Privacy policy

Last updated: September 2, 2026

Who we are

Supplier Flow is operated by PeakFlow Media LLC (“we”, “us”). This policy covers data we collect on this site and through the Supplier Flow product.

What we collect

  • Account info: email, name, profile image (via Clerk)
  • Billing info: a customer reference from our payment processor (card details stay with the processor, never us)
  • Product usage: supplier unlocks, CRM activity, search demand reveals
  • Technical: IP address, browser, OS (anonymized for analytics)

How we use it

  • Deliver the product you pay for (credit grants, unlocks, CRM)
  • Send transactional email (invoices, receipts, follow-up reminders)
  • Send marketing email (the weekly digest and the education series). You can opt out from the unsubscribe link in every one of those messages.
  • Detect abuse (rate limiting, fraud signals)
  • Improve the product (aggregated analytics via PostHog)

Third parties we use

Clerk (authentication), Fanbasis / Commas (payments, as our Merchant of Record), Neon (database), Vercel (hosting and traffic analytics), Resend (email), PostHog (analytics), Sentry (error monitoring), Inngest (background jobs), Chatra (live chat, which receives the messages you send us in the chat widget), Shopify (store connection, product import and app billing for merchants who install from the Shopify App Store), Anthropic (the AI model that summarizes supplier profiles), DataForSEO (supplier search-volume data). Each processes data under their own privacy terms. Supplier profile data is compiled from public web sources and summarized with AI; this does not involve your personal account data.

Shopify merchants

If you connect a Shopify store, we store your shop domain, your Shopify Admin API access token (encrypted at rest), and the product ids and draft products you import. We use this to run Import Products and to keep price and stock sync up to date on the products you imported.

Our access is limited to product scopes (read_products and write_products). We do not request or read your customers, orders, or any other store data.

On uninstall your access token is revoked. When Shopify sends us the shop/redact webhook we erase the token, store name and store email and delete your sync history. Your import history (the products you imported and their Shopify ids) stays on your Supplier Flow account, along with the shop domain it belongs to, until you delete the account. We handle Shopify’s mandatory compliance webhooks (customers/data_request, customers/redact and shop/redact) at /api/webhooks/shopify.

Your rights

Email hello@supplierflow.io to: export your data, delete your account, correct inaccuracies, object to processing, or file a complaint. We respond within 30 days.

Retention

Cancelling does not delete anything. Your account and your saved work (unlocked suppliers, saved lists, CRM records) stay until you delete your account, which you can do from Settings or by emailing hello@supplierflow.io. We process deletion requests within 30 days. Our financial ledger and audit logs are retained for as long as accounting and tax law requires.

Cookies

We use strictly-necessary cookies for authentication (Clerk) and checkout (our payment processor). Analytics cookies (PostHog) are opt-in in the EU and on by default elsewhere.