Política de privacidade
This Privacy Policy explains how personal data is collected and processed when you visit carvflow.com, create an account, contact CarvFlow, purchase or trial a product, manage a subscription, activate a licence, download software, receive support or use a CarvFlow marketplace connector.
The legal operator identified above is the data controller for personal data processed for CarvFlow's own website, store, customer relationship, subscription, licensing, marketing, security and support purposes.
1. Scope
This Policy covers personal data processed by CarvFlow as controller in connection with the website, WooCommerce store, customer accounts, payments, subscriptions, licensing, support, marketing, analytics and security.
When a merchant uses a CarvFlow connector to synchronise personal data relating to that merchant's customers or marketplace orders, CarvFlow may process that data on the merchant's behalf. In that context, the merchant generally determines the purposes of processing and CarvFlow may act as a processor under the GDPR or other applicable data-protection law.
2. Personal data we process
| Category | Examples | Main purpose |
|---|---|---|
| Identity and account data | Name, email address, username, account identifiers and authentication-related information. | Create and secure accounts and provide access to purchases, subscriptions and licences. |
| Business and billing data | Business name, billing name, billing address, country, telephone number, VAT/tax number and invoice information. | Checkout, billing, invoicing, taxation, accounting and customer administration. |
| Order and subscription data | Products purchased, plan, order/subscription identifiers, trial dates, renewals, cancellation status, payment status and payment method. | Fulfil orders and manage trials, renewals, cancellations and access. |
| Payment-related metadata | Transaction references, payment status, provider identifiers/tokens and limited payment metadata. | Confirm payments, reconcile transactions and prevent fraud. |
| Licence and installation data | Licence identifier and status, plan, entitlements, activation count, website URL/host, installation identifier, activation/deactivation timestamps and technical binding information. | Issue, activate, validate, transfer, renew, suspend, expire or revoke licences and enforce activation limits. |
| Marketplace connector data | Merchant/store identifiers, marketplace account identifiers, product/SKU/EAN information, catalogue data, prices, stock, order details, end-customer names and contact details, billing/shipping addresses, tax identifiers where supplied, quantities, fulfilment/tracking information, refund/status information and other data necessary to perform the requested synchronisation. | Provide the marketplace integration and related troubleshooting, reconciliation and security. |
| Support and communications | Contact-form submissions, emails, chat/support messages, attachments and information you choose to provide when requesting assistance. | Respond to enquiries and provide technical/customer support. |
| Marketing data | Email address, newsletter subscription status, campaign interactions and marketing preferences. | Send product updates, marketplace news and promotional communications where legally permitted. |
| Website, analytics and advertising data | IP address, browser/device information, pages visited, referrer, timestamps, cookie or advertising identifiers and campaign/interaction data where optional technologies are consented to. | Security, diagnostics, analytics, campaign measurement and advertising. |
| Security and operational logs | Login/security events, API requests, service health, synchronisation/job metadata, error messages, timestamps and anti-abuse information. | Protect, operate, debug and maintain the Services. |
3. Payment data
Payments may be processed by third-party providers including Stripe and ifthenpay, depending on the payment method selected. CarvFlow does not store full payment-card numbers or card security codes.
Payment providers may process personal data independently for payment execution, fraud prevention, authentication, regulatory compliance and related purposes under their own privacy terms.
4. Purposes and legal bases
Depending on the context, CarvFlow relies on one or more of the following legal bases:
- Performance of a contract: account creation, checkout, order fulfilment, trial/subscription management, licensing, authorised downloads, marketplace integration and support.
- Legal obligation: tax, invoicing, accounting, consumer-protection, regulatory and other statutory duties.
- Legitimate interests: service security, fraud and abuse prevention, operational logging, reliability, debugging, business administration and defence of legal claims, balanced against the rights and freedoms of individuals.
- Consent: optional analytics, advertising/marketing cookies, newsletter marketing where consent is required, and other optional processing for which consent is the appropriate basis.
5. Marketplace data and CarvFlow as processor
A merchant using a CarvFlow connector may transmit personal data relating to its own customers and marketplace orders. The merchant remains responsible for determining the lawful basis for that processing, providing appropriate privacy information and complying with applicable eCommerce and data-protection duties.
To the extent CarvFlow processes such data solely on the merchant's documented instructions to provide the connector service, CarvFlow acts as a processor. The controller and processor must put in place the contractual terms required by applicable data-protection law, including a Data Processing Agreement where Article 28 GDPR applies.
CarvFlow does not use merchant end-customer/order data for unrelated direct marketing.
6. Hosting, infrastructure and email
CarvFlow uses third-party hosting, infrastructure, backup, security and email-delivery services to operate the website, online store, platform and communications. These providers process only the data necessary to provide the relevant infrastructure service and are subject to applicable contractual and data-protection requirements.
CarvFlow currently uses Hostinger infrastructure for parts of its hosting and email environment. The exact technical location of individual systems may change as infrastructure is maintained or migrated; data-transfer safeguards are addressed as required by applicable law.
