Privacy Policy

For the business data you enter into HayFlow ("Customer Data"), you (the customer organization) are the controller and Dune Summit acts as a processor/service provider that handles it on your behalf to run the Service. For account and billing information, we act as a controller.

• Account & identity (via Clerk): name, email, organization name, role, and authentication metadata.
• Billing (via Clerk Billing / Stripe): subscription plan, trial status, and payment metadata. We do not store full payment card numbers — Stripe handles card data.
• Customer Data you enter: locations, stacks, inventory transactions, tickets, invoices, business profile, and any customer/contact details you choose to add (e.g., the name of a buyer on an invoice).
• Support & AI assistant: messages you send to the in-app help assistant or support, which may be processed by our AI vendor (Anthropic) and stored to provide and improve support.
• Technical & usage data: IP address, device/browser info, log and error data (via Sentry), and rate-limiting signals on public endpoints (via Upstash). Used for security, debugging, and reliability.

• To provide, operate, secure, and support the Service.
• To process billing and manage subscriptions and trials.
• To monitor reliability (error tracking, uptime, rate limiting) and prevent abuse.
• To communicate with you about your account, service changes, and support.
• To comply with law and enforce our Terms.

We do not sell your personal information or Customer Data. We do not use your Customer Data for advertising.

The owner of Dune Summit LLC is also employed by a company in the hay export industry. Because some HayFlow customers may operate in that same industry, we make these binding commitments (see also Section 5 of the Terms):

• We will not access, analyze, or use your Customer Data for the benefit of any hay export company or for any competitive, sourcing, pricing, or trading purpose.
• We will not share or disclose your Customer Data — or insights derived from it — with the owner's employer or its affiliates.
• Internal access to Customer Data is limited to operating, securing, and supporting the Service, and is not used to inform the owner's separate employment.
• Your data is kept logically isolated per organization and is not commingled with any other business's operations.

If our ownership changes or these commitments can no longer be honored, we will notify affected customers (Section 8).

We share information only with vendors that help us run the Service, under contracts that restrict their use of it:

We may also disclose information to comply with law, respond to lawful requests, protect rights and safety, or in connection with a business transfer (merger, acquisition, or sale of assets) — in which case we will notify you and the data-use commitments in Section 4 will be addressed.

• Customer Data is stored in our hosted Postgres database (Neon) and processed in the United States (AWS us-west-2 region).
• We use multi-tenant isolation (every record is scoped to your organization), encrypted connections, scoped access, and access controls. No system is perfectly secure.
• We retain Customer Data while your account is active. After termination, you may request an export for 30 days, after which we may delete or anonymize it, subject to legal retention requirements and routine backups.

• Access / export / correct / delete: Organization admins can view and edit Customer Data in-app, and may request export or deletion by contacting us.
• Depending on where you live, you may have rights under laws such as the CCPA/CPRA or others. To exercise rights, contact support@hayflow.io. We will not discriminate against you for exercising them.
• For Customer Data, individuals whose information you entered should direct requests to you (the controller); we will assist you as required.

We may update this Policy. We will post the updated version with a new effective date and, for material changes, provide reasonable notice. We will notify affected customers of incidents or changes affecting the Section 4 commitments as required by law.

HayFlow is a business tool and is not directed to children under 16. We do not knowingly collect their personal information.

Privacy questions or requests: support@hayflow.io, Dune Summit LLC. Mailing address available on request.