Privacy
What StowFlow collects, where it is kept, and who else
can see it. Written to be read, not to be survived.
Last updated: 2 November 2026
What we collect
Only what the product needs to work. There is no advertising, no tracking
across other sites, no third-party analytics SDK, and nothing is sold or
shared for marketing. We keep one simple, anonymous count of how many
people visit our website — described below — and nothing more.
- Your account — the email address you sign up with, your first and
last name (shown to your team next to the changes you make), and the role you hold in
your company (owner, manager or picker). Passwords are held by Amazon Cognito and never
reach us in readable form.
- Your company details — company and warehouse names, address, city,
country and type of business, the referral code you signed up with (if any), and the
API keys you create (stored only in masked form after you've seen them once).
- Your warehouse data — the items, bins, stock levels, orders
and movements you enter or scan.
- Business contacts you add — your suppliers' names, phone numbers and
emails, your clients' names, and the delivery city and phone you give when you order
equipment. They are used only to run your warehouse and deliver what you ordered.
- Payments — what you paid for and when. Your card number goes straight
to our payment provider, Stripe; StowFlow never sees or stores it.
- Proof documents — the delivery notes, photos and receipts you
choose to upload.
- An audit trail — what was picked, stowed,
changed or deleted, when, and by which team member's email address —
including a snapshot of each record before and after the change. The
trail is permanent and cannot be switched off; it is the point of the
product. Correcting a record updates the live copy — the trail keeps
the history of what it said before.
- Support chat messages — if you use the assistant on our website or
in the console. On the website you do not need an account, and we do not ask for your name.
- Earlier contact requests — until October 2026 our website had a
request form. For anyone who used it, we keep exactly what was typed (name,
number and note) only to reply about StowFlow. The form no longer exists.
- An anonymous website visit count — when you open our marketing
site, we add one to a daily tally so we can see roughly how many people
reach it. To estimate unique visitors we store a one-way, scrambled
fingerprint of your network address that cannot be turned back into it,
is linked to nothing else, and is deleted automatically after 30 days.
No cookie, no profile, and nothing that identifies you. If your browser
sends a "Do Not Track" signal, we skip it entirely.
We do not collect location, contacts, photos beyond the documents you
upload, or any device identifier for advertising.
Where it is stored
In Amazon Web Services, encrypted in transit and at rest, in the
AWS Europe (Ireland) region. Your data is
isolated per company: another StowFlow customer cannot read it, and access
is enforced by the database itself rather than by our application code.
The camera scanning happens entirely on your phone. Video is never
uploaded, recorded or transmitted — the barcode is decoded on the device
and only the resulting code is used.
Who else can see it
Four companies. Nobody else.
- Stripe — card payments, receipts and the page where you manage your
card, invoices or cancel. Stripe receives your email, company name and card, and keeps
payment records as financial law requires.
- Amazon Web Services — hosting, database, file storage and
login. AWS does not access your data except as needed to run the service.
- Anthropic — the AI features. Two things are sent, and only
when triggered:
- When you press Generate with StowFlow AI on Recommendations, a snapshot of that
warehouse — items, bins, stock positions, open orders and recent demand
— is sent so the model can suggest better slotting. It is not sent at
any other time.
- Messages you type into the website assistant — and, when you ask it
a question from inside the console, a small summary of your
warehouse (item names and counts, low-stock list, open order
numbers) is sent with the question so it can answer about your
stock. It is not stored.
Anthropic does not train its models on data submitted through its API.
No account emails or uploaded documents are ever sent.
- Google — the typeface on our public pages is served
from Google Fonts, so loading this website tells Google your IP address
and browser. It gets nothing else: no warehouse data passes through it,
and the signed-in console does not load it at all. We would rather serve
the font ourselves and are moving to that.
Product lookups. When a manager registers a new product by its
barcode, StowFlow's server asks the public product databases Open Food
Facts and UPCitemdb what that barcode is. Only the barcode
number is sent — never your company, your stock or anyone's details — and the
answer is kept so the same barcode isn't asked about twice.
We will disclose data if legally compelled to, and will tell you unless
we are prohibited from doing so.
On your device
The app keeps a copy of your warehouse on the phone or computer you use
it on, so scanning keeps working where there is no signal. It is deleted
when you sign out — which matters if you share handsets between shifts.
How long we keep it — and deleting your data
Your data stays while your account is open. You can delete it yourself at any
time: Settings → Warehouses → Delete this warehouse removes the
warehouse and all its data straight away, and the login of anyone who belongs to no
other warehouse. Copies in our rolling backups expire within 35 days. We keep payment
records, because accounting law requires it. Support chat messages are kept for 30
days and then discarded.
If a plan lapses, your warehouse becomes read-only rather than deleted —
you can still view and export everything. Nothing is destroyed because an
invoice is late.
Cookies and storage on your device
StowFlow uses no advertising or tracking cookies and no third-party analytics. The
console keeps your sign-in and an offline copy of your warehouse in your browser's
storage — it can't work without them, so there is nothing to opt in to and no cookie
banner. When you pay, Stripe's own page may set cookies to prevent fraud; that is covered
by Stripe's privacy policy.
Your rights
Under the UAE Personal Data Protection Law (Federal Decree-Law 45 of 2021)
you can ask for a copy of your data, correct it, or have it deleted. You
do not need to ask us for a copy of your warehouse data — export it
yourself from the console at any time, in a format you can open in Excel.
For anything else, email
hello@stowflow.ae and we will reply
within 30 days.
Children
StowFlow is a tool for businesses and is not directed at anyone under 18.
Changes
If this changes in a way that affects you, we will email account owners
before it takes effect rather than quietly reposting the page.
Contact
StowFlow · Dubai, United Arab Emirates ·
hello@stowflow.ae