Privacy Policy

RAMS-flow ("we", "us", "our") provides Risk Assessment and Method Statement software for UK contractors and site teams.

For the purposes of UK data protection law, we are the data controller for personal data held in your account. You can contact us about anything in this policy at hello@rams-flow.com.

RAMS-flow is intended for use by businesses and their employees. You must be aged 18 or over to create an account or use the Service.

• Account data — full name, email address, hashed password, role within your company.
• Company data — company name, billing status, subscription plan, seats purchased, branding logo.
• Documents you create — RAMS, risk assessments, COSHH assessments, methodology photos, subcontractor documents, safety data sheets you upload.
• Audit and activity logs — actions you take on documents (create / edit / version bumps), timestamps, IP metadata from the underlying platform.
• Billing identifiers — Stripe customer and subscription IDs. Card details are held by Stripe, not by us.
• Email-delivery records — message IDs and bounce/complaint status for the operational emails we send you.

• Contract — to provide the service you signed up for: storing your documents, managing your team, billing your subscription.
• Legitimate interest — to keep the service secure, prevent abuse, send operational emails (welcome, renewal reminders, payment failures), and improve the product.
• Legal obligation — to retain financial records for the period required by UK tax law.

• Active accounts — for as long as the account is open.
• After cancellation — your documents remain accessible in read-only mode for 30 days so you can export anything you need.
• On deletion request — we permanently delete your account, documents, storage files, and authentication credentials. We retain a minimal compliance audit record (date and event type only) of the deletion itself.
• Financial records — invoice metadata is kept for 6 years to meet UK tax requirements.

We use the following processors to deliver the service:

• Lovable Cloud / Supabase — database, file storage, and authentication. EU-based.
• Stripe — subscription payments and billing.
• Postmark — transactional email delivery.
• Anthropic — artificial intelligence platform used to generate risk assessment content when you use the AI generation features. Task descriptions and industry context you provide are sent to Anthropic's API for processing. Anthropic is based in the United States. Data is processed under Anthropic's privacy policy and data processing terms available at anthropic.com/privacy. No personal identification data is sent — only the task description you enter.
• Cloudflare — security and bot protection service used on our sign in and sign up pages (Cloudflare Turnstile). Cloudflare may process your IP address and browser information to verify you are a human user. Cloudflare is based in the United States. Data is processed under Cloudflare's privacy policy available at cloudflare.com/privacypolicy.

Each of these has their own privacy policy and acts as a data processor on our behalf. We do not sell your personal data and never share it for advertising purposes.

Under the UK GDPR you have the right to:

• Access your data — use Settings → Privacy → Download my data to receive a JSON file of everything we hold about you.
• Rectify inaccurate data — update your profile in Settings.
• Erase your data — use Settings → Privacy → Delete my account for personal deletion, or Settings → Billing → Close account to delete the whole company.
• Object to processing or restrict it — contact us at hello@rams-flow.com.
• Complain to the Information Commissioner's Office (ICO) at ico.org.uk.

All connections are encrypted with TLS. Passwords are hashed and salted. Access to production data is restricted to authorised staff. Storage and database services are operated by certified sub-processors.

If we make material changes to this policy we will notify existing customers by email. The "last updated" date at the top of this page always reflects the current version.

We use the following cookies on RAMS-flow:

Essential cookies (always active): These cookies are necessary for the website to function and cannot be switched off. They are set in response to actions you take such as logging in or filling in forms.

• Session cookies — keep you logged in to your account securely.
• Security cookies — protect against cross-site request forgery attacks.

Security and bot protection:

• Cloudflare Turnstile — used to verify you are human when signing in. Cloudflare may set cookies as part of this verification process.

Payment processing:

• Stripe — used to process payments securely when you subscribe to a paid plan. Stripe may set cookies during the checkout process.

We do not use any advertising, tracking or analytics cookies.

You can manage your cookie preferences at any time by clearing your browser cookies and revisiting the site.

Email hello@rams-flow.com with any privacy question, data request, or complaint. We aim to respond within 5 working days.