Privacy Policy

Last updated: 9 July 2026

ProcFlow is a software platform provided by SMR Solutions B.V. ("SMR Solutions", "we", "us"), registered in the Netherlands. This Privacy Policy explains what personal data is processed through the ProcFlow mobile app and web dashboard, and how it is handled.

1. Who Controls Your Data

ProcFlow is used by organisations ("Customers") to manage their own operational procedures, work orders, and compliance records. If you are using ProcFlow as an employee, contractor, or user of one of our Customers, your employer or the organisation that invited you is the data controller of your personal data. SMR Solutions acts as the data processor, operating the software on the Customer's behalf (or, for self-hosted deployments, providing the software that the Customer operates on its own infrastructure).

For questions about how your specific organisation uses your data, contact your organisation's ProcFlow administrator first.

2. What Data We Collect

• Account data: name, email address, role, and organisation/site assignment.
• Authentication data: hashed passwords and session tokens (we never store passwords in plain text).
• Operational data: procedure executions, work orders, permits to work, incident reports, asset records, and related timestamps you or your organisation create in the app.
• Media: photos and digital signatures you attach to procedure steps, incidents, or sign-offs, if your organisation uses these features.
• Device data: device type, OS version, and app version, used for support and crash diagnostics.
• Push notification tokens: if notifications are enabled, to deliver alerts relevant to your work.

3. How We Use Data

Data is used exclusively to operate the ProcFlow platform for your organisation, specifically to:

• Authenticate you and enforce role-based access controls;
• Display and store the procedures, records, and work orders your organisation creates;
• Send notifications related to assigned tasks, approvals, or incidents;
• Provide customer support when requested;
• Maintain and improve the security and reliability of the platform.

We do not sell personal data. We do not use your data for advertising.

4. Where Data Is Stored

For our standard hosted (SaaS) service, data is stored using Supabase infrastructure located in the European Union (Frankfurt, Germany). For self-hosted / on-premise deployments, data is stored on infrastructure controlled by the Customer, and this Privacy Policy should be read together with that Customer's own data handling practices.

5. Third-Party Processors

The following third parties may process data on our behalf, under contractual data protection safeguards:

• Supabase Inc. — database, authentication, and file storage (EU region).
• Apple Inc. — app distribution via the App Store / TestFlight.
• Google LLC — app distribution via Google Play.
• OpenAI, LLC — optional AI-assisted document import feature, only if enabled by your organisation.

6. Data Retention

Data is retained for as long as your organisation maintains an active ProcFlow subscription or deployment. Upon termination of a contract or trial, data is deleted or returned to the Customer within 30 days, unless a longer retention period is required by law or agreed separately.

7. Your Rights (GDPR)

If you are located in the European Economic Area, you have the right to:

• Access the personal data held about you;
• Request correction of inaccurate data;
• Request deletion of your data (subject to legal/operational retention requirements);
• Request a copy of your data in a portable format;
• Object to certain processing.

Requests should first be directed to your organisation's ProcFlow administrator, as they are the data controller. If you are unable to reach them, you may contact us directly at the address below.

8. Security

We implement encryption in transit (TLS), encrypted storage at rest, role-based access control, and row-level security policies on all data. Passwords are hashed and never stored in plain text.

9. Children

ProcFlow is a business application intended for use by adult employees and contractors of our Customer organisations. It is not directed at children, and we do not knowingly collect data from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to Customers. The "Last updated" date at the top of this page reflects the most recent revision.

11. Contact

SMR Solutions B.V.
Heerhugowaard, The Netherlands
Email: privacy@smrsolutionsbv.com
Website: smrsolutionsbv.com