Privacy policy
Last updated 22 August 2026
CMT Flow is workshop management software for garment Cut-Make-Trim units. This policy explains what the service stores, why it stores it, and how to get it removed. It covers the application at cmtflow.online.
What we collect
Account details. Your name and email address, so you can sign in and so other members of your workshop can tell who did what.
Workshop records. The operational data you enter: articles, bundles and lots, suppliers, workers, issues, returns, payroll and ledger entries. This is your business data, entered by you.
If you sign in with Google. We receive only your name, email address and profile picture from your Google account. Nothing else is requested and nothing is written back to your Google account.
What we do not collect
No advertising identifiers, no tracking pixels, no third-party analytics, and no location data. We do not build profiles of you and we do not sell or share your data with anyone for marketing.
Payment card details are never collected, because the service does not take payments.
Why we hold it
Solely to run the service you asked for: keeping you signed in, showing your workshop its own records, and calculating payroll and balances from the entries you make. There is no secondary use.
Where it is stored
Data is held in a Postgres database operated by Supabase, and the application is served by Netlify. Access is enforced at the database level: every table carries row-level security so members can only read records belonging to workshops they have joined.
Passwords are hashed by Supabase Auth and are never visible to us or to anyone else in your workshop.
Who can see your data
Other members of your workshop, according to the permissions its owner grants them. Nobody outside your workshop can read your records.
How long it is kept
Records stay until you delete them. Archived bundles are retained so historical payroll remains reproducible. Closing your account removes your profile and sign-in credentials.
Your choices
You can edit your name and password, and connect or disconnect Google sign-in, from Account settings inside the app at any time.
To request a copy of your data or have your account and its records deleted, email the address below. Deletion requests are actioned within 30 days.
Changes
If this policy changes materially, the date at the top will be updated. Continuing to use the service after a change means you accept the revised policy.
Contact
Questions, data requests, or deletion requests: basilshabir100@gmail.com