Privacy Policy

This Privacy Policy explains what information Mizan Flow ("we", "us") collects when you use our financial and accounting platform, why we collect it, and how it's handled.

We collect the following categories of information:

• Account information — name and email address when you sign up, handled via our authentication provider (Supabase).
• Store and order data — revenue, order, and refund events synced from any e-commerce platform you connect (Salla, Zid, Shopify, or WooCommerce).
• Financial data you enter — product costs, expense records, and related figures you add manually to compute profitability.
• AI Advisor conversations — messages you send to the AI Financial Advisor, along with the financial snapshot used to answer them, are sent to our AI provider (Anthropic) to generate a response.
• Subscription and billing status — whether your workspace is on a trial, active, or expired plan, managed through our billing provider (Tap Payments). We do not receive or store your payment card details.

• To operate and display your dashboard, analytics, and product profitability figures.
• To power the AI Financial Advisor with accurate, workspace-specific context.
• To manage your subscription and restrict access when a trial or subscription lapses.
• To detect and prevent abuse (e.g. rate-limiting excessive requests).

We rely on the following providers to operate the service, each processing a subset of your data under their own privacy terms:

• Supabase — authentication and database hosting.
• Anthropic — AI Financial Advisor responses.
• Tap Payments — subscription checkout and billing.
• Salla, Zid, Shopify, WooCommerce — whichever platforms you choose to connect.

We retain workspace data for as long as your account is active. If you delete your account or workspace, associated data is removed within [insert retention period] except where retention is required by law (e.g. billing records).

You may request access to, correction of, or deletion of your personal data at any time by contacting us (see below). Depending on your jurisdiction, you may have additional rights under applicable data-protection law.

Data is stored using industry-standard access controls (Postgres Row Level Security, scoped API keys) and encrypted in transit. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

Questions about this policy? Contact us at [insert support email].