1. Who controls the data
Any Media Boost Ltd is the service operator and data controller for account, billing and website information. Each customer organisation is normally the controller for employee, applicant, lead and contact information entered into its private workspace. CompanyFlowHQ acts as its service provider and processor for that workspace data, under our Data Processing Agreement.
We are the controller for:
- your account details and sign-in records, including when you sign in with Google or Microsoft;
- billing records for your CompanyFlowHQ subscription and credit, which Stripe processes for us;
- bot checks on sign-up, sign-in and public forms, which Cloudflare Turnstile carries out for us;
- support emails and other messages you send us; and
- visits to our own website.
2. Information we collect
We may process account names, business email addresses, authentication records, employee and HR records, job applicants, lead contact details, consent records, campaign information, message delivery events, audit activity, IP-derived security records and support communications. Passwords are stored only as salted cryptographic hashes. Provider tokens are encrypted.
3. Why we use it
- Provide the CRM, marketing automation and HR service requested by a customer.
- Authenticate users, prevent abuse and protect workspaces.
- Send messages only under the customer’s instructions and recorded consent settings.
- Maintain delivery records, diagnose failures and improve reliability.
- Meet legal, tax, fraud-prevention and security obligations.
4. Legal bases
Depending on the context, processing is based on performance of a contract, legitimate interests in operating and protecting the service, compliance with law, or consent. Customers are responsible for having a lawful basis for the people they upload or contact and for honouring marketing opt-outs.
5. Service providers
CompanyFlowHQ runs on Cloudflare (hosting, database, file storage, backups, AI features, bot checks, inbound email forwarding and help connecting live screen shares). We use Resend to deliver email, Stripe to take subscription payments and Google Fonts to show the app’s typeface. Other providers are involved only when a workspace chooses to connect them: Google (sign-in, Calendar, Google Meet links, Analytics, Search Console, Business Profile, Ads), Microsoft (sign-in, Outlook mail and calendar, Microsoft Teams links), Zoom (meeting links), Meta (Facebook, Instagram, Messenger, WhatsApp, Threads), Twilio and Zadarma (SMS and calls), a business’s own Stripe account (invoice and booking payments), and the social networks, mailboxes and automation tools it links. With your consent, our own public website also uses Google Analytics and Microsoft Clarity (see Cookies).
Only the minimum information needed for the chosen function is shared. Some providers process data outside the UK under recognised safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. The full, current list, with what each receives and where, is in the sub-processor list.
6. AI features
AI helpers (such as summaries, reply drafts, call notes, reading documents, captions and translation) run on Cloudflare Workers AI, on Cloudflare’s own network. Your data is not used to train AI models. AI suggestions are there to help people in the workspace: we do not use them to make decisions based solely on automated processing that have legal or similarly significant effects on anyone.
7. Call recording, screen recording and live screen sharing
- Call recording. A workspace can choose to record calls. When it does, a recording notice is played before the call is connected. The workspace must tell people about recording and have a lawful basis for it.
- Screen recording. A workspace can ask a customer to record their screen to show a problem. The person chooses what to record and when to start and stop. The workspace must tell people how the recording will be used.
- Live screen sharing. Screen shares are sent directly between the browsers taking part (peer to peer) and are not recorded or stored by us. If a direct connection isn’t possible, the encrypted stream may be relayed through Cloudflare’s Realtime TURN service, which does not store it. The details needed to set up the connection are removed 24 hours after the share ends.
Security activity record in workspaces
A workspace owner can use Activity & threats to protect their business’s data. When it is used, CompanyFlowHQ records, for that workspace, what each of its users does in the app:
- What is recorded. Sign-ins and failed sign-ins, pages opened, records opened, exported, changed or deleted, and settings and access changes, with the time, IP address, approximate location (city and country), network and device type.
- What is never recorded. Message contents, what is typed, screen contents or anything outside the app.
- Why. To keep the workspace’s data secure: spotting attacks, stolen passwords and data theft. Unusual activity can pause an account until the owner reviews it; a person always decides what happens next.
- Who can see it. Only the workspace’s owners. Staff are told about it when they sign in.
- How long. For the period the owner chooses (30, 90, 180 or 365 days; 180 days by default), then it is deleted automatically.
For this record the workspace is the controller and we act as its processor. Staff with questions should ask their employer.
8. Cookies and similar storage
CompanyFlowHQ does not place advertising cookies. We use only these:
- Sign-in cookies (strictly necessary). A secure session cookie keeps you signed in for up to 7 days. Short-lived cookies (10 to 30 minutes) protect sign-in, two-step sign-in, sign-up and connecting Zoom. A device cookie lets us warn you when your account is used on a new device.
- Referral cookie. If you arrive through a referral link, a cookie remembers the referral code for 30 days so the referral can be credited.
- Live chat widget (on websites that use it): your browser’s local storage keeps a random visitor key (
cfw_v_…) so your conversation carries on, and notes that you have seen the chat button (cfchat_seen_…). Session storage keeps the campaign details of the page you arrived on (cfchat_utm) until you close the tab. - Website visitor stats (on websites that use them): no cookies. A site owner can stop their own visits being counted, which stores
cfhq_ignorein their browser. - App preferences. The app keeps a few settings, such as your language, appearance and sound choices, in your browser’s local storage.
