Privacy Policy

ShopFlowOP is operated by ShopFlowOP (ABN 71 697 277 795), with a registered address in Sydney, NSW, Australia. You can reach our privacy contact at [email protected].

We collect personal information you provide directly, and operational data we need to run the service:

• Account information — name, email, password (stored hashed), workshop name, role.
• Workshop content — the customer, vehicle, job, quote, invoice, supplier, parts, photo, and document records you and your team enter or upload.
• Usage and security data — IP address, browser and device metadata, request logs, and authentication events, used for security, audit, and abuse prevention.
• Optional integration tokens — if you connect an external service (for example, Gmail for sending), we store OAuth tokens encrypted at rest with an application-held key.

• To operate, maintain, and secure the service.
• To deliver features you use (quotes, invoices, notifications, parts search).
• To communicate with you about your account, updates, and support.
• To meet legal, tax, and accounting obligations.
• To improve the product, using aggregated and de-identified data.

We do not sell personal information, and we do not use your workshop data to train third-party AI models.

Your data is stored on Supabase (PostgreSQL and object storage) in an Australian region. All data is encrypted in transit (TLS) and at rest. Each workshop is tenant-isolated at the database layer, so users from one workshop cannot access another workshop's data.

We share limited data with the trusted service providers needed to operate the service, each under their own privacy terms:

• Supabase — database and file storage.
• Railway — API hosting.
• Vercel — web hosting.
• Resend — transactional email (e.g. invoices, invites, purchase orders).
• Anthropic (Claude AI) — only when you use AI features (parts-receipt extraction). We send only the photos or text you submit for analysis; no other workshop or customer data is sent. We do not use your data to train AI models.
• eBay (Browse API) — only when you use the parts-search feature, with the search terms you enter; no workshop or customer data is sent.

We will not transfer personal information overseas other than via the hosting providers above and any further providers will be disclosed when added.

Under Australian privacy law you have the right to:

• access the personal information we hold about you (APP 12),
• correct it if inaccurate (APP 13),
• request a full export of your workshop's data,
• request deletion of your account and workshop data, subject to any legal retention obligation.

Email [email protected] for any of the above.

We retain your data for as long as your account is active. If you cancel, we keep it accessible for 30 days for export, then delete it on request. Certain operational logs (security and audit) are retained for up to 12 months.

We follow the Notifiable Data Breaches scheme. If a data breach is likely to result in serious harm to you, we will notify both you and the Office of the Australian Information Commissioner (OAIC) as soon as practicable.

We use a small number of strictly necessary cookies — primarily, a signed authentication cookie used to keep you logged in. We do not use third-party advertising or analytics cookies on the web app.

ShopFlowOP is a business product not intended for use by anyone under 18. We do not knowingly collect personal information from children.

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change. We will notify you of material changes via email or in-app.

If you have a privacy concern, please contact [email protected] first so we can try to resolve it directly. If you are not satisfied, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.