Privacy Policy

1. Who we are and what this policy covers

Encarmo provides business management software and related websites, tools, and services, including accounting, billing and invoicing, inventory, sales and customer relationship management, human resources, payroll, scheduling, and business reporting.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit encarmo.com, use our free tools, create or manage an account, contact us, request a demonstration, receive our marketing, or otherwise interact with our services.

The entity responsible for personal information described in this policy is Inflowen, trading as Encarmo, at 75 E 3rd St., Sheridan, WY, United States, 82801, Wyoming, WY (“Encarmo,” “we,” “our,” or “us”).

You can contact us about privacy at support@encarmo.com, using the subject line “Privacy Request.” For inquiries regarding European and UK data protection or our designated compliance representative, please direct inquiries to the same address.

This policy explains our practices; it does not mean that visiting our website gives consent to optional tracking or marketing.

2. Our role when businesses use Encarmo

We generally act as a data controller for information used to manage our website, customer relationships, accounts, subscriptions, marketing, and our own security and legal obligations.

When a business uploads or manages personal information about its customers, employees, contractors, suppliers, or other individuals through Encarmo, that business generally determines why and how the information is used. We process that information on its instructions as a processor or service provider, subject to our customer agreement and applicable data processing agreement.

For example, your employer may use Encarmo to maintain your employee record, calculate payroll, manage leave, or administer shifts. The employer’s privacy notice governs its decisions about that information. Please contact that business first to request access, correction, or deletion. If we receive such a request, we will direct it to or assist the responsible business as appropriate.

Workspace administrators can manage access and may view, export, correct, or delete information within their permissions. Ask your organization about its access rules and retention practices.

3. Personal information we collect

The information involved depends on the features you use and your relationship with Encarmo.

Information you provide directly

• Account and business information: your name, work email address, business name, role, contact details, account preferences, and authentication credentials.
• Inquiries and demonstrations: information entered into contact or booking forms, company details, selected inquiry topic, scheduling availability, and messages you send us.
• Subscriptions and billing: subscription selections, billing contact, transaction references, and information required to administer payments. Payment credentials (such as credit card numbers) are processed directly by our certified payment providers (such as Stripe) under their own PCI-DSS compliant security standards; full card numbers are never stored on Encarmo servers.
• Communications: support requests, attachments, feedback, and correspondence. If a call or demonstration is recorded, we will notify participants and obtain consent where required.
• Marketing preferences: newsletter subscriptions, consent records, and unsubscribe or advertising choices.
• Applications for employment: information you choose to submit when applying for a role, such as contact details, a résumé, and work history.

Information processed through business workspaces

Depending on the modules enabled by a customer, we may process:

• Customer, supplier, and prospect names, contact details, business relationships, CRM notes, and correspondence.
• Invoice details, transaction records, bank-related information, tax information, accounting entries, expenses, and uploaded documents.
• Employee and contractor records, employment terms, compensation, tax identifiers, payment account details, attendance, leave, and HR documents.
• Appointment details, booking contacts, staff availability, and shift information.
• Inventory and order records that identify customers, suppliers, or staff.
• Reports and dashboards generated from these records.

Some information may be sensitive under applicable law, including financial identifiers or information revealed by HR documents. Customers are responsible for providing appropriate notices and establishing the permissions and legal grounds required to process it. Only submit information necessary for your intended use of an authorized feature.

Free tools and calculators

We offer free web tools such as invoice, margin, salary, and tax calculators. Values entered into these calculators run locally in your browser where possible. If an optional tool requires server processing or offers to email results, that processing is limited to providing the requested output unless you opt in to follow-up communications.

4. Information collected automatically

When you access our websites or services, we automatically collect technical information, including:

• Log and device data: IP address, browser type and version, operating system, device identifiers, referring URLs, timestamps, language settings, and network connection characteristics.
• Activity and diagnostic data: pages viewed, links clicked, interactions with features, error reports, load times, and diagnostic records used to secure and optimize the platform.
• Cookies and tracking technologies: cookies, local storage, and similar technologies used to keep you logged in, remember preferences, assess performance, and measure marketing campaigns.

5. Information from third parties

We may receive information from:

• Workspace colleagues: when an administrator or team member invites you or creates an account on your behalf.
• Payment and billing providers: confirmation of completed payments, billing country, and transaction status.
• Third-party integrations: if you connect an external account (such as calendar, email, bank feed, or single sign-on provider), we receive information necessary to enable the connection.
• Marketing and analytics vendors: business demographic information, event engagement, and campaign performance signals.

