Privacy policy

Effective date: October 24, 2026

This policy explains what personal data Narrow Ways Farm, LLC, doing business as Thinkfleet ("SKUFlow", "we", "us") collects, why, who we share it with, and the choices you have. It covers the skuflow.ai website, the SKUFlow web app at app.skuflow.ai, the SKUFlow mobile app for iOS and Android, and the pages SKUFlow hosts for the businesses that use it (customer portals, invoice, quote and proof links, online stores, the product designer, payment pages and business websites).

Two kinds of people, two roles

SKUFlow is software for businesses that make, decorate and sell physical products: screen printers, embroiderers, promotional products distributors and so on. That means two kinds of people show up in SKUFlow.

• Our customers. The businesses that sign up for SKUFlow, and the people who work for them (owners and office, sales, art and production staff). For their account and billing data, and for visitors to skuflow.ai, SKUFlow decides how the data is used. We are the controller (in US state law terms, the "business").
• Our customers' customers. The clients of those businesses, such as companies, teams, schools and individual buyers. A business puts their names, addresses, phone numbers, orders, artwork, invoices and so on into SKUFlow to run its work. For that data the business is the controller and SKUFlow is a processor (a "service provider"). We handle it only to provide SKUFlow to that business and on its instructions.

If you are a customer of a business that uses SKUFlow (for example, you received a proof to approve, an invoice link or an order confirmation), that business is responsible for your data. Please contact the business first with questions or requests about your information. If you contact us, we will pass your request to the business and help it respond.

What we collect from businesses and their staff

Account data. Name, email address, phone number, password or passkey, second-factor settings, the business (organization) you belong to and your role in it. Sign-in, sessions, organizations, members, invitations and roles are handled by Base316, our account and billing provider. Your session is kept in a secure, httpOnly cookie on app.skuflow.ai.

Billing data. Your plan, billing interval, trial status, invoices, AI credit and text message usage, and credit pack purchases. Plan changes, payment cards and invoices are handled in Base316's billing portal. SKUFlow does not receive or store your full card number.

Business data. Everything you enter or create to run your business: customers and their contacts, shipping and billing addresses, quotes, orders, artwork and proofs, product designs, online stores, catalog and pricing, purchase orders, production schedules, shipments, invoices, payments, inventory, expenses, notes, photos, videos, forms, signatures, messages, automations, reviews, websites and settings. See "What we process for businesses" below.

Usage and technical data. Our servers record requests (such as the page or operation, the time, the result and a request ID) to run, secure and debug the service. We keep an activity log of changes made in each business (who did what and when, including changes made by the AI assistant, by other AI assistants through MCP, or through the API). We use IP addresses, or a one-way hash of them, for rate limiting and abuse prevention.

Support and communications. What you send us by email, live chat or our forms.

What we process for businesses

When a business uses SKUFlow, it may put the following personal data about its own customers into SKUFlow, and SKUFlow processes it on the business's behalf:

• names, contact people, email addresses and phone numbers, and contact preferences (whether a number may be texted, whether marketing emails are allowed);
• shipping, billing and delivery addresses. Addresses may be converted to map coordinates (geocoded) using OpenStreetMap's Nominatim service;
• quotes, orders, artwork, proofs and approvals, product designs, store orders (including sizes and the names or numbers on personalized items), photos, signatures and notes;
• invoices, payments, refunds and fundraiser totals. For online payments, SKUFlow stores the card brand and last four digits, never the full card number (see "Payments");
• emails and text messages the business sends through SKUFlow, and replies;
• online store, product designer and website form submissions, with where the visitor came from (the page, referrer, campaign tags and ad click IDs);
• Google reviews of the business, and which customer wrote a review when the reviewer's name matches exactly one customer.

End customers also use pages SKUFlow hosts for the business: the customer portal, invoice, quote and proof links, payment pages, online stores, the product designer, the email and text preferences page, and the business's website. What they enter there goes to the business.

What we collect on skuflow.ai

Demo and contact forms. Your name, email address, and optionally your phone number, business name, business type, team size and message, plus the page you sent it from. We email each request to our team through Amazon Simple Email Service (Amazon SES), and we may also file it as a lead in our own SKUFlow account. We use it to answer you and to follow up about SKUFlow.

Scheduling a demo. After a demo request you can pick a time on our Cal.com booking page. We pass it your name and email to fill in the form. Cal.com handles the booking under its own privacy policy.

Live chat. The chat bubble is provided by Crisp. If you use it, Crisp receives your messages and anything you choose to share (such as your email address), along with technical information about your browser. Crisp stores cookies and local storage in your browser to keep your conversation going between pages and visits.

Photos. Some photos on skuflow.ai and on business websites built with SKUFlow are loaded directly from Unsplash or Pexels, as their terms require. When your browser loads one, that service receives your IP address and browser information.

No analytics or advertising cookies. skuflow.ai does not currently use analytics or advertising cookies, tracking pixels or cross-site trackers. The only cookies and browser storage set on skuflow.ai are Crisp's, for the chat. If we add analytics later, we will update this policy and ask for consent where the law requires it.

