Privacy Policy

Last updated: 5 October 2026

Who we are and our role

ValuationFlow is operated by Martinaitis Ventures, a UK sole-trader business. For privacy questions or data-rights requests, contact [email protected].

Martinaitis Ventures is the data controller for personal data used to create and administer ValuationFlow accounts, subscriptions, security, service communications and support. Where a business customer uploads personal data about its own clients, suppliers, site contacts or other people solely so ValuationFlow can provide the service, that customer will generally decide why that information is used and ValuationFlow will process it on the customer's behalf. The exact legal role can depend on the circumstances.

Information we process

Depending on how you use ValuationFlow, we may process:

• account and contact details, including name, business email address and login information;
• company profile information and billing or subscription identifiers;
• project, client and supplier details, Applications for Payment, variations, retention, project costs, invoice references and commercial notes;
• uploaded contracts, certificates, supplier invoices, receipts, photos and other supporting evidence;
• client approval-link activity, certification decisions, comments and audit-history events;
• optional accounting-integration data and identifiers when you connect Xero, QuickBooks Online or Sage Accounting;
• documents and review data you deliberately submit to optional AI features; and
• technical, security and email-delivery records such as timestamps, session/security events, delivery status and diagnostic logs.

Stripe processes payment-card information used at checkout. ValuationFlow does not need to store your full payment-card number.

Where information comes from

Most information comes directly from account users. Business users may also enter information about clients, suppliers and project contacts, upload documents containing personal data, or authorise an accounting provider to return selected organisation, customer, invoice or payment-status information. Client contacts may provide information directly when they use a secure approval link.

Why we use information and our lawful bases

We use account, project and service data to provide ValuationFlow and perform our contract with the account holder. This includes authentication, project workflows, document generation, secure client links, billing administration and requested integrations.

We rely on legitimate interests where appropriate to secure and improve the service, prevent fraud and abuse, maintain audit and diagnostic records, provide essential operational communications, respond to support requests and protect our legal interests. Those interests are balanced against the rights and expectations of the people affected.

We may also process information where necessary to comply with legal obligations. Where a feature genuinely requires consent, we will identify that choice at the point it is requested and consent can be withdrawn for future processing.

Documents, client links and optional AI

Uploaded evidence and original AI-review documents are private to the relevant account unless a user deliberately shares specific evidence through a secure client approval link. The link holder can view the linked application and permitted evidence and can record a certification decision or comment. Account users should share approval links only with authorised contacts and can revoke them.

If you deliberately use an AI action, the selected document and the minimum relevant record context needed for that action may be sent to OpenAI to create a reviewable suggestion, draft or explanation. AI is optional, outputs require human review, and normal manual use of ValuationFlow does not depend on AI. ValuationFlow does not use these AI features to make solely automated decisions that have legal or similarly significant effects on individuals.

Do not upload special-category, criminal-offence or other highly sensitive personal data unless it is genuinely necessary for your business purpose and you are satisfied you have a lawful basis and appropriate safeguards.

Accounting integrations

If you authorise Xero, QuickBooks Online or Sage Accounting, ValuationFlow stores encrypted connection tokens and exchanges the customer, invoice and payment-status information needed for the actions you request. Disconnecting removes locally stored connection tokens; records already created in the accounting provider remain subject to that provider and your instructions there.

Who we share information with

We use specialist service providers to operate ValuationFlow. Depending on the feature used, these may include Railway for application/database infrastructure, Stripe for subscription payments, Resend for transactional email, OpenAI for optional AI processing, Google Workspace for business communications, and Xero, Intuit QuickBooks or Sage when you authorise those integrations.

We may also disclose information where required by law, to establish or defend legal claims, or where necessary to protect the security of ValuationFlow, its users or others. We do not sell personal data to advertisers.

International transfers

Some providers may process information outside the United Kingdom. Where UK data-protection rules require a transfer safeguard, we rely on an applicable adequacy regulation or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or an approved UK addendum where relevant. Contact us if you need more information about the safeguards used for a particular provider.

How long we keep information

We keep account and service data only for as long as it is needed for the purpose for which it was collected. In deciding retention we consider whether the account is active, whether the data remains necessary to provide the service, legal and accounting record-keeping obligations, security and fraud-prevention needs, and whether information is required to resolve a dispute or enforce an agreement.

When an account or stored document is deleted, we remove or anonymise live-service data where it is no longer required, subject to the considerations above. Backup copies may remain until the relevant backup cycle is overwritten or expires. Payment providers, accounting providers and other third parties retain their own records under their policies and your relationship with them.

Your rights

Depending on the circumstances and the lawful basis used, UK data-protection law may give you rights to access, correct or erase personal data, restrict its use, receive certain information in a portable format, and object to particular processing. Some rights are not absolute and may not apply to every record.

Your right to object

You can object to processing based on legitimate interests. Contact us at the address above and explain the processing you object to. We will consider the request under applicable UK data-protection law.

If we rely on consent for a specific processing activity, you can withdraw that consent for future processing. You can also complain to the Information Commissioner's Office (ICO) if you believe your personal data has been handled unlawfully.

Cookies and similar storage

ValuationFlow uses essential browser storage and cookies needed for secure sign-in, sessions, security controls and core service operation. We do not currently use advertising cookies. If we introduce optional non-essential tracking that requires a choice, we will provide the required notice and controls before using it.

Security

We use technical and organisational safeguards including encrypted connections, password hashing, tenant-level access controls, rate limiting, restricted administrative access, second-step admin verification, secure session controls, audit logging and protected integration secrets. No online service can guarantee absolute security.

Changes to this policy

We review this policy as ValuationFlow, its providers and applicable requirements change. If a material new use of personal data requires additional notice or choice, we will provide that information before or when the new processing begins. The date at the top of this page shows the latest revision.