Privacy Policy

Last updated: 28 May 2026

1. Who we are

ClientFlow is a product of ZigMax Digital ("ZigMax", "we", "us"). We provide a managed CRM and client portal for accounting and bookkeeping firms. This policy explains how we collect, use and protect personal information that flows through ClientFlow.

2. What we collect

We collect: (a) account information your firm provides (name, email, role, firm name, billing details); (b) end-client data your firm uploads (contact details, documents, invoices, signed agreements); (c) usage logs (IP address, browser, pages visited) to operate and secure the service; (d) communications you send to support.

3. How we use it

To provide and improve ClientFlow, deliver support, send service notices, prevent fraud and abuse, and meet legal obligations. We do not sell your data and we do not use end-client data to train AI models.

4. Where it's stored

Production data is hosted on Australian infrastructure (AWS Sydney region). Encrypted at rest with AES-256 and in transit with TLS 1.2+. Backups are stored in the same region.

5. Sub-processors

We use a small set of trusted sub-processors: Supabase / AWS (hosting), Resend (transactional email), Stripe & Paddle (payments), ElevenLabs (optional voice agent), Cloudflare (CDN & WAF). A current list is available on request.

6. Your firm's responsibilities

Your firm is the data controller for end-client data inside its ClientFlow instance. You're responsible for collecting valid consents from your clients, managing user access, and exporting/deleting data when required.

7. Data subject rights

If you are an end-client of a firm using ClientFlow and want to access, correct or delete your data, contact your accounting firm directly — they are the controller. We will assist them on request.

8. Retention

We retain firm data for as long as the firm has an active subscription. On cancellation, data is retained for 30 days (for recovery), then permanently deleted. Backups are purged within 90 days.

9. Changes

We will notify firm administrators by email at least 14 days before any material change to this policy.

10. Contact

Privacy questions: [email protected]