Privacy Policy

rflow is an independent web design and AI automation studio. We build websites and digital workflows for small businesses across the US and UK. Our contact address is hello@rflow.dev.

This Privacy Policy explains how we collect, use, and protect information you share with us — whether through our website, contact form, or during a project engagement.

We only collect information you actively provide to us. This includes:

• Contact details — name, email address, company name, and any message you send via our contact form.
• Project information — budget range, timeline preferences, service requirements, and any project details you share.
• Communication records — emails, messages, and meeting notes related to your project.

We do not collect payment information directly. Any payments are processed through third-party platforms (Stripe, Wise, or Upwork) under their own privacy policies.

Automatically collected data

Our website may collect anonymous analytics data (page views, device type, referral source) via privacy-respecting tools. This data is aggregated and never tied to an individual.

We use your information solely to:

• Respond to your enquiry and provide a project scope
• Deliver the services you have hired us for
• Send project updates, invoices, and related communication
• Improve our website and service offering (using anonymised data only)

We will never sell, rent, or share your personal information with third parties for marketing purposes.

We process your data on the following legal bases under GDPR and applicable UK data protection law:

• Contract — processing necessary to perform a contract you have entered into with us.
• Legitimate interests — responding to enquiries and running our business effectively.
• Consent — where you have explicitly agreed to receive communications from us.

We retain your personal data for as long as necessary to provide our services and comply with legal obligations:

• Contact enquiries: 12 months if no project begins, then deleted.
• Active project data: retained for the duration of the engagement plus 3 years for financial/legal records.
• You may request deletion at any time by emailing hello@rflow.dev.

We use a small number of trusted third-party tools to operate our business:

• Vercel — website hosting. Privacy policy.
• Stripe / Wise — payment processing. Your payment data is handled entirely by them.
• Google Workspace — email and documents.
• Calendly — meeting scheduling (if you use our booking link).

Each of these services has its own privacy policy. We only share the minimum data required for them to function.

Under GDPR and UK data protection law, you have the right to:

• Access — request a copy of the data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — request deletion of your personal data.
• Restriction — ask us to limit how we use your data.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interests.

To exercise any of these rights, email hello@rflow.dev. We will respond within 30 days.

Our website uses minimal cookies. See our Cookie Policy for full details.

We may update this policy from time to time. When we do, we will update the “Last updated” date at the top of this page. Continued use of our website after changes constitutes acceptance of the updated policy.