Legal
Privacy Policy
Effective 14 August 2026Last updated 11 October 2026
What we collect, why we collect it, and what happens to your factory's data. The short version: your styles and production data are yours, we never sell them, and we never train models on them.
1 · Who we are
INDOPAR SA operates GarmentFlow. We are the data controller for the personal data described in section 2. Contact details are in section 12.
This policy explains what we collect, why, and what you can do about it. It covers our website, the GarmentFlow service and our Pin to GarmentFlow browser extension.
2 · What we collect
Account and contact information
Name, business email, company name, telephone or WhatsApp number if you give it, approximate factory size, job role, and the content of enquiries you send us.
Billing information
We do not collect or store card numbers. Payments are processed by Paddle.com as Merchant of Record. Paddle collects the payment details and provides us with the information needed to manage your subscription — typically your name, business details, country and transaction records.
Service usage and technical data
Log records of access to your instance, IP address, browser and device type, pages and features used, error reports, and the active-operator count used to determine your plan band.
Website analytics
Aggregate visit statistics — pages viewed, referring site, approximate country, device type. We use privacy-focused analytics and do not build advertising profiles or sell this data.
Support communications
Emails, messages and call notes exchanged with our support team.
Pin to GarmentFlow browser extension
Our browser extension saves styles you see on an online shop into your own GarmentFlow. It does nothing until you click its button. It then reads the page in that one tab: the styles the page shows (their names, prices, photo addresses and links) and the page's address and title.
When you click Pin to GarmentFlow, it opens your GarmentFlow's save page with what it read, and you choose what to keep. What you save is stored in your instance as your factory's data (section 3). The extension keeps one setting in your browser: your GarmentFlow address.
It does not read other tabs, track the pages you visit, or record what you type or click. It has no advertising or analytics. It sends nothing anywhere except to your own GarmentFlow, and only when you click Pin to GarmentFlow. We use what it reads only to save the styles you choose: we do not sell it, use it for advertising, or use it to train machine-learning models.
3 · Your factory's data
The important part
The data your factory puts into GarmentFlow — styles, patterns, tech packs, flats, orders, costs, production records and employee records — is yours. For that data you are the controller and we are a processor acting on your instructions.
We do not sell it. We do not share it with third parties for their own purposes. We do not use it to train machine-learning models. We access it only to operate the service, to provide support you have asked for, to comply with a legal obligation, or to investigate a suspected security incident.
Where that data includes personal data about your employees, you are responsible for having a lawful basis to process it and for informing them appropriately. We will process it only as instructed by you and as needed to provide the service.
4 · Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Providing and operating the service | Performance of a contract |
| Billing, subscription management and plan bands | Performance of a contract |
| Support and communication with you | Performance of a contract; legitimate interests |
| Security, fraud prevention and abuse investigation | Legitimate interests; legal obligation |
| Improving the product and understanding how it is used | Legitimate interests |
| Marketing emails to business contacts | Consent, or legitimate interests where permitted |
| Meeting tax, accounting and legal duties | Legal obligation |
You can unsubscribe from marketing at any time using the link in any such email or by writing to us. Unsubscribing does not stop essential service messages about your account, billing or security.
5 · Who we share it with
We use a small number of service providers. Each is bound by contract to protect your data and to use it only to provide their service to us.
| Provider | Purpose |
|---|---|
| Our hosting provider | Running your instance, backups, infrastructure security |
| Paddle.com | Payment processing as Merchant of Record, invoicing, tax |
| Email delivery provider | Transactional and support email |
| Website analytics provider | Aggregate website statistics |
A current list of sub-processors is available on request at privacy@garmentflow.io. We will give reasonable notice before adding a sub-processor that materially affects the processing of your factory data.
We may also disclose data where required by law or a valid legal request, or to establish or defend legal claims. If our business is sold or merged, data may transfer to the acquirer, who will remain bound by this policy or a materially equivalent one.
6 · International transfers
We operate internationally and our providers may process data in countries other than yours. Where personal data protected by the laws of the European Economic Area, the United Kingdom or a comparable regime is transferred, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision. Details are available on request.
Instances can be hosted in a specific region on request for Factory L plans and above.
7 · How long we keep it
| Data | Retention |
|---|---|
| Your factory data in an active instance | While your account is active |
| Your factory data after termination | Available for export for 60 days, then deleted |
| Account and contact records | Duration of the relationship, plus 12 months |
| Billing and tax records | As required by law, typically 5–10 years |
| Support correspondence | 3 years |
| Server and access logs | 12 months |
| Backups | Rolling, overwritten within 90 days |
8 · How we protect it
Your instance has its own database — your data is not pooled with other customers in a shared table. Data is encrypted in transit and at rest. Infrastructure is hosted in certified data centres with monitored physical and network security. Backups run daily and can be restored.
Access to customer instances by our staff is limited to those who need it, logged, and used only for the purposes in section 3. The service supports role and permission control so you can limit what your own people can see.
If a personal data breach affects you, we will notify you without undue delay and, where required, the relevant supervisory authority.
9 · Your rights
Depending on where you are, you may have the right to: access the personal data we hold about you; correct it; delete it; restrict or object to processing; receive it in a portable format; and withdraw consent where processing relies on consent.
To exercise any of these, write to privacy@garmentflow.io. We will respond within one month. We may need to verify your identity first.
If your request concerns data held inside a customer's GarmentFlow instance — for example if you are an employee of a factory that uses GarmentFlow — please contact that factory, which is the controller for that data. We will assist them in responding.
You also have the right to complain to your local data protection authority.
10 · Cookies
We use the minimum necessary. Essential cookies keep you signed in and keep the service secure — these cannot be turned off without breaking the service. Analytics cookies, if used, measure aggregate website usage.
We do not use advertising or cross-site tracking cookies. You can block or delete cookies in your browser; essential cookies are required for the service to function.
11 · Children
GarmentFlow is business software and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe we have, write to us and we will delete it.
12 · Changes and contact
We may update this policy. Material changes will be notified by email and in the service at least 30 days before they take effect. The date at the top shows when it was last revised.
INDOPAR SA
PY02 KM24. CAPIATA, PARAGUAY
PY02 KM24. CAPIATA, PARAGUAY
Privacy enquiries and rights requests: privacy@garmentflow.io
General support: support@garmentflow.io
General support: support@garmentflow.io