Privacy Policy.

1. The short version

We collect the minimum we need to run Dumaflow for your business. Your business data belongs to you, we don't sell personal information to anyone, and you can take your data with you if you leave.

2. What we collect

Account information — your name, email address, business name and billing details when you sign up. Business data — the clients, sites, jobs, quotes, invoices, photos, notes and supplier documents your team puts into Dumaflow while doing their work. Technical data — device and log information (such as app version, browser type and IP address) used for security, debugging and keeping the service reliable.

3. How we use it

To provide and improve the service, to secure accounts, to bill subscriptions, to answer support requests, and to send service messages (things like booking confirmations your business triggers, invoices, and important notices about your account). We don't use your business data for advertising and we don't sell it.

4. Where it lives

Your data is stored in a secured cloud database with continuous backups, encrypted in transit. Access within Dumaflow is role-based: for example, field technicians never see pricing, and your team only sees your organisation's data. Some of our infrastructure providers store data on servers outside South Africa; where that happens, it is protected by contractual safeguards consistent with POPIA.

5. Who we share it with

Only service providers who help us run Dumaflow — hosting and database infrastructure, email delivery, and payment processing — and only to the extent needed for them to do their job. Each acts under contract as an operator processing data on our instructions. We'll disclose information if the law requires it, and we'll tell you when we're allowed to.

6. Your clients' information

When your business stores its clients' details in Dumaflow, your business is the responsible party for that information and Dumaflow processes it as an operator, strictly on your instructions. Keep your own clients informed about how you use their details — our POPIA statement explains the roles in more detail.

7. Team location

Where a business enables team-map features, technician locations are processed during working hours to help the office assign the nearest team member and coordinate the day. This is controlled by the business (the employer), which is responsible for informing its team; Dumaflow processes the data on the business's instructions and doesn't use it for anything else.

8. Retention and export

We keep your data while your account is active. You can export your clients, jobs and invoices at any time, and for a reasonable period after cancellation we'll help you take your data with you, after which it is deleted from live systems and cycles out of backups.

9. Your rights

You can ask us what personal information we hold about you, ask for corrections, ask for deletion where the law allows, and object to processing. Email admin@dumaflow.com and we'll respond promptly. Our POPIA statement covers these rights and the complaint process in full.

10. Cookies

This marketing site uses no tracking or advertising cookies. The app uses only the cookies and local storage needed to keep you signed in securely.

11. Changes and contact

If we make material changes to this policy we'll notify account holders by email or in-app. Questions: admin@dumaflow.com.