In short: your brand’s data belongs to your brand. We use it only to run Oflo for you. We never sell it, never use it for advertising, and you can export it or ask us to delete it at any time.
Who we are
Oflo is a platform that helps fashion brands run products, stock, stores, orders, money and teams in one place. It is built and operated from Tunisia. In this policy, “Oflo”, “we” and “us” mean the company that runs Oflo. Our full company details are on the legal notice.
Our role and yours
Two kinds of personal data pass through Oflo, and the rules are different for each.
- Data about our customers and their team. Your name, email, role and how you use the app. For this data, Oflo decides how it is used and is the controller.
- Data your brand puts into Oflo. Your shoppers, orders, members, suppliers, employees and payroll. Your brand decides why and how this data is used and is the controller. Oflo only processes it on your behalf and following your instructions, as a processor.
If you are a shopper of a brand that uses Oflo, please contact that brand first. It is in charge of your data, and we will help it answer you.
What we collect
On this website
- Demo requests: your name, brand, email, optional phone or WhatsApp number, number of stores and the topics you pick.
- Emails you send us and what they contain.
- Technical data our website host logs to keep the site working and safe, such as IP address, browser and pages requested.
This website uses no advertising or tracking cookies. See the cookie policy.
In the Oflo web and mobile apps
- Account data: name, email, password (stored only as a secure hash by our authentication provider), profile photo, language and preferences.
- Organization data: company name, logo, plan, invoices from Oflo and billing contact.
- Business data you enter or connect: products, stock, orders, customers, members, suppliers, invoices, cash and payroll records, files and photos you upload.
- Usage and device data: sign-in times, actions recorded in history logs (for example who moved stock or approved a return), app version, and a push notification token if you allow notifications.
- Error reports: technical details when something breaks, without the content of your records.
How we use it
- To provide Oflo: sign you in, show your data to the right people, sync with your website and courier, send the emails and notifications you turned on.
- To support you when you ask for help.
- To bill your subscription and keep accounting records.
- To keep Oflo secure, prevent abuse and fix errors.
- To improve Oflo, using aggregated usage that does not identify you or your shoppers.
- To answer demo requests and, if you agree, send you news about Oflo. You can unsubscribe at any time.
We do not sell personal data. We do not use your brand’s data to train AI models, and we do not show advertising.
Legal basis
We process personal data in line with Tunisian Organic Law n° 2004-63 of 27 July 2004 on the protection of personal data. Where the European Union General Data Protection Regulation (GDPR) applies, we rely on these bases:
- Contract: to provide the service you signed up for.
- Legal obligation: invoicing, tax and accounting records.
- Legitimate interest: security, error fixing, answering demo requests and improving Oflo.
- Consent: optional marketing emails and push notifications. You can withdraw consent at any time.
Who we share it with
We use a small number of trusted providers to run Oflo. Each one only gets the data it needs and is bound by confidentiality and data protection terms.
| Provider | What for |
|---|---|
| Supabase | Database, sign-in, file storage and server functions that host Oflo. |
| Our website host | Serves this website and the web app. |
| Sentry | Error reports, so we can fix problems quickly. |
| Expo | Delivers push notifications to the mobile app. |
| Groq and Google Gemini | Reading supplier invoices you upload, so you do not have to type them. Only the document you send is processed. |
| Stripe | Card payments for subscriptions, where card billing is used. We never see your full card number. |
| Email providers | Sending the emails you turn on, through your own email server or ours. |
| Apple and Google | Distributing the mobile app through their stores. |
When you connect your own services, such as WooCommerce, Aramex or Google Analytics, Oflo exchanges data with them on your instruction. Their own privacy policies apply to what they do with it.
We may also share data when the law requires it, to protect our rights or users, or as part of a merger or sale of the business, in which case this policy keeps applying to your data.
Data outside Tunisia
Some of our providers store or process data outside Tunisia, for example in the European Union or the United States. When that happens we use providers with recognised safeguards, such as the European Commission’s standard contractual clauses, and we follow the transfer rules of Tunisian law.
How long we keep it
- Account and business data: for as long as your subscription is active.
- After you leave: you can export your data, then we delete it within 90 days. Copies in backups disappear as backups rotate.
- Our invoices to you and accounting records: as long as tax and accounting law requires, up to 10 years.
- Demo requests: up to 24 months after our last exchange, unless you become a customer.
- Error reports and technical logs: up to 90 days.
Security
Each brand’s data is kept apart from every other brand’s at the database level, access inside a brand follows roles and permissions, and data is encrypted in transit and at rest. Read more on the security page.
Your rights
You can ask to access, correct or delete your personal data, to receive a copy of it, to object to some uses, or to withdraw your consent. Write to privacy@oflo.studio from the email linked to your account. We answer within 30 days.
To close your account and delete your data, follow the steps on delete your data.
If you are not satisfied with our answer, you can complain to the Instance Nationale de Protection des Données Personnelles (INPDP) in Tunisia, or to the data protection authority of your country.
The mobile app
- Camera: used only to scan barcodes and take photos you choose to upload. Scans are not recorded.
- Photos: only the pictures you pick are uploaded.
- Notifications: only if you allow them. You can turn them off in your phone settings.
- Sign-in: your session is stored in the phone’s secure storage.
- The app does not track you across other apps or websites, and contains no advertising.
Children
Oflo is a tool for businesses and is not meant for children under 16. We do not knowingly collect their data.
Changes
We may update this policy as Oflo grows. We change the date at the top, and tell customers by email or in the app before any important change takes effect.
Contact
Questions about privacy: privacy@oflo.studio.