Privacy

Last updated: 19 August 2026. This describes how AcquiriFlow handles personal data. It is written to match what the software actually does.

Who we are

AcquiriFlow is operated by Acquiri Limited, a company registered in England and Wales, company number 16133595, registered office 3 Paxton Mews, Durham, England, DH1 5BS. For questions about this policy or about data we hold, write to team@acquiri.io.

The two kinds of people in this system

This matters, because our role is different for each of them.

• Our customers. Trade businesses who sign up. For their data we are the controller: we decide what we hold and why.
• Their customers. The people a trade business has previously quoted, whose details they upload so we can text them on the business’s behalf. For these people we are a processor. The trade business is the controller and decides who is contacted; we act on their instructions.

What we hold about our customers

• Email address and password (stored hashed, never in readable form).
• Business name, trading name, timezone and currency.
• The mobile number messages are sent from and the contact for handoffs.
• Working hours and how long a visit takes.
• Billing state and, where a subscription exists, a Stripe customer reference. We never see or store card numbers.

What we hold about their customers

Only what the trade business uploads or what arrives in a conversation:

• Name, mobile number and email address where given.
• The job they were quoted for and the value of that quote.
• The date of the original enquiry.
• Every message sent and received, and whether each was delivered.
• Appointments booked, and whether the visit happened.
• Opt-out records, which we keep permanently. See below.

Text messages and opt-out

Every campaign’s first message tells the recipient they can reply STOP. Replying STOP suppresses that person immediately, across every campaign of that business, and the suppression cannot be switched off in the product. We keep opt-out records permanently and deliberately: deleting the record of somebody’s objection is what allows them to be contacted again by mistake.

Messages are not sent before 8am or after 9pm in the recipient’s local time, and no person receives more than four messages in any thirty days from one business.

Who else receives this data

Our sub-processors, and what each one sees:

• Supabase (database and authentication, London region). Holds everything described above.
• Vercel (application hosting). Processes requests; does not store the database.
• Twilio (SMS delivery). Receives the mobile number and the message text of anything sent or received.
• Anthropic (the AI that drafts replies). Receives the conversation text and the facts a business has approved. Message content is sent for the purpose of generating a reply.
• Stripe (payments). Receives the customer’s billing details directly. Card details never reach our servers.
• Calendly (demo booking). Embedded on our marketing pages. If somebody books a call, the name, email address and anything else typed into that form goes to Calendly, and it sets its own cookies when used.

The file on our home page never leaves your computer

The tool on acquiriflow.com that reads a spreadsheet and tells you how much quoted work went quiet runs entirely in your browser. The file is not uploaded, not stored, and never reaches our servers or anybody else’s. Close the tab and nothing of it remains. That is a deliberate design decision, so somebody can try it with a real customer list before deciding to trust us with one.

How long we keep it

Account and message data is kept for as long as the account is open. When a trade business closes their account, their data is deleted on request; opt-out records are retained, as described above, because deleting them would defeat their purpose. Revenue and billing records are kept for six years, as UK tax law requires.

Your rights

Under UK GDPR you may ask for a copy of your data, ask us to correct or delete it, or object to how it is used. If you are a customer of a trade business that uses AcquiriFlow, that business is the controller and the fastest route is to contact them directly; you can also write to us at the address above and we will pass it on and assist.

If you are unhappy with how we have handled a request you can complain to the Information Commissioner’s Office at ico.org.uk.