DDM Flow
Legal · Effective 1 September 2026

Privacy Policy

This Privacy Policy describes how DDM Technology ("DDM", "we", "us") collects, uses, and shares personal information when you use the DDM Flow software-as-a-service product (the "Service") available at https://ddmflow.com.

DDM Flow is operated from South Africa. We process personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA). Where your jurisdiction provides additional rights (e.g. GDPR, CCPA), we honour those to the extent reasonably practical.

1. Information we collect

When you create an account and use the Service, we collect:

  • Account information — your name, email address, password (hashed), and business name.
  • Business data you enter — clients, items, invoices, quotes, payments, expenses, banking details for your business profile.
  • Payment information — we do not store full card numbers. Card payments are processed by Paystack; we store only a tokenised reference, the card brand (e.g. Visa), and the last 4 digits for display.
  • Usage data — IP address, browser, device type, pages visited, actions taken. Used to keep the Service secure and improve it.
  • Cookies — see Section 7.

2. How we use your information

  • To provide, maintain, and improve the Service
  • To process subscription payments and renewals via Paystack
  • To send invoices and quotes on your behalf to your customers via Resend
  • To respond to support requests
  • To detect, prevent, and address fraud, abuse, and technical issues
  • To comply with legal obligations

3. AI features and your data

Several parts of the Service send data to Anthropic Claude through the Vercel AI Gateway. This section used to name only the in-app AI Assistant, which was not the whole picture. The complete list is:

  • The AI Assistant, Penny and the AI Bookkeeper — your messages, plus the slice of your workspace the assistant needs to answer (clients, items, invoices, expenses, ledger figures).
  • Receipt and document capture — the image or PDF itself of any receipt or supplier invoice you upload or forward by email, so its fields can be read.
  • Expense categorisation — the supplier name and line-item descriptions of an expense, to suggest a category.
  • Invoice design matching — an existing invoice you upload so its layout can be reproduced.
  • Collections replies — when one of your clients replies to a payment reminder by email or WhatsApp, the text of that reply is classified for tone. Your client is not a user of the Service and did not agree to these terms; you are the responsible party for that data, and we act on your instruction as operator.
  • Cash-flow alerts — a nightly job sends a summary of your financial position (balance, upcoming money in and out) so the alert can explain itself. This runs without any action by you.
  • Tax explanations — the totals on a VAT return for the period, to write the plain-language rationale beside each field.

We do not train any model on your data, and Anthropic does not train on data submitted through its API. We have not entered a zero-data-retention agreement with Anthropic, so inputs and outputs may be retained by them for a limited period under their own policy. An earlier version of our Data Processing Agreement described this as zero-data-retention; that was wrong, and it has been corrected. If your business requires a zero-retention arrangement, contact us before using the AI features.

4. Sharing your information

We share information only with the following categories of sub-processors:

  • Supabase — primary database (hosted in Frankfurt, EU)
  • Vercel — application hosting and AI Gateway
  • Resend — transactional email delivery
  • Paystack — subscription payment processing
  • Anthropic — Claude AI models, for every feature listed in section 3

We do not sell, rent, or trade your personal information to third parties. We may disclose information when required by law, court order, or to protect rights and safety.

5. Data retention

We retain your account data for as long as your workspace exists. Cancelling a paid plan does not delete it — the workspace reverts to the Free tier and the data remains, so you can return to it later.

Deletion happens when you ask for it. Deleting your account from Settings → Account permanently removes your workspace, its records and your stored files. You can also request deletion via support@ddmtech.co.za. Some records are kept for longer where legislation requires it — company and tax records in particular — and backups are cycled out on their own schedule rather than erased on the day you ask.

6. Your rights under POPIA

You have the right to:

  • Access the personal information we hold about you (export available from Settings → Account)
  • Correct any inaccurate information
  • Request deletion of your information
  • Object to processing for direct marketing (we don't do direct marketing without consent, but the right is yours regardless)
  • Lodge a complaint with the Information Regulator of South Africa at inforeg@justice.gov.za

7. Cookies

We use a small number of cookies, all of which are strictly necessary:

  • Session cookie (Supabase Auth) — keeps you signed in
  • Theme preference — remembers your light/dark mode choice

We do not use advertising cookies and we do not track you across other websites. We do use two product-analytics and error-reporting services on our own site: PostHog (page views and feature usage, associated with your account email) and Sentry (error reports, including a recorded replay of the session in which an error occurred). Our support chat, Plain, receives your name and email so a reply reaches you. Session recording is disabled for normal use — this is a financial application — and is captured only around an error.

8. International transfers

Our infrastructure providers (Supabase, Vercel, Resend, Anthropic) may process data outside South Africa. We rely on standard contractual safeguards published by these providers for cross-border transfers.

9. Children

DDM Flow is a business tool not directed at individuals under 18. We do not knowingly collect data from children.

10. Changes to this policy

We may update this policy from time to time. Material changes will be flagged in-app or by email. The effective date at the top of this page shows when the policy was last updated.

11. Contact us

Questions about this Privacy Policy? Email support@ddmtech.co.za. For information-related complaints we cannot resolve, you may also contact the Information Regulator of South Africa.