Last updated: August 2026 · Data controller: RehabFlow
RehabFlow ("RehabFlow", "we", "us") operates the RehabFlow marketplace at rehabflow.app. For the personal data described in this notice, RehabFlow is the data controller: we decide what data is collected and why. Our payment provider Paddle acts as a separate controller for the payment and tax data it collects when you buy a plan. Contact us about privacy at privacy@rehabflow.app.
Account data (name, email address, phone number, password credentials, role, profile photo); listing data you submit (property address, photos, financials, description); communications (in-app messages, attachments, support requests); usage and telemetry data (pages and listings viewed, searches, saved buy boxes, feature usage); and technical data (device and browser type, IP address, cookie identifiers). We do not collect or store your card number — payment details are entered with Paddle.
To create and administer your account and provide the marketplace, including publishing your listings and delivering messages — legal basis: performance of our contract with you. To take payment, manage subscriptions, and prevent chargebacks — contract performance and legal obligation. To keep the platform secure, verify users, and detect fraud, spam, and misleading listings — legitimate interests. To match deals to investor buy boxes, produce AI deal scores, and improve the product through analytics — legitimate interests. To send marketing or newsletter emails — consent, which you can withdraw at any time. To meet accounting, tax, and other legal duties — legal obligation.
Service providers and subprocessors that host and run the platform (cloud hosting, database and file storage, email delivery, analytics, error monitoring, support tooling). Paddle.com, which acts as the Merchant of Record and reseller for all orders placed on RehabFlow: Paddle receives the transaction data needed to process your payment, manage your subscription, handle refunds and returns, issue invoices, and meet sales-tax and VAT obligations, and Paddle handles customer service inquiries relating to orders. Other users, only where necessary to complete an interaction you initiated (for example your name and contact details are shown to a wholesaler you message). Professional advisers such as lawyers and accountants. Authorities, where disclosure is required by law. We never sell your personal data.
Our providers, including Paddle, may process data in countries outside your own, including the United States. Where data leaves the UK or EEA we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.
Account and profile data: for as long as your account is open, then up to 12 months after closure so you can reactivate. Listings and messages: while your account is open, and up to 24 months after a listing is removed to resolve disputes. Transaction and invoice records: 7 years, to meet tax and accounting law. Usage, analytics, and security logs: up to 24 months. When data is no longer needed for these purposes we delete or anonymise it.
Subject to your local law, you can request access to your data, correction of inaccurate data, deletion, restriction of or objection to our processing, and a portable copy of data you provided. Where we rely on consent you can withdraw it at any time, and you can unsubscribe from marketing emails from any email we send. You can access, export, or delete much of your data directly in your account settings, or email privacy@rehabflow.app — we respond within one month. If you are in the UK or EEA you can also complain to your local data protection supervisory authority.
We apply appropriate technical and organisational measures, including TLS encryption in transit, encryption at rest, row-level access controls scoped to your account, private storage for uploaded files, and least-privilege access for staff. No system is perfectly secure — please use a strong, unique password.
We use essential cookies and local storage to keep you signed in and to secure your session; these cannot be switched off. We use analytics cookies to understand how the product is used, and our checkout provider may set cookies needed to complete a purchase. We do not run third-party advertising cookies. You can manage or delete cookies in your browser settings.
We will update this notice when our practices change and will revise the date above. Questions, requests, or complaints: privacy@rehabflow.app.