Privacy Policy

ClientFlow OS is operated by Trickle Up, based at Nottingham, United Kingdom. We are the data controller for the account information described below.

For questions about this policy or your data, email privacy@trickleup.co.uk.

This matters, because our responsibilities differ:

• Your account data — the people at your agency who sign in, your billing details and how you use the product. We are the controller of this data.
• Your client data — the information you put into ClientFlow OS about your own clients and projects. You remain the controller; we act as your processor and only handle it to provide the service.

• Account details — name, work email, password (stored hashed, never in plain text), job role and agency name.
• Billing details — plan, subscription status and invoices. Card details are handled by Stripe and never reach our servers.
• Content you create — clients, projects, tasks, messages, files, meetings and reports.
• Technical data — IP address, browser type and pages visited, used to keep the service secure and working.
• Communications — emails and enquiries you send us.

• To provide the service — performance of our contract with you.
• To take payment — performance of our contract.
• To keep it secure and prevent abuse — our legitimate interests.
• To improve the product — legitimate interests, using aggregated and anonymised usage data.
• To send service emails (invites, reports, alerts) — performance of our contract.
• To send marketing — only with your consent, and you can opt out in any message.

We do not sell personal data, and we never will.

Some features use AI to draft briefs, reports, content plans and meeting summaries. The relevant project text is sent to our AI provider to generate that output. It is used only to produce your result — not to train public models. AI output is always presented for a human to review before it reaches a client.

Only the suppliers needed to run the service, each under contract and only for that purpose:

• Hosting — to run the application and database.
• Stripe — payments and subscription billing.
• Resend — sending transactional email.
• AI provider — generating the AI features described above.
• Analytics & error monitoring — to keep the service reliable.

We may also disclose data where the law requires it, or to a buyer if the business is sold — in which case this policy continues to apply.

We host data in the UK or European Economic Area wherever possible. Where a supplier processes data outside the UK, we rely on UK adequacy regulations or the International Data Transfer Agreement to protect it.

• While your account is active — for as long as you use the service.
• After you cancel — 30 days, so you can change your mind or export your data, then deletion.
• Invoices and financial records — six years, as UK tax law requires.
• Backups — deleted data disappears from backups within 90 days.

• Encryption in transit (HTTPS) and at rest.
• Passwords stored using industry-standard one-way hashing.
• Each agency’s workspace is isolated — one customer can never see another’s data.
• Role-based access, so people only see what their role allows.
• Regular backups, and access limited to staff who need it.

Under UK GDPR you can ask us to:

• Give you a copy of your personal data.
• Correct anything inaccurate.
• Delete your data (where we are not legally required to keep it).
• Restrict or object to how we use it.
• Transfer it to another provider.
• Withdraw consent for marketing at any time.

Email privacy@trickleup.co.uk and we’ll respond within one month. If you’re unhappy with our answer you can complain to the Information Commissioner’s Office at ico.org.uk.

We use essential cookies to keep you signed in and the service secure — these can’t be switched off. If we use analytics cookies, we ask for your consent first and you can change your mind at any time.

ClientFlow OS is a business tool and is not intended for anyone under 18.

If we make a material change we’ll email account holders and update the date at the top of this page.