Business websites, QR codes and visitor statistics

Businesses can publish a website with SKUFlow and print QR codes. To show them simple statistics, SKUFlow counts:

• Website page views per day and page, using a beacon that sets no cookie.
• QR code scans: the device type, phone system and browser family (read from the browser's user agent), the country when our network provides it, and a daily visitor hash (a one-way hash of the IP address, user agent, day and a secret value), used only to count unique scanners. We do not store the IP address.

A business website also remembers, for the length of the browser tab, the first page of the visit, so an order or message can say where the visitor came from.

How we use personal data

• To provide SKUFlow: run accounts, store and show your data, send the emails and texts you ask for, process payments, sync with the tools you connect, and run the mobile app.
• To bill for SKUFlow, count usage (AI credits and text segments) and enforce plan limits.
• To secure SKUFlow: authenticate users, prevent abuse and fraud, rate-limit requests, keep audit logs and investigate incidents.
• To support you and answer your requests.
• To tell you about changes to SKUFlow and, if you are a business customer or asked for a demo, about our products. You can opt out of marketing emails at any time.
• To comply with the law and enforce our terms.

We do not sell personal data. We do not share personal data for cross-context behavioral advertising. We do not use the data of our customers' customers for our own purposes.

AI features

SKUFlow's AI features use Claude, a model provided by Anthropic:

• AI assistant. The chat assistant answers questions about your business and proposes changes. To answer, it sends Anthropic your question, your name and role, the business's name, the date, the page you are on, and the records it reads to answer (for example, customers, orders or invoices). It can only see and do what your role allows, and every change waits for you to approve it. Your conversations are saved to your account, visible only to you, and you can delete them.
• Review replies. When you ask for a draft, SKUFlow sends the review and, when there is one, the matched customer's last order.
• Website copy. When a business builds a website, SKUFlow sends its products, services, location and business type to draft the pages.

Each request includes only the business data needed for it. Anthropic processes it as our subprocessor to return a response. SKUFlow does not use your data to train AI models. AI output can be wrong, so SKUFlow shows drafts for you to review and nothing is sent or posted until you choose to.

Payments

What businesses pay SKUFlow is billed through Base316 and its payment processor.

What end customers pay a business goes through Stripe Connect. Each business has its own Stripe account and is onboarded and verified by Stripe. Customers pay on Stripe-hosted pages, so card and bank details go straight to Stripe and never reach SKUFlow's servers. SKUFlow stores the payment's amount, tip, status, fees, Stripe's reference numbers, the payment method type and the card brand and last four digits. A customer can choose to save a card with Stripe for future payments. Stripe uses payment data under its own privacy policy, including for fraud prevention.

Emails and text messages

Businesses send emails and texts to their customers through SKUFlow (proof requests, order and shipping updates, quotes, invoices, receipts and campaigns). Texts and phone calls go through Twilio, on an account SKUFlow provides to the business (or a Twilio account the business connects instead); emails go through SKUFlow email (SKUFlow's own Amazon SES account, the default) or the provider the business connects in its messaging settings instead: Resend, Postmark, SendGrid, Mailgun or its own Amazon SES account. SKUFlow keeps a log of each message, its content and its delivery status, and records replies, opt-outs (such as STOP), bounces and complaints so they are honored.

SKUFlow also sends its own emails to users, such as notifications about their account and their business.

SKUFlow text alerts. If you turn on text alerts in Settings → Notifications and give your mobile number, SKUFlow texts you from its own toll-free number about your work and account: orders assigned to you or cancelled, and account, billing and integration alerts. Message frequency varies. Msg & data rates may apply. Reply STOP to stop, HELP for help. Turning alerts on is optional and not required to use SKUFlow; you can turn them off at any time in the same place.

Mobile numbers and text consent are never shared for marketing. Mobile phone numbers and SMS opt-in and consent data, ours and those the businesses collect through SKUFlow, are not sold, rented or shared with third parties or affiliates for their marketing or promotional purposes. They are shared only with the providers that deliver the messages (Twilio and the mobile carriers), and only to deliver them. Text messaging originator opt-in data and consent will not be shared with any third parties, excluding aggregators and providers of the text message services.

Integrations you connect

• Google Business Profile. If a business connects Google, SKUFlow reads its locations and reviews and posts the replies the business writes. Tokens are stored encrypted. Disconnecting revokes access; reviews already synced stay.
• QuickBooks Online (Intuit). If a business connects QuickBooks, SKUFlow sends customers, invoices, payments and related records to the business's QuickBooks company. Tokens are stored encrypted. Disconnecting revokes access.
• Webhooks. A business on a plan that includes them can send event data to addresses it chooses. What happens there is the business's responsibility.