6. How we use personal information

We use personal information to:

• Provide, operate, and maintain Encarmo websites, workspaces, and services;
• Create and administer accounts, authenticate users, and manage permissions;
• Process subscription orders, invoices, renewals, and payments;
• Deliver customer support, respond to inquiries, and troubleshoot technical issues;
• Monitor, detect, prevent, and remediate fraud, security incidents, unauthorized access, and violations of terms;
• Analyze trends, track usage, and optimize the functionality, reliability, and usability of the platform;
• Communicate service notifications, billing updates, security alerts, and system notices;
• Send promotional communications, event invitations, and product news where permitted by law and subject to your preferences; and
• Comply with applicable legal, accounting, tax, and regulatory obligations, or defend legal claims.

7. Legal bases for processing (GDPR / UK GDPR)

Where European, UK, or Swiss data protection laws apply, our processing of personal information as a controller relies on:

8. How we share personal information

We do not sell personal information or share customer personal information for cross-context behavioral advertising without required consent. We disclose personal information only in the following circumstances:

• Service providers and subprocessors: trusted vendors that perform services on our behalf under written confidentiality and data protection obligations. These include cloud hosting providers, payment processors, customer support platforms, email delivery vendors, and security monitoring tools.
• Within your organization: workspace administrators and authorized users can access records, activity logs, and configurations in accordance with assigned roles.
• Third-party integrations: when you or your administrator choose to connect third-party applications, we transmit required information to that service.
• Professional advisers: lawyers, accountants, auditors, insurers, and financial consultants bound by professional confidentiality obligations.
• Legal and regulatory authorities: when we believe in good faith that disclosure is required by law, subpoena, warrant, or court order, or necessary to protect rights, safety, or prevent fraud.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of company assets, subject to customary confidentiality protections.

9. International data transfers

Encarmo operates globally and may transfer, store, and process personal information in the United States and other countries where our service providers maintain facilities.

Where personal information is transferred from the European Economic Area, the United Kingdom, or Switzerland to countries without an adequacy decision, we implement appropriate safeguards, including European Commission Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or vendor adequacy certifications.

10. Data retention and deletion

We retain personal information for the period necessary to fulfill the purposes described in this policy, support active subscriptions, comply with legal and tax retention periods, resolve disputes, and enforce agreements.

When an account or subscription is terminated, we provide a 30-day self-service export window. Following this period, customer workspace data is scheduled for deletion or irreversible anonymization in accordance with our standard backup rotation cycle, typically completed within 60 days unless extended retention is required by applicable law.

11. Security measures

We maintain appropriate administrative, technical, and physical measures designed to protect personal information against unauthorized access, destruction, loss, alteration, or disclosure.

These safeguards include 256-bit AES encryption at rest, TLS 1.3 encryption in transit, strict multi-factor authentication, least-privilege role-based access controls, regular vulnerability scanning, automated database backups, and SOC 2 Type II compliant infrastructure.

While we work continuously to protect our systems, no internet transmission or electronic storage method can guarantee absolute security. You are responsible for safeguarding your login credentials.

12. Your privacy rights

Depending on your jurisdiction, you may have the right to:

• Access: request confirmation of processing and a copy of your personal information;
• Correction: request correction of inaccurate or incomplete personal information;
• Deletion (Erasure): request deletion of your personal information, subject to statutory retention exceptions;
• Restriction: request that we restrict processing in certain circumstances;
• Data Portability: receive your data in a structured, commonly used, and machine-readable format;
• Object: object to processing based on legitimate interests or direct marketing; and
• Withdraw Consent: withdraw previously granted consent at any time without affecting past lawful processing.

To exercise these rights, email support@encarmo.com with “Privacy Rights Request” in the subject line. We will verify your identity before fulfilling the request and respond within statutory timeframes.

13. Cookies and tracking choices

We use strictly necessary cookies to ensure security, maintain authentication, and deliver requested features. We also use analytics and performance cookies to understand how our site is used.

You can manage non-essential cookies via our cookie preferences banner or through browser settings. Disabling essential cookies may impact platform functionality.

14. Regional US state disclosures (California, Virginia, Colorado, etc.)

Under the California Consumer Privacy Act (CCPA) as amended by the CPRA, and similar privacy statutes in Virginia, Colorado, Connecticut, Utah, and other US states:

• We do not sell personal information for monetary consideration;
• We do not share sensitive personal information for cross-context behavioral advertising without disclosure and opt-out rights;
• Residents have rights to access, delete, correct, and opt out of profiling or targeted advertising; and
• We do not discriminate against individuals for exercising their statutory privacy rights.

15. Children’s privacy

The Services are designed exclusively for business and professional use and are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn that personal data of a minor has been collected, we will take prompt steps to delete it.

16. Changes to this Policy

We may update this Privacy Policy from time to time. When changes occur, we will update the “Last Updated” date at the top of this document.

For material changes that impact your privacy rights, we will provide prominent advance notice through the website, via email, or inside active workspaces before changes take effect.

17. Contact us and supervisory authorities