Privacy Policy

Two different groups of people

Businesses subscribe to SerFlows and use it to take bookings. We decide how their account information is handled, and this policy governs it.

Customers book with one of those businesses. We hold that information on the business’s behalf and act on their instructions — the business decides what to collect, who to contact and what to keep. If you booked an appointment and want your details changed or removed, the business you booked with is the right place to start; see If you booked with a business using SerFlows below.

If you run a business on SerFlows, the Data Processing Agreement is the contract covering your customers’ information specifically — what we may do with it, who else touches it, and how it is deleted. It forms part of the Terms you accepted when you created your account.

Where we operate

SerFlows is intended for use in the United States. Our systems and the companies listed under Who else touches your data operate in the US, and the service is not offered to people in the European Economic Area or the UK.

What we collect from businesses

When you create an account we record that you accepted these documents: the date and time, and which version of the Terms and this policy was in force.

Your name and login email; your business name, category, public phone and email, city, service radius, and — if customers come to you — your business address. Your page content: description, logo, cover photo, work gallery, services and prices, opening hours, policies and brand color.

For alerts, the mobile number you want reaching on. When you save it we ask Twilio whether it is a mobile, a landline or a virtual number, and store that answer — a landline cannot receive texts, and knowing that is what stops your lead alerts disappearing silently.

For billing, your subscription status and Stripe identifiers. We never see or store your full card number.

What we collect from customers who book

Name, phone number, and email if given. The service address, but only when the business travels to their customers — a business whose customers come to them never sees that field. Which service was chosen, the times that suit, any notes, and the answers to a short set of questions that depend on the trade.

Up to five photos, if the customer chooses to add them. Photos are shrunk in the browser before being sent.

Which link was used. A business can share links that record where a booking came from — an Instagram bio, a flyer, a QR code on a van — so they can see which of their channels is working. That source is shown to the business alongside the booking.

Whether SMS consent was given. The booking form asks separately, with a box that is never ticked in advance, and we keep a record of it: whether they agreed, when, the number it applied to, and the exact wording they were shown.

Whether they asked for a book-again email, if the business offers one. That is a separate box, also never ticked in advance, and we keep the same kind of record: when, the email address, and the exact wording. If they later unsubscribe, we keep their address and the business it applies to, so the emails stay stopped.

Pages built for a business and handed over

Someone can build a booking page for a business and hand it over to its owner. To do that we email the address they give us a link, and we keep that address, who sent the link and when it was accepted.

When the owner accepts, the page becomes theirs. The test bookings the builder made, and the messages those caused, are deleted, and the builder’s own contact details, alerts and payment setup are removed from the page.

People a business adds to its team

A business can invite people who work with it to sign in to its bookings with a login of their own, instead of sharing the owner’s. For each one we keep their name, the email they were invited on (which becomes their login), what the business allowed them to do, when they were invited and when they joined, and that they accepted these documents. If they turn on booking alerts, we also keep the mobile number those go to, checked with Twilio the same way as a business’s own.

A team member can see that business’s bookings in full, including its customers’ details and the business’s private notes on them. They never see its billing, its own settings, or any other business. A business is responsible for whom it invites, and this policy covers a team member’s information the same way it covers a business’s.

What is collected automatically

Our hosting and database providers keep standard server logs, which include IP addresses and basic request details, and are used to keep the service running and secure.

On SerFlows’s own pages — the home page, sign-up, login and these legal pages — we count visits with Vercel Web Analytics, run by our hosting company. It records which page was opened, the site that linked to it, and the type of device, browser and country. It uses no cookies, can’t tell who you are, and doesn’t follow you to other sites. It is never used on a business’s booking page, or on the links we send to customers.

When you first open one of those pages, we also note where you came from — for example “Facebook” or “Google”, and the name of an ad campaign if the link carried one — in a small cookie on your device. It lasts 30 days and is read only if you create an account, when it is saved with your account so we can tell which advertising works. If you don’t sign up, it never reaches us.

We do not use advertising pixels or third-party trackers, and none of this is shared for advertising. The only other cookie SerFlows sets is the one that keeps you signed in. If that changes, this page changes first.

Links we send to customers

To reschedule, report a problem, pay, view a quote or check on a job, we send a link containing a long random code. That code is what proves it is you — there is no password, because asking a customer to make an account to reschedule a car wash would mean most of them simply don’t.

It also means anyone holding the link can see that booking, including the name, address and appointment time on it. We ask search engines not to index these pages and mark them not to be indexed, but the link itself should be treated like a key: don’t forward it or post it anywhere public.

Calendar syncing

A business can subscribe to their SerFlows calendar from Google Calendar, Apple Calendar or Outlook. That subscription address contains a secret code and, like the links above, anyone holding it can read the appointments in it — including customer names and addresses. Handing it to a calendar app means handing those details to that app’s provider.

