Data controller: Nextra (Pty) Ltd, South Africa, operating the ISOflows service.
This notice explains what personal data we collect, why, and who we share it with.
Data we collect
- Account: name, email, preferred language, password (hashed).
- Company: name, country, tax ID, sector, processes, risks, objectives and other context you provide during onboarding.
- Platform usage: activity logs, uploaded evidence, AI assistant conversations, notifications.
- Technical: IP address, device type, strictly-necessary cookies for authentication.
- Payment: card details are collected and processed directly by Paddle; we only receive subscription identifiers, status and email.
Purposes and legal basis
- Providing the service (contract) — account creation, plan generation, evidence storage, support.
- Billing (contract) — via Paddle, including tax obligations.
- Security and fraud prevention (legitimate interest).
- Product communications (legitimate interest) — messages about your subscription.
- Marketing (consent) — only if you opt in.
Data sharing
- Paddle.com Market Ltd — Merchant of Record, handles payments, subscriptions, tax and invoices.
- Infrastructure providers — cloud hosting (Cloudflare, Supabase) and AI model providers powering the virtual assistant.
- Authorities where required by law.
Retention
We keep data while your account is active. After cancellation we retain billing data for the legally required period (typically 5 years) and delete or anonymize the rest within 90 days.
Your rights
You may request access, rectification, erasure, portability, object to processing, and withdraw consent. Contact info@isoflows.com. You can also complain to your competent data-protection authority.
Security
We apply encryption in transit and at rest, access control and monitoring. No system is 100% secure, but we follow industry best practices.
Contact
info@isoflows.com