OwambeFlow Data Policy
Last updated: October 27, 2026
1. Purpose
This Data Policy explains what data OwambeFlow handles, why, where it is stored, who processes it on our behalf, and how long we keep it. It complements our Privacy Policy and Cookie Policy.
2. Data we handle
- Account data: name, email, phone, country, date of birth, username and profile photo.
- Event data: event details, invitations, guest lists, guest IDs, RSVPs, plus-ones and check-ins.
- Communications: event chat messages, comments, photos and reviews.
- Financial records: AsoLedger orders and manually recorded payments, and E-Spray records. We do not store card numbers.
- Technical data: device and browser information, IP address, logs and error reports.
3. How we use data
- To provide and secure the service, including sign-in and two-factor verification.
- To let organizers manage their events and guests take part in them.
- To send transactional emails such as invitations, confirmations and security alerts.
- To fix errors, prevent fraud and, with your consent, improve the product through analytics.
- To meet legal, accounting and anti-money-laundering obligations.
4. Platforms we use to manage data
We use the following service providers. Each processes data only to deliver its service to us and is bound by its own security and data-protection commitments.
| Platform | Purpose |
|---|---|
| Supabase | Database, authentication and file storage Account details, event, guest, RSVP, check-in, chat, AsoLedger and E-Spray records, uploaded images and documents. |
| PostHog | Product analytics and error tracking Pages visited, feature usage, device/browser details and error reports. Analytics run only if you accept analytics cookies. |
| Email delivery provider | Sending account and event emails Recipient email address, name and the content of transactional emails (invites, confirmations, sign-in codes). |
5. Storage, security and access
- Data is encrypted in transit (HTTPS) and at rest by our infrastructure providers.
- Row-level access rules ensure organizers see only their events and guests see only what they are permitted to see.
- Private files are stored in access-controlled storage and shared using time-limited links.
- Important actions are recorded in audit logs for security and accountability.
- Some providers may process data outside your country; where they do, we rely on appropriate safeguards.
6. Cookies and consent
Essential cookies and local storage keep you signed in and the site secure. Analytics (PostHog) only start after you choose "Accept all" in the cookie banner. You can change your choice by clearing your browser storage for this site, which will show the banner again.
7. Retention
We keep account and event data while your account is active. Financial and audit records may be kept longer where required by law. Logs and error reports are kept only as long as needed to operate and secure the service.
8. Your rights
Depending on where you live, you can ask to access, correct, export or delete your data, or object to certain processing. Contact us through the Contact page and we will respond within a reasonable time.
9. Changes
We may update this policy as our services or providers change. We will post the updated version here.