Privacy Policy

1. What We Collect

Account information: your name, email address, and password (hashed, never stored in plain text) when you register.

Content and media: images, videos, captions, and other material you upload or create within BukoFlow.

Social connections: OAuth tokens for the social media accounts you connect. We store only what is needed to publish on your behalf; we never post without your explicit instruction.

Usage data: pages visited, features used, and actions taken within the app, to help us understand how the product is used and improve it.

Billing information: payment is handled entirely by Stripe. We receive only a non-sensitive subscription status; we never see or store your full card number.

Timezone: collected at registration to schedule posts in your local time.

2. How We Use It

• Provide and operate the BukoFlow service
• Publish scheduled content to your connected social accounts
• Send transactional emails (account verification, billing receipts)
• Send product updates and onboarding tips (you may opt out at any time)
• Detect and prevent fraud or abuse
• Improve and develop the platform

We do not sell your personal information. We do not use your content for advertising.

3. Third-Party Services

We use the following trusted third parties to operate BukoFlow:

• Hosting provider: application hosting and database (servers in the US)
• Media storage provider: uploaded file storage (US/EU data centres)
• Stripe: payment processing
• Email delivery provider: transactional email delivery
• Meta, LinkedIn, and other social platforms: receiving published content via their APIs
• Cloudflare Turnstile: bot and fraud detection on signup. Turnstile processes signals such as IP address, browser, and device information to tell humans from bots, acting as our data processor for this purpose. See Cloudflare's Turnstile Privacy Addendum for details

Each provider operates under their own privacy policy and, where required, under a data processing agreement with us.

4. Data Retention

We keep your account data for as long as your account is active. If you delete your account, we will delete or anonymise your personal information within 30 days, except where we are required to retain it for legal or accounting purposes.

Uploaded media is deleted from storage within 30 days of account deletion.

5. Cookies

We use a single session cookie to keep you logged in. We do not use advertising, tracking, or analytics cookies from third parties. No cookie consent banner is required.

6. Your Rights

Under the NZ Privacy Act 2020 and GDPR (where applicable) you have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion of your account and data
• Export your data in a portable format
• Object to or restrict certain processing
• Withdraw consent (where processing is based on consent)

To exercise any of these rights, email [email protected]. We will respond within 20 working days.

7. Security

We use HTTPS for all data in transit and encrypt passwords using bcrypt. Access to production data is restricted to authorised personnel only. No security measure is perfect; please contact us immediately if you believe your account has been compromised.

8. Children

BukoFlow is not directed at anyone under 18. We do not knowingly collect personal information from minors. If you believe a minor has registered, please contact us and we will delete the account promptly.

9. Changes to This Policy

We will notify you by email of any material changes to this policy at least 14 days before they take effect. Continued use of BukoFlow after that date constitutes acceptance.

10. Contact

Privacy questions or complaints: [email protected]

Golden Tree Digital, New Zealand