Back to Home

Privacy Policy

Last updated: July 2026

1. Who We Are

Work Flow Trade is operated by Workflow Trade Limited (company number 9422441, NZBN 9429053604309), a company registered in New Zealand. We are committed to protecting your personal information in accordance with the New Zealand Privacy Act 2020. In this policy, "we", "us", and "our" refer to Workflow Trade Limited.

2. What Information We Collect

We collect the following types of personal information:

  • Account information: name, email address, phone number, company name, industry, team size
  • Authentication data: encrypted passwords, session tokens
  • Business data: customer records, job details, quotes, invoices, inventory, timesheets, and leave records that you create within the Service
  • Location data: GPS coordinates of staff members who have location tracking enabled on their devices
  • Payment information: processed securely by Stripe — we do not store credit card numbers
  • Usage data: login times, feature usage patterns, device type

3. How We Use Your Information

We use your information to:

  • Provide and operate the Work Flow Trade service
  • Process payments and manage subscriptions
  • Send transactional emails (password resets, invoices, welcome emails, trial reminders)
  • Provide customer support
  • Improve the Service based on usage patterns
  • Comply with legal obligations

We do not sell or rent your personal information, and we do not share the information you store in Work Flow Trade with third parties for marketing purposes. Section 10 describes the advertising-measurement tools used on our website.

4. GPS & Location Data

Work Flow Trade includes GPS tracking functionality for staff management purposes. Tracking is enabled per staff member by the account owner, and the Work Flow Trade app is designed to collect location while a staff member is clocked in and to stop when they clock out. Staff members are shown a location disclosure in the mobile app before tracking begins. If you are a staff member, your employer controls whether tracking is enabled for you — ask them about their tracking policy, and you can request access to location information held about you.

GPS data is used solely for the purposes of job management, timesheet verification, and dispatch optimisation. Location data is stored securely and is only accessible to authorised users within the same company account. Raw GPS location logs are automatically deleted after 90 days.

Arrival and departure prompts. If your employer turns this on and you agree to it in the mobile app, the app watches for your arrival at the job sites you are scheduled at that day and shows a reminder on your phone to clock in — and, while you are clocked in, a reminder to clock out when you leave. This uses a small set of geofences around those sites only; it records the arrival and departure events, not your route or position between sites. You can turn it off at any time under My Account, and nothing is recorded unless you agreed to it. Geofence events are deleted after 90 days.

5. Third-Party Services

We use the following third-party services to operate Work Flow Trade:

  • MongoDB Atlas — database hosting (data stored on cloud infrastructure)
  • Render — application hosting
  • Stripe — payment processing
  • Resend — transactional email delivery
  • Cloudinary — image and file storage
  • Xero — accounting sync (only if your company connects its Xero account; customer contacts and invoices you choose to sync are sent to Xero)
  • Microsoft Clarity, Google (Analytics & Ads) and Meta — website analytics and advertising measurement on our website only (see section 10); never inside the native mobile apps

Each of these services has their own privacy policy. We select services that maintain appropriate security and privacy standards. These providers store data on cloud infrastructure located outside New Zealand (including the United States). Wherever your data is stored, it remains protected by, and we remain responsible for it under, the New Zealand Privacy Act 2020.

6. Data Storage & Security

Your data is stored on enterprise-grade cloud infrastructure with encryption in transit (TLS/SSL) and at rest. We implement access controls, automated backups, and security monitoring to protect your information.

Passwords are hashed using bcrypt and are never stored in plain text. Authentication uses short-lived JWT tokens with secure refresh token rotation.

7. Data Retention

Your data is retained for the duration of your account. If you cancel your subscription (or your trial expires), your data is retained for at least 90 days so you can export it or resubscribe. After that period it may be deleted. You can request deletion of your personal information at any time (see section 8).

Please note that New Zealand law requires businesses to keep certain records themselves — for example, tax records for 7 years and wage and time records for 6 years. Export any records you need before closing your account.

8. Your Rights Under the NZ Privacy Act 2020

Under the Privacy Act 2020, you have the right to:

  • Access your personal information that we hold
  • Request correction of inaccurate information
  • Request deletion of your personal information
  • Complain to the Office of the Privacy Commissioner if you believe we have breached the Act

To exercise any of these rights, contact us at support@workflowtrade.co.nz. We will respond within 20 working days.

9. Customer Portal Users

If you are a customer of a business that uses Work Flow Trade and you access the Customer Portal, your personal information (name, email, contact details) is managed by that business. We act as a data processor on their behalf. Contact the business directly regarding how they handle your information.

10. Cookies & Analytics

The Work Flow Trade app uses essential cookies and similar storage required for the Service to function (authentication, session management). We do not use advertising cookies inside the app.

Our website (workflowtrade.co.nz) uses Microsoft Clarity (usage analytics, logged-out visitors only), Google Analytics, Google Ads conversion tracking, and the Meta (Facebook) Pixel to understand how visitors find us and how our advertising performs. These tools set cookies and share visit data with those providers. They run on our website only and are never included in the native iPhone or Android apps.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or through the Service. The "Last updated" date at the top of this page reflects when the policy was last changed.

12. Contact Us

For any privacy-related questions or requests, contact us at:

Workflow Trade Limited (NZBN 9429053604309)
Email: support@workflowtrade.co.nz
Privacy Officer: The Director