- Google Fonts. The app loads its typeface from Google, which receives your IP address and browser details to send the font.
- Cloudflare Turnstile. On sign-up, sign-in and some public forms, Cloudflare checks that you are not a bot, using your IP address and browser details.
Our own website analytics, only if you agree. On the public pages of companyflowhq.com and on our sign-up page we ask before using two analytics tools. Google Analytics counts visits and shows which pages and campaigns help visitors; it sets the cookies _ga and _ga_… (kept for up to 2 years). Microsoft Clarity, if we switch it on, shows anonymised clicks and scrolling so we can see where a page is unclear, with anything typed hidden; it sets _clck and _clsk (up to 1 year). Nothing loads until you click Accept, and we never send email addresses, names or the details in web addresses. Your choice is kept in your browser (cfhq_consent) for 6 months; change it at any time from “Cookie settings” at the bottom of every page. These tools are never used inside your workspace, on your customers’ booking pages, forms or portals, or on your own website.
Google Analytics is provided by Google Ireland Limited and Microsoft Clarity by Microsoft Ireland Operations Limited. Both may process data in the United States under the UK Extension to the EU–US Data Privacy Framework. Our lawful basis is your consent.
The CompanyFlowHQ phone and tablet app
The app for iPhone, iPad and Android shows the same workspace as the website and follows this notice. It has no advertising, no tracking across other apps or websites and no third-party analytics. On top of what the website keeps, it uses:
- Sign-in. A random sign-in token kept in your phone’s secure storage (iPhone Keychain / Android Keystore). We store only a fingerprint of it, with the device name, platform, app version and approximate place, so you can see and sign out the phone in Settings → Security. With Sign in with Apple, Apple gives us a stable ID and the email you chose to share (it may be a private relay address).
- Notifications. A push token, sent through Expo’s push service to Apple Push Notification service or Google Firebase Cloud Messaging, to deliver the notifications you choose. It is removed when you sign out.
- Microphone. Only during business calls you make or answer in the app. Calls are carried by the workspace’s calling provider (such as Twilio).
- Location. Only when you clock in or out and your workspace asks for a location check: it is taken once, at that moment, and kept with that clock-in record. Never in the background.
- Camera and photos. Only when you choose to take or pick a photo (for a chat, an email, a receipt or your profile). Only the picture you choose is uploaded.
- Face ID / fingerprint. Checked by your phone itself; we never receive biometric data.
- Problem reports. Only when you press “Send problem report”: a short technical log (app version, phone model and what the app did), never your notes or passwords.
You can delete your account in the app at any time: My settings → Delete account. A team member’s account is deleted straight away (the work they did for the business stays in its workspace); a workspace’s only owner closes the whole workspace, as described below.
9. How long we keep data
Data is kept while a workspace is active and as reasonably required for security, legal or dispute purposes. In particular:
- If a subscription ends or a trial isn’t converted, the workspace stays read-only for 90 days. We email the owner before it could be removed. After that, our team reviews it and deletes it within 30 days.
- If the owner asks us to delete the workspace, nothing is deleted for 14 days (they can cancel until then), and our team deletes it within 30 days of the request.
- Billing records for your CompanyFlowHQ subscription and credit are kept for 6 years after the workspace is deleted, as UK tax law requires.
- Screen recordings are deleted automatically after 90 days.
- Customer screen-recording uploads not attached to a request within 24 hours are removed.
- Social media comments and mentions collected for insights are deleted after 90 days.
- AI call notes and transcripts are deleted after the period the workspace chooses (30, 90, 180 or 365 days, or kept until deleted; 90 days by default). Call recordings and voicemails are deleted after the same period if the workspace turns that on; otherwise they are kept until the workspace deletes them.
- Security activity (audit) logs are kept for about one year.
- Workspace security activity records are deleted after the period the owner chooses (30, 90, 180 or 365 days; 180 by default).
- Sign-in sessions stop working when they expire after 7 days, and are deleted when you sign out or sign out your other devices.
- Encrypted backups are kept on a rolling basis (30 daily, 12 monthly and 5 yearly copies), so deleted data can remain in a backup until that copy expires. Uploaded files are backed up separately, and deleted files are removed from that file backup within 35 days.
10. Security
We use encrypted transport, secure cookies, access controls, rate limits, audit records and encrypted provider credentials. No internet service can promise absolute security.
11. Children
CompanyFlowHQ is a business service and is not for anyone under 18. We do not knowingly create accounts for children.
12. Your rights
Depending on applicable law, you may request access, correction, portability, restriction, objection or deletion. Where we rely on your consent, you can withdraw it at any time; this does not affect anything we did before you withdrew it. Workspace owners can download a structured copy of the whole workspace and ask for it to be deleted in Settings → Your data. Owners and admins can export one person’s data from their record, and erase one person in Settings → Erase one person. Employees, leads and applicants should normally contact the organisation that collected their information first.
You have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113. We would appreciate the chance to deal with your concerns first.
13. Contact
Email privacy@companyflowhq.com or write to Any Media Boost Ltd, 117 St Paul’s Avenue, Harrow, HA3 9PT, United Kingdom.