Privacy Policy
This privacy notice explains how Neoflo collects and uses personal data about visitors to neoflo.ai, people we contact about our services, and people who use our platform. It is written to meet Articles 13 and 14 of the UK GDPR, so it also covers personal data we did not collect from you directly. Where we refer to "Neoflo", "we", "our" or "us", we mean the controller described in section 1.
1. Who we are and how to contact us
Neoflo is the controller of your personal data. Our registered office is at UOB Plaza, 80 Raffles Place, #32-01, Singapore 048624, and we also operate from 19 Graham Street, Irvine, CA 92617, United States.
For any privacy question or request, contact us through neoflo.ai/company, reply to any email we have sent you, or write to us at the Singapore address above.
2. Who this notice covers
Prospects and business contacts: finance, operations and technology leaders at organisations we believe may benefit from our services, including people we email who have not contacted us first.
Website visitors: anyone who visits neoflo.ai, books a demo or subscribes to our newsletter.
Customer users: people at customer organisations who use the Neoflo platform, its integrations or managed services.
Candidates, partners and suppliers: people who apply to work with us or who work with us on delivery.
3. What personal data we hold and where it comes from
Data you give us. Name, work email, phone number, job title, employer, and anything you include in a message, demo booking, newsletter sign-up, application or support request.
Data we collect about business contacts from other sources. For prospects we have not met, we hold your name, job title, employer, work email address, business phone number, work location and professional profile URL. We obtain this from publicly available professional sources (for example your employer's website and your public professional networking profile), from licensed business-contact data providers, from event and partner introductions, and by inferring a work email address from your employer's email format. We do not collect special category data, and we do not buy consumer lists.
Data collected automatically. IP address, device and browser information, pages viewed, and whether an email we sent was opened or a link clicked. See our Cookie Policy for the technologies involved.
Customer platform data. Names, work contact details and activity logs of users of the Neoflo platform, and the business records those users process. For business records we act as a processor on our customer's instructions, under the customer contract, and that data is outside this notice.
4. Why we use your personal data and our lawful basis
To contact you about our services (B2B marketing). Lawful basis: our legitimate interest in promoting relevant services to the organisations they are designed for. We have balanced this against your interests: we contact you only in your professional capacity, about matters relevant to your role, we keep the data we hold minimal, and every email carries an unsubscribe link. Where consent is required by law, we rely on consent instead.
To respond to enquiries, run demos and negotiate contracts. Lawful basis: steps taken at your request before entering into a contract, and our legitimate interest in following up.
To provide, secure and support the platform. Lawful basis: performance of the customer contract, and our legitimate interest in keeping the service secure and reliable.
To send our newsletter. Lawful basis: consent, which you can withdraw at any time using the link in every issue.
To improve the website and our services, using aggregated analytics. Lawful basis: legitimate interests.
To comply with law, keep records, and establish or defend legal claims. Lawful basis: legal obligation and legitimate interests.
We do not use personal data to train public AI models. Where AI systems help us deliver services, the data shared with them is limited to what the task needs, and no decision producing legal or similarly significant effects about you is made solely by automated means.
5. Marketing emails and your choices
We send business-to-business marketing emails in line with the Privacy and Electronic Communications Regulations. Every marketing email identifies the sender, gives a valid address to contact us, and includes a working unsubscribe link. If you unsubscribe we add your address to a suppression list so we do not email you again, and we stop within a reasonable time and always within 28 days. You can also object at any time using the contact details in section 1. Objecting to direct marketing is an absolute right; we will honour it without asking for a reason.
6. Who we share personal data with
We share personal data only with the categories of recipient below, and only to the extent needed:
Cloud hosting and infrastructure providers, including Amazon Web Services and Google Workspace.
Email delivery, CRM, scheduling and newsletter providers, including HubSpot and Beehiiv.
Business-contact data providers, for the sourcing described in section 3.
AI model and analytics providers that process data on our instructions under contract.
Professional advisers, auditors and insurers.
Regulators, courts and law enforcement where the law requires it.
A buyer or successor if our business is sold or reorganised, under confidentiality terms.
We do not sell personal data.
7. International transfers
We operate from Singapore and the United States, and our providers are located in the United Kingdom, the European Economic Area, the United States and Singapore. When personal data of people in the United Kingdom leaves the United Kingdom we protect it with the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or we rely on a UK adequacy decision where one applies. You can request a copy of the relevant safeguard using the contact details in section 1.
8. How long we keep personal data
Prospect data: 12 months from our last contact with you if you have not responded; if you engage with us, for as long as the relationship is active and 12 months after it ends.
Suppression list: your email address only, for as long as needed to make sure we do not contact you again.
Customer contacts and contracts: for the life of the contract and 6 years after it ends, for legal and accounting purposes.
Newsletter subscribers: until you unsubscribe.
Website analytics and email engagement logs: up to 24 months.
Candidate data: 12 months after the recruitment decision unless you ask us to keep it longer.
9. Security
We use encryption in transit and at rest, access controls with audit trails, and contractual security obligations on our providers. Details of our controls are published at trust.neoflo.ai.
10. Your rights
Under the UK GDPR you can ask us to: give you access to your personal data and a copy of it; correct it; erase it; restrict how we use it; provide it to you or another organisation in a portable format; and stop processing based on legitimate interests, including all direct marketing. Where we rely on consent you can withdraw it at any time. To exercise a right, contact us using the details in section 1. We respond within one month, and we may ask you to confirm your identity.
You can complain to the UK Information Commissioner's Office at ico.org.uk, by phone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would appreciate the chance to resolve your concern first. People in Singapore may contact the Personal Data Protection Commission, and people in the European Economic Area may contact their national supervisory authority.
11. Cookies
Our use of cookies and similar technologies is described in our Cookie Policy.
12. Children
Our services are for businesses. We do not knowingly collect personal data from anyone under 18, and we will delete any such data we discover.
13. Changes to this notice
We will post any changes on this page and update the date at the top. If a change materially affects how we use your data, we will also tell you by email where we have your address.