A business can reset that address at any time from Settings, which immediately stops the old one working.

Text messages and email

We send messages about a booking: a confirmation, reminders before the appointment, a payment link, a quote, and a note when a job is marked complete. These are transactional — they are about an appointment the customer made — and are not marketing.

One email is an exception. A business can offer a book-again email: a single reminder, sent a while after a finished job, asking whether the customer would like to book again. It goes only to customers who ticked a box on the booking form asking for it, never by text, and never more than once per job. Every one names the business, comes with a one-tap unsubscribe link, and carries our mailing address.

Consent is given by ticking the box on the booking form. Reply STOP to opt out and HELP for help. Message and data rates may apply. Message frequency varies with the booking. Carriers are not liable for delayed or undelivered messages.

We keep a record of each message: what was sent, where, when, whether the carrier accepted and delivered it, and any error it returned. That record is what lets a business see whether their customer actually heard from them.

Our number cannot hold a conversation. If a customer replies, we pass the message on to the business and tell the customer to contact them directly.

If you are a business sending messages through SerFlows

You are responsible for the people SerFlows contacts on your behalf. You confirm that anyone whose details you enter has agreed to be contacted about the work in question, and that you will not use SerFlows to send marketing or bulk messages. The book-again email is the one exception: SerFlows sends it, only to customers who asked for it on your booking form.

In practice, almost every message SerFlows sends is triggered by a customer who filled in your booking form themselves. The exception is a booking you enter by hand — that person has not ticked anything, so only add someone who has asked you to.

Payments

Subscriptions are billed by Stripe. To take card payments from their own customers, a business connects their own Stripe account; those payments go directly to them, and we never hold their money. Card details are entered on Stripe’s systems and we never see or store a full card number.

AI features

A business can ask us to draft the “About” text or a service description for their page. When they do, we send their business name, trade and whatever they have typed to Anthropic, which returns a suggestion. Under Anthropic’s terms, information sent through their API is not used to train their models.

It is always optional, always a suggestion, and always editable. Customer booking details are never sent to it.

Who else touches your data

We share information with the companies that run parts of the service, only as far as they need it to do their job. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

We may also disclose information if the law requires it, or to protect the service and the people using it.

How your files are stored

Photos a customer uploads with a booking, and completion photos taken at their property, are kept in private storage and shown only to the business the booking belongs to, through a link that expires.

A business’s own logo, cover photo and work gallery are public, because they appear on a booking page anyone can open.

How long we keep things

Bookings, messages and account information are kept while the account is open, so a business has its own history. A business can delete an individual booking at any time from their dashboard, which removes it and its photos.

You can close your account yourself from Settings, which deletes every booking, every customer’s details, every photo, your booking page and your login, and cancels your subscription at the same time. It cannot be undone. If you would rather we did it, email support@serflows.com.

A team member’s login is deleted when they leave the team or the business removes them, and when the business closes its account.

We do not delete data automatically after a set period; deletion happens when you or the business asks. Our payment provider keeps its own record of what you were charged, and routine backups and server logs age out on their own schedule.

Security

Data is held with the providers listed above, sent over encrypted connections, and reachable only by the account it belongs to and the people that business has added to its team. Files containing customer photos are not publicly readable. No system is perfectly secure, but if a breach affects your information we will tell you as the law requires.

Your choices

A business can see and change most of its information directly in the dashboard, change its alert settings, reset its calendar address, and delete bookings.

Depending on where you live — including California, Virginia, Colorado, Connecticut, Texas and Oregon — you may have the right to know what personal information we hold, to get a copy, to correct it, to have it deleted, and not to be treated differently for asking. We do not sell personal information or share it for targeted advertising, so there is nothing to opt out of on that front.

To exercise any of these, email support@serflows.com. We may need to confirm who you are before acting.

If you booked with a business using SerFlows

Your booking belongs to that business. The quickest route is to contact them directly — they can change or delete it themselves.

You can also email us and we will help. Because we hold that information on their behalf, we may need to pass your request to them, and we will tell you when we do.

Children

SerFlows is for businesses and is not directed to children. We do not knowingly collect information from anyone under 13. If you believe a child has given us information, email us and we will delete it.

Anonymised information

We may use information that has been aggregated or stripped of anything identifying — how quickly bookings are answered, which kinds of link get used — to understand and improve the service, and to describe it publicly. This never identifies a business, a customer or a booking.

Other sites

Pages we link to, and services like Stripe or a calendar app, have their own policies. This one covers only SerFlows.

Changes

If this policy changes we will update the date at the top, and tell account holders directly if the change is significant.

Contact

Questions, requests or complaints: support@serflows.com.