Who we share data with

We share personal data only:

• with the subprocessors below, to run SKUFlow;
• within a business, according to the roles the business sets (for example, production staff see only the work assigned to them, and cost data is hidden from roles without access);
• with services a business chooses to connect (Google, QuickBooks, its messaging providers, its webhook endpoints);
• when the law requires it, or to protect the rights, safety and property of our users, the public or SKUFlow;
• with a buyer or successor if SKUFlow is involved in a merger, acquisition or sale of assets, under this policy's protections.

Subprocessors

Where a business connects its own Twilio, email, Google or QuickBooks account, that provider also acts under the business's own agreement with it. We will update this list when we add or change a subprocessor.

Where data is stored

SKUFlow stores data in the United States, on Amazon Web Services in the us-east-2 (Ohio) region. Some subprocessors may process data in other countries (for example, Crisp is based in the European Union). If you use SKUFlow from outside the United States, your data is transferred to and processed in the United States, where data protection laws may differ from those in your country.

Security

We use technical and organizational measures designed to protect personal data, including:

• encryption in transit (HTTPS/TLS) for the website, the app and the API;
• integration tokens, webhook secrets and messaging provider credentials encrypted with AES-256-GCM, under keys we can rotate;
• database row-level security, so each business's records are separated from every other business's at the database level, in addition to permission checks on every request;
• role-based permissions, with every change recorded in an activity log;
• session tokens kept in httpOnly cookies, not readable by page scripts; two-factor sign-in and passkeys supported; each login can be signed in on at most two devices at a time;
• database backups with point-in-time recovery.

No system is perfectly secure. If we learn of a security breach that affects your personal data, we will notify you and, where required, the authorities, as the law requires.

How long we keep data

• Business data is kept while the business's account is open, so the business can use it. When an account is closed, we delete or de-identify the business's data within 30 days, unless the business asks for an export first or we must keep it by law. Backups are overwritten within 35 days after that.
• Downgrading a plan does not delete anything: the business can still see everything it made.
• Operational records are deleted on a schedule: system event records after 90 days, webhook delivery logs after 30 days, the QuickBooks sync log after 90 days, Stripe event IDs after 30 days, and the activity log after 365 days.
• Mobile app data on the phone is limited to the work assigned for today and tomorrow, photos are removed from the phone once uploaded, and signing out deletes the business's data from the phone.
• Conversations with the AI assistant are kept until the person deletes them or the account is closed.
• Website and demo requests sent to us are kept as long as needed to follow up and for our business records.
• Billing and payment records are kept as long as tax, accounting and financial laws require.

Your rights and choices

Depending on where you live, you may have the right to:

• know and access the personal data we hold about you;
• correct inaccurate data;
• delete your data;
• get a copy of your data in a portable format;
• opt out of the sale or sharing of personal data, or of targeted advertising. We do neither;
• appeal a decision we make about your request.

Business users can view and correct most of their data in the app. A business can ask us for an export of its data at any time.

Deleting your account. Accounts are created by the business you work for, which can remove you at any time. You can also ask us to delete your SKUFlow account, from the web app or the mobile app, by emailing privacy@skuflow.ai from the address you sign in with. We delete your account and sign-in details within 30 days. Records you made while working for a business (such as order notes, photos and timesheets) belong to that business and stay with it, without your account.

To make a request, email privacy@skuflow.ai. We will verify your identity before acting on it, usually by confirming you control the email address on the account. You may use an authorized agent where the law allows; we may ask for proof of their authority. We will respond within the time the law requires (for example, 45 days under California law). We will not discriminate against you for exercising your rights.

If you are a customer of a business that uses SKUFlow, please send your request to that business, which controls your data. If you contact us, we will forward it to the business. You can always stop marketing emails and texts from a business through the unsubscribe link in its emails, by replying STOP to its texts, or on the preferences page linked in its messages.

US state privacy rights

Residents of California and other states with comprehensive privacy laws (such as Colorado, Connecticut, Virginia, Texas and Oregon) have the rights described above. In the last 12 months, for our own customers, users and website visitors, we have collected the categories described in this policy: identifiers (such as name, email, phone, IP address), commercial information (plan and billing history), internet activity (requests to our servers, chat), professional information (business name, role, business type) and, for mobile app users, records of work time and work photos. We collect them for the purposes in "How we use personal data" and disclose them only to the recipients in "Who we share data with". We do not sell personal data or share it for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing the data of anyone under 16. We do not use sensitive personal data (such as account passwords) for anything other than providing SKUFlow.

For data a business puts into SKUFlow about its customers, SKUFlow acts as that business's service provider, and the business handles consumer requests.

Children

SKUFlow is a tool for businesses and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, email privacy@skuflow.ai and we will delete it.

Changes to this policy

We may update this policy as SKUFlow changes. We will post the new version here with a new effective date. If a change materially affects how we use personal data, we will tell business customers by email or in the app before it takes effect.

Contact us

Narrow Ways Farm, LLC, doing business as Thinkfleet
A North Carolina limited liability company
2890 Mount Pleasant Road South, Mount Pleasant, NC 28124
privacy@skuflow.ai