7. Analytics, advertising, CAPTCHA, newsletter and support tools
Subject to cookie-consent requirements and actual configuration, CarvFlow may use:
- Google Analytics for website analytics;
- Google Ads for advertising, conversion measurement or remarketing where enabled;
- Meta Pixel for advertising and campaign measurement where enabled;
- CAPTCHA or anti-abuse technologies to protect forms, accounts and checkout flows;
- newsletter/email-marketing providers to send opted-in communications;
- customer-support or chat providers to handle support requests.
Non-essential analytics and advertising technologies are used only after the consent required by applicable law. The specific cookies and technologies currently active are described in the Politica de cookies and consent interface.
8. Newsletter and direct marketing
If you subscribe to the CarvFlow mailing list, CarvFlow may use your email address to send product updates, new marketplace integrations, service news and promotional offers.
Where consent is required, marketing is sent only after a valid opt-in. You can unsubscribe at any time using the unsubscribe mechanism in an email or by contacting info@carvflow.com. Withdrawal of consent does not affect processing already carried out lawfully before withdrawal.
9. Cookies
CarvFlow uses strictly necessary technologies for functions such as account authentication, security, cart, checkout, subscription management and payment processing. Optional analytics, advertising and preference technologies are used only according to the consent rules applicable to them.
See the Politica de cookies for more information.
10. Recipients and categories of recipients
Personal data may be disclosed, where necessary, to:
- hosting, infrastructure, backup, security and email providers;
- payment providers such as Stripe and ifthenpay;
- Google and Meta services where the corresponding analytics/advertising functionality has been enabled with the required consent;
- newsletter, support/chat and anti-abuse providers used by CarvFlow;
- marketplaces and eCommerce services when data exchange is required to provide the connector service requested by the merchant;
- accountants, tax advisers, lawyers and other professional advisers where necessary;
- public authorities, courts or regulators where disclosure is required by law.
Processors acting on CarvFlow's behalf are required to protect personal data and to process it under appropriate contractual terms.
11. International data transfers
Some technology providers may process data outside Portugal or outside the European Economic Area. Where a transfer requires a safeguard under the GDPR, CarvFlow relies on an applicable legal mechanism such as an adequacy decision, Standard Contractual Clauses or another recognised safeguard.
12. Retention
CarvFlow keeps personal data only for as long as necessary for the purpose for which it was collected and for any additional period required by law or reasonably necessary to establish, exercise or defend legal claims.
- Accounting, invoicing and tax records are retained for the statutory retention period applicable in Portugal, which can require retention for 10 years.
- Account, subscription and licensing records are kept while the customer relationship or licence is active and afterwards for the period necessary to manage renewals, fraud prevention, contractual history, legal claims and statutory obligations.
- Marketplace operational data and logs are retained according to operational, security, troubleshooting and legal needs and are deleted or anonymised when no longer required.
- Support communications are kept for the time necessary to resolve, document and follow up the request and related legal obligations.
- Marketing data is kept until you unsubscribe or withdraw consent, subject to a limited suppression record where necessary to ensure that the opt-out continues to be respected.
- Cookie retention periods vary by technology and are shown in the cookie-consent interface or Cookie Policy.
13. Security
CarvFlow uses technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include encrypted transport, encryption of sensitive credentials where appropriate, access controls, authentication, logging, backups, anti-replay controls and infrastructure hardening.
No online service can guarantee absolute security. Customers are also responsible for securing their own WordPress site, marketplace account, devices and credentials.
14. Your rights
Subject to the conditions and limits in applicable law, you may have the right to:
- request access to your personal data;
- request correction of inaccurate or incomplete data;
- request deletion of personal data;
- request restriction of processing;
- object to processing based on legitimate interests;
- object at any time to direct marketing;
- request data portability where the legal conditions are met;
- withdraw consent at any time where processing relies on consent;
- lodge a complaint with a competent data-protection authority.
In Portugal, the supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD).
To exercise a right, contact info@carvflow.com. CarvFlow may request reasonable information to verify identity before acting on a request.
15. Automated technical decisions
CarvFlow uses automated technical rules to manage matters such as licence validity, activation limits, security controls, queue processing and service entitlements. These technical rules implement the subscription/licence contract and service security.
CarvFlow does not currently use solely automated decision-making to make decisions about individuals that produce legal or similarly significant effects within the meaning of the GDPR without the safeguards required by law.
16. Children
CarvFlow's paid software and subscription Services are intended for persons and organisations with legal capacity to enter into the relevant contract and are not directed to children.
17. Third-party services
The website and connectors interact with independent third-party services. Where a third party determines its own purposes for processing personal data, its own privacy terms apply to that independent processing.
18. Changes to this Privacy Policy
CarvFlow may update this Policy to reflect changes in the Services, technology, providers or legal requirements. The current version and last-updated date will be published on this page.
19. Contact
For privacy questions or data-protection requests, contact info@carvflow.com.
Legal information
CarvFlow is a commercial brand operated by Diogo Manuel Costa Barros de Carvalho,
Empresário em Nome Individual (Portugal).
NIF: 268143650
Avenida da República 336, 4430-188 Vila Nova de Gaia, Portugal
info@carvflow.com ·
+351 912 215 685