Privacy Policy

How EzFlow collects, uses, and protects your data.

Last updated: October 4, 2026

1. Introduction

This Privacy Policy explains how Dvixen Elite PM Limited ("we", "us", or "the Company"), the operator of the EzFlow platform ("the Service"), collects, uses, and protects your personal data. By registering for or using the Service, you acknowledge the practices described in this policy.

2. Data Controller

The data controller responsible for your personal data is Dvixen Elite PM Limited, a limited company registered in the Republic of Cyprus under registration number HE 480488, with its registered office at Arch. Makariou III, 140, RAPTOPOULOS BUILDING, Floor 1, Flat/Office 101Α, 3021, Limassol, Cyprus.

3. Data We Collect

We collect the following categories of data:

• Website visitors: pages viewed, approximate location derived from IP address, browser and device type.
• Demo and enquiry data: name, email address, company name, and your answer to how you heard about us, submitted when you book a demo or contact us.
• Corporate details: your company name, business address, and related corporate information provided during registration.
• Account credentials: registered email addresses and user profiles created within the app.
• Usage data: information generated as you and your team use the Service, such as records you create and activity logs tied to your account.

For personal data that you enter into the Service about your own customers, suppliers and staff, EzFlow acts as a data processor under the Data Processing Agreement in our Terms of Service. This policy covers personal data where EzFlow is the data controller.

4. How We Use Your Data

We process your personal data only where we have a legal basis under Article 6 of the General Data Protection Regulation (GDPR), as set out below:

| Purpose | Legal basis (Article 6 GDPR) | | --- | --- | | Providing and maintaining your account and workspace | Performance of a contract | | Delivering the operational, accounting and management features of the Service | Performance of a contract | | Processing subscription payments | Performance of a contract | | Responding to demo requests and enquiries | Legitimate interests in responding to business enquiries | | Keeping the Service secure and preventing misuse | Legitimate interests in protecting the Service | | Complying with accounting, tax and other legal obligations under Cyprus law | Legal obligation | | Sending marketing communications where you have opted in | Consent |

5. Cookies

The Service uses only strictly necessary session mechanisms to keep you logged in. These are essential to the functioning of the app and do not require separate consent.

With your consent, we also use the following third-party measurement tools. They are loaded only after you accept the corresponding category of cookies through our consent banner, and never before consent:

• Google Analytics (analytics — measuring site usage).
• Google Ads (marketing — measuring ad conversions).
• LinkedIn Insight Tag (marketing — measuring ad conversions and building audiences of site visitors).

You can withdraw your consent at any time using the "Cookie settings" link in the footer of the website. Your consent choice is stored for 12 months.

6. Third-Party Sharing & Processors

We share personal data only with trusted sub-processors that help us operate the Service. Each processor is listed below with what it does and where it processes data:

• Base44 — platform hosting and database, European Union.
• Stripe — subscription payment processing, European Union and United States.
• Resend and Amazon Web Services — transactional email delivery, European Union and United States.
• Google Workspace — business email correspondence, European Union and United States.
• CalendarBridge — demo booking scheduling, United States.

We do not sell personal data to any third party. We will give you notice before adding or replacing any sub-processor.

7. International Transfers

The Service and its primary database are hosted in the European Union. Some of our sub-processors are established in the United States, which means your personal data may be transferred outside the European Economic Area. Any such transfers are made under the European Commission's Standard Contractual Clauses or, where applicable, the processor's certification under the EU-US Data Privacy Framework.

8. Data Retention

We retain personal data for the following periods:

• Account and workspace data: deleted within 30 days of account closure.
• Our own billing and accounting records (subscription invoices): retained for 6 years as required by Cyprus law.
• Demo and enquiry data: 12 months from last contact.
• Marketing contact data: 24 months from last engagement or until consent is withdrawn.
• Server and security logs: 12 months.

The 6-year retention applies to our own billing and accounting records, such as subscription invoices — it does not apply to your data stored within the Service.

Once data is no longer required, it is deleted or anonymized in accordance with applicable retention schedules.

9. Your Rights Under GDPR

As a data subject located in the European Economic Area, you have the following rights regarding your personal data:

• The right to access the personal data we hold about you.
• The right to request rectification of inaccurate data.
• The right to erasure — you may request at any time that your access to the Service be closed and that all of your personal data held by the Company be deleted.
• The right to restrict or object to processing.
• The right to data portability.
• The right to withdraw consent at any time.
• The right to lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus.

To exercise any of these rights, contact us at hello@ezflow.solutions.

10. Account Closure & Data Deletion

You may request to close your account at any time. You may export your data from the Service at any time before closure. Upon such a request, we will terminate your access to the Service and delete all personal data associated with your account, except where retention is required to comply with a legal obligation under Cyprus law.

11. Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.

12. Contact

For any questions or requests regarding this Privacy Policy or your personal data, please contact us at hello@ezflow.solutions.