Name
  • Email address
  • Phone number
  • Password and authentication information (stored in hashed/encrypted form by our authentication provider — we do not store your password in plain text)
  • Role within a business account

3.2 Business information

  • Business name, address, and country
  • Branch/location details for multi-branch accounts
  • Business settings such as currency, timezone, and configured preferences

3.3 POS and business records entered through the platform

  • Product and stock/inventory information
  • Sales, purchases, and orders
  • Customer and supplier records entered by a business (see Section 4)
  • Receipts and delivery records
  • Staff records and permissions
  • Credit sales and outstanding balance records, where a business uses credit tracking

3.4 Technical information

  • IP address
  • Browser type and version
  • Device type and operating system
  • Installed-PWA usage signals (for example, whether the app is running in standalone/installed mode)
  • Application and error logs, including crash reports
  • Security and audit logs (for example, records of staff sign-ins and sensitive account actions)

3.5 Usage information

  • Pages and features used
  • Product usage/analytics events
  • Session and activity information

3.6 Support information

  • Support ticket conversations and messages
  • Attachments or screenshots you choose to upload to a support ticket
  • Other details you provide when contacting support

3.7 Notification information

Where you choose to enable browser/installed-app push notifications, we store the technical information needed to deliver them:

  • The push subscription endpoint issued by your browser
  • The technical subscription keys (p256dh and auth) required by the Web Push standard to encrypt notifications
  • Basic browser/device information associated with the subscription
  • Your notification preferences

3.8 Payment and subscription information

  • Subscription plan and billing cycle
  • Payment status (e.g., active, past due)
  • Transaction references and provider metadata returned by our payment provider(s)

We do not directly collect or store your full card number. Where card payment is used, card details are entered directly with, and processed by, our third-party payment provider(s) — see Section 8.

4. Information a Business Enters About Its Own Customers, Suppliers, and Staff

A business using DistributionFlow may enter information about its own customers (for example, for credit-sale tracking), suppliers, employees/staff, and other contacts.

The business is responsible for having an appropriate lawful basis and authority to provide that information to us, for the accuracy of that information, and for its own compliance obligations toward those individuals (including, where applicable, notifying them and honouring their rights). DistributionFlow processes this information to provide the software to the business, as described in Section 2.

5. How We Collect Information

  • Directly from you, such as when you create an account or contact support
  • From authorised administrators of a business account, such as when a business owner adds a staff member
  • Through your use of POS and other business operations within the platform
  • Automatically through your use of our software and devices (for example, technical and usage information described in Section 3)
  • Through cookies and similar technologies (see Section 10)
  • Through support communications
  • Through integrated third-party providers (for example, a payment provider returning a transaction reference)

6. How We Use Information

  • Providing, operating, and maintaining the DistributionFlow platform, including POS, inventory, and reporting functionality
  • Authenticating users and managing accounts and permissions
  • Supporting payment and billing functionality through our integrations
  • Managing subscriptions and billing
  • Providing customer support
  • Security, fraud prevention, and abuse detection
  • Troubleshooting and maintaining backups
  • Analytics and improving our product
  • Communicating with you, including service, security, and (where you have opted in) marketing communications
  • Complying with legal and regulatory obligations
  • Delivering push notifications where you have chosen to enable them

7. Legal Bases for Processing

Where data protection law requires a lawful basis, we rely on one or more of the following depending on the specific processing activity — we do not rely on consent as the basis for every purpose:

  • Performance of a contract — to provide the platform to registered users and businesses under our Terms of Service
  • Legitimate interests — for example, security, fraud prevention, and improving our product, balanced against your rights
  • Legal obligation — for example, retaining certain financial or transaction records, or responding to lawful requests from authorities
  • Consent — for example, optional marketing communications, or where enabling a browser feature (like push notifications) requires your permission

8. Payment and Financial Service Providers

DistributionFlow Technologies Limited is not a bank and is not itself a payment processor, deposit-taking institution, money-transfer operator, or other regulated financial institution, unless separately licensed to act as such.

Where payment functionality is available on the platform, DistributionFlow integrates with duly licensed third-party payment providers — such as Paystack — to process payments. These providers process payment information under their own privacy policies and their own regulatory obligations, and may collect information (such as full card details) directly that DistributionFlow never receives.

DistributionFlow does not become a bank or payment processor merely because its software integrates with these providers, and does not itself hold customer funds.

9. Analytics

We use PostHog, a product analytics provider, to understand how our website and platform are used and to help us improve them. PostHog may collect information such as pages viewed, features used, device/browser information, and — for logged-in users — information linked to your account.

This analytics data is not fully anonymous: where you are logged in, usage events may be associated with your user account. We also use PostHog to help capture application errors so we can diagnose and fix issues.

10. Cookies and Similar Technologies

We use cookies and similar technologies (such as browser local storage) for the following categories of purpose:

  • Strictly necessary — required for core functionality, such as keeping you signed in and maintaining your session
  • Preferences — remembering settings such as a device name or a previously chosen tab or view
  • Analytics — used by our analytics provider (Section 9) to understand product usage

You can control or delete cookies through your browser settings, and blocking some cookies may affect how the platform functions (for example, staying signed in). Where applicable law requires prior consent for non-essential cookies, we are working to strengthen the consent controls on our website; in the meantime, please use your browser's cookie controls if you wish to limit non-essential cookies.

