Privacy policy: data, cookies and retention

In short: we collect what is needed to attribute orders and record payouts. Shopper phone numbers are hashed, Converty tokens are encrypted, RIB documents are visible only to the creator and their merchant. This site and the app measure usage with Microsoft Clarity (masked, never tied to your name or email); nothing is used for advertising.

1. Who is responsible

Inflow is responsible for the account data of merchants and creators. For shoppers’ order data, the merchant (the store) decides what is collected and why; Inflow processes it on the merchant’s behalf, only to attribute orders and calculate commission. We follow Tunisian personal data protection law (Organic Law No. 2004-63).

2. What we collect, and why

Data	What exactly	Why
Merchant account	Name, email, password (stored hashed), language, settings, actions log.	To run your account and keep a record of sensitive actions.
Store connection	Store name, web address, currency and country from Converty; Converty access tokens, encrypted at rest.	To read orders and create promo codes on your behalf.
Store orders	Order reference, status history, products, amounts, promo code, customer name and city. Converty sends the full order, including phone and address: we keep the phone only as a salted one-way hash plus its last 4 digits, and we do not keep the address.	To attribute orders to creators and follow delivery status.
Creator account	Name, email, social handles, phone if given, language.	To run the creator portal.
Payout details	Bank name, IBAN, account holder, tax ID, address, RIB document.	So the merchant can pay the creator.
Free product requests	Shipping name, phone, address and city entered by the creator.	So the merchant can ship the product.
Link clicks	When a shopper opens a link like `inflow.work/l/<code>`: time, a salted hash of the IP address, browser family, referrer, a random visitor ID.	To count clicks and spot suspicious patterns.
Storefront script (optional)	The link reference, a random visitor ID, products, quantities and total of the order, the page address, time, hashed IP, and the phone as a hash plus last 4 digits.	To credit shoppers who browse before ordering or come back later.

3. Who sees what

Merchants see their own orders (customer name, city, last 4 phone digits), their creators’ profiles and stats, and the payout details of creators who work with them.
Creators see their own links, clicks, orders (city, products, status and commission only), earnings and payouts. Never a customer’s name or phone number.
RIB documents are only reachable by the creator who uploaded them and the merchant they work with. They are never public.
Inflow staff access data only to operate the service, give support or investigate abuse.
Service providers (hosting, database) process data on our behalf under confidentiality obligations.

We do not sell personal data and do not use it for advertising.

4. How we protect it

Converty access tokens are encrypted at rest.
Phone numbers and IP addresses are stored as salted one-way hashes (plus the last 4 phone digits).
Passwords are stored hashed, never in clear.
Traffic is encrypted (HTTPS). Changes to payout details and payout decisions are logged, with only the last 4 IBAN digits in the log.

5. How long we keep it

We keep account, order and ledger data while the account is active. Webhook delivery records are deleted after 30 days. When an account is closed, we delete or anonymise its data within 90 days, except ledger and payout records we must keep for legal or accounting reasons. Replaced or deleted RIB documents are removed from our servers.

6. Cookies and local storage

This website uses Microsoft Clarity for anonymous usage analytics and session replay (clicks, scrolling, pages visited), to see what to improve. Clarity sets its own cookies; what you type and Nino conversations are masked in recordings. It is not loaded when your browser sends Do Not Track or Global Privacy Control. Fonts are served from our own domain.
Nino, our support chat, sets no cookie until you write to it: your first message sets one random visitor ID cookie (inflow_vid, one year) so you find your conversation and our team’s answers when you come back. Conversations are stored to answer you and improve our help pages.
Merchant app and creator portal use one session cookie to keep you signed in. It is required and is not used for tracking.
Merchant app and creator portal also use Microsoft Clarity (a separate project) to see how the product is used once you are signed in. Recordings are strictly masked (text, amounts and personal details are hidden) and linked only to an internal account ID, never to your name, email or phone number; the admin console is never recorded. Clarity sets its own cookies and is not loaded when your browser sends Do Not Track or Global Privacy Control.
Tracked links set a random visitor ID cookie on Inflow’s domain when a shopper opens one, to recognise repeat clicks. It contains no personal details.
Storefront script (optional, on the merchant’s store): stores the creator’s link reference and a random visitor ID in the shopper’s browser, first-party on the store’s domain, so a later order can be credited.

There is no cookie banner: the site uses no advertising cookies, and usage analytics are skipped whenever your browser asks not to be tracked.

7. Your rights

You can ask to access, correct or delete your personal data, or object to its use. Merchants and creators can correct most details directly in the apps. Shoppers can contact the store they bought from, or write to us and we will pass the request on. Write to hello@inflow.work; we answer within 30 days.

8. Changes and contact

If we change this policy in a meaningful way, we will say so on this page and in the apps. Questions: hello@inflow.work.