11. Push Notifications

If you install DistributionFlow as a PWA or use it in a supported browser, you may choose to enable push notifications (for example, for support replies or business alerts). Enabling push notifications is entirely optional and is never required to use the platform.

If you enable push notifications, we store the technical subscription information described in Section 3.7 so we can deliver notifications to your device. You can revoke notification permission at any time through your browser or device settings, which stops further notifications from being delivered.

12. Offline POS Functionality

To support selling when there is no internet connection, certain POS data (such as products and pending sales) may be temporarily cached or stored locally on your device. This data syncs to our servers automatically once connectivity returns.

Because this data is stored on your device while offline, the security of that device is also your and your business's responsibility — for example, using a passcode or device-level encryption on shared POS devices.

13. Barcode Scanning and Camera Access

Where barcode scanning is used, the platform may request access to your device's camera to read a barcode. Camera frames are processed on your device to decode the barcode and are not uploaded or stored by DistributionFlow.

Separately, some features do store images you choose to upload — for example, product images, delivery proof-of-delivery photos, and files attached to a support ticket. These are stored as part of the relevant business record or support ticket, not as part of barcode scanning.

14. Who We Share Information With

We do not sell your personal information. We may share information with:

  • Hosting and infrastructure providers that run our servers and database
  • Payment providers, such as Paystack, where payment functionality is used
  • Analytics providers (PostHog)
  • Email, SMS, and WhatsApp providers used to deliver notifications and transactional messages
  • Support and other service providers who help us operate the platform
  • Professional advisers (for example, auditors or legal counsel), where necessary
  • Regulators or law enforcement, where required by law

Sharing with these providers does not mean information is "never shared" — it means it is shared only as necessary to operate the service, under appropriate contractual terms, and never sold.

15. International Data Transfers

DistributionFlow and the service providers we use may process and store information in countries other than the one you are in. Where information is transferred internationally, we aim to use providers that apply appropriate safeguards. We have not yet completed a full cross-border transfer documentation review; if you have specific questions about where your data is processed, contact us at support@distribution-flow.com.

16. Data Retention

We retain personal information for as long as necessary for the purposes described in this Policy, taking into account:

  • Active account data — for as long as your account remains active
  • Subscription and financial/transaction records — for as long as necessary to meet accounting, tax, and legal obligations
  • Customer support records — for as long as necessary to resolve your query and for a reasonable period afterward for quality and dispute-resolution purposes
  • Logs and security data — for a limited operational period necessary for security and troubleshooting
  • Backups — retained for a limited period in line with our backup practices, after which they are rotated out
  • Deleted accounts — after a request to close an account, we retain data for a limited period to allow export or reactivation, then delete or anonymize it unless we are required or permitted by law to keep it longer

We have not fixed a single universal retention period for every category above; where a specific period applies to a particular record type, we will make that clear on request.

17. Data Security

We use reasonable technical and organizational measures to protect information, including:

  • Authentication and access controls
  • Tenant isolation between different businesses' data
  • Role-based permissions, including the ability to restrict staff to specific branches on multi-branch accounts
  • Encryption of data in transit
  • Database access restrictions
  • Audit and security logging of sensitive actions
  • Regular backups

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

18. Your Privacy Rights

Depending on where you are located and applicable law, you may have rights including to:

Nigeria

  • If you are in Nigeria, you may have rights under the Nigeria Data Protection Act 2023, and may lodge a complaint with the Nigeria Data Protection Commission (NDPC).

United Kingdom

  • If you are in the UK, you may also have rights under UK data protection law, and may lodge a complaint with the Information Commissioner's Office (ICO), where applicable to your circumstances.
  • Be informed about how your information is processed
  • Access the personal information we hold about you
  • Correct (rectify) inaccurate or incomplete information
  • Request deletion or erasure of your information, subject to legal or contractual retention requirements
  • Restrict certain processing
  • Object to certain processing, including for direct marketing
  • Receive your data in a portable format, where technically feasible
  • Withdraw consent at any time, where processing is based on consent, without affecting processing carried out before withdrawal
  • Rights relating to solely automated decision-making with legal or similarly significant effect, where applicable — DistributionFlow does not currently use automated decision-making of this kind

These rights are not absolute and may be subject to exceptions under applicable law. To exercise any of these rights, contact us at support@distribution-flow.com.

19. Children's Privacy

DistributionFlow is intended for business use by adults and authorised business representatives, and is not designed or directed at children. We do not knowingly collect personal information from children.

20. Account Deletion

You may request deletion of your account by contacting support@distribution-flow.com. We may ask you to verify your identity before completing a deletion request.

Some transactional or legal records may need to be retained after account closure to meet accounting, tax, or legal obligations. Where a business account has multiple staff, business data entered by the account may also be subject to the business's own contractual or legal retention requirements, and deletion of the overall business account may need to be requested by an authorised administrator.

22. Changes to This Policy

We may update this Privacy Policy from time to time. Where changes are material, we will make reasonable efforts to notify registered users (for example, by email or an in-app notice). Continued use of the platform after an update takes effect constitutes acceptance of the revised Policy, to the extent permitted by applicable law.

23. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

Email: support@distribution-flow.com — DistributionFlow has not appointed a formal Data Protection Officer; privacy enquiries are handled by our support team.

Have questions?

Our team is happy to clarify any part of this document.