Privacy Policy

Effective Date: The date on which LICENSEE completes electronic acceptance of the EULA ("I Agree" click-wrap or checkout completion), or the date of first access to the Platform, whichever is earlier.

Section 1 — Introduction

O and P Advisory Services, LLC ("FLOWOFKANBAN," "we," "us," or "our") respects your privacy. This Privacy Policy describes how we collect, use, disclose, and protect information when you access and use the FLOWOFKANBAN Material Replenishment Platform (the "Platform").

This Privacy Policy is incorporated by reference into our End User License Agreement ("EULA") and is an integral part of the agreement between you ("LICENSEE," "you," or "your") and us. In the event of any direct conflict between the EULA and this Privacy Policy with respect to the treatment of Licensee Data, the EULA shall control. Capitalized terms used but not defined in this Privacy Policy have the meanings given to them in the EULA.

Section 2 — Information We Collect

2.1 Account Registration Data

When you create a FLOWOFKANBAN account, we collect information necessary to establish and manage your account, including: your full name, email address, company name, and role designation (tenant admin, board owner, team lead, contributor, viewer). If you invite team members, we collect their email addresses for the purpose of issuing invitations. This information is provided voluntarily by you at registration and is required for the Platform to function.

2.2 Licensee Data

Licensee Data is the business and operational data that you and your Authorized Users input into the Platform. This includes, without limitation: part and material master records, location hierarchies, kanban loop definitions and sizing parameters, kanban card states, move requests and move events, conveyance routes, station issues, alerts, and any other data you submit to or through the Platform. As between you and FLOWOFKANBAN, you retain all right, title, and ownership interest in and to your Licensee Data. We process Licensee Data solely as described in Section 3 below and in accordance with the limited license granted in the EULA.

2.3 Technical Usage Data

We automatically collect certain technical and usage information when you interact with the Platform, including: IP address, browser type and version, device identifiers, operating system, referring URLs, timestamps of access, session duration, feature usage patterns, page interactions, and error logs. This data is collected through server logs, cookies, and similar technologies as described in Section 6 below.

2.4 Billing and Payment Data

When you purchase a subscription or add-on, we collect billing-related information including your name, company, billing address, and subscription plan selections. Payment card information is processed exclusively by our payment processor, Stripe, and is not stored on our servers. We receive a tokenized reference from Stripe but do not see, store, or transmit your full payment card details.

2.5 Communications Data

If you contact us directly — via email, our contact page, or support channels — we collect the information you provide in those communications, including your name, email address, and the content of your message. We retain this information for the purpose of responding to your inquiry and maintaining a record of our communications.

Section 3 — How We Use Your Information

3.1 Providing the Platform

We use Account Registration Data, Licensee Data, and Technical Usage Data to: (a) operate, maintain, and improve the Platform; (b) authenticate users and manage sessions; (c) store and process your loops, cards, locations, and move records; (d) generate Outputs based on your inputs, including loop sizing recommendations and material flow alerts; (e) provide customer support; and (f) communicate with you about your account, subscription, and the Platform.

3.2 Billing and Subscription Management

We use Billing and Payment Data to: (a) process subscription payments; (b) manage billing cycles and renewals; (c) handle cancellations and refunds as applicable under the EULA; (d) detect and prevent fraud; and (e) comply with applicable tax obligations.

3.3 Security and Compliance

We use Technical Usage Data and Account Registration Data to: (a) monitor and protect the security and integrity of the Platform; (b) detect, investigate, and respond to security incidents and unauthorized access; (c) enforce the EULA, including its Acceptable Use provisions; (d) comply with legal obligations; and (e) maintain audit trails as required.

3.4 Aggregated Anonymous Data

We may collect, use, analyze, and disclose anonymized, aggregated, de-identified technical and usage data derived from your use of the Platform (including feature usage patterns, session frequency, performance metrics, error rates, and load data), provided that such data: (a) cannot reasonably be used, alone or in combination with other information, to identify you, any Authorized User, or any individual; and (b) does not incorporate or reveal any Licensee Data.

3.5 Uses We Do Not Make

• We do not sell Licensee Data or Account Registration Data to third parties.
• We do not use Licensee Data to train machine learning models, except as expressly provided in the EULA with respect to Aggregated Anonymous Data.
• We do not use Licensee Data for advertising or marketing to third parties.
• We do not share Licensee Data with third parties for their own independent commercial purposes.

Section 4 — Legal Bases for Processing

4.1 General

For individuals in the European Economic Area, the United Kingdom, or Switzerland, we process personal data under the EU General Data Protection Regulation (GDPR) based on the following legal bases: (a) performance of a contract — processing necessary to provide the Platform services under the EULA; (b) compliance with legal obligations; (c) legitimate interests — processing for security, fraud prevention, and platform improvement, balanced against your privacy rights; and (d) consent — where you have provided explicit consent for specific processing activities.

4.2 California Consumer Privacy Act (CCPA/CPRA)

For California residents, we process personal information as a "service provider" or "processor" on behalf of our business customers, consistent with the business-to-business and employee data exemptions under the CCPA as amended by the CPRA, where applicable. We do not sell personal information as defined by the CCPA. Licensee Data that you input into the Platform is processed on behalf of the business entity that licensed the Platform, and that entity is the "business" responsible for providing privacy notices to its employees and end users.

Section 5 — How We Share Your Information

5.1 Sub-Processors and Service Providers

We engage a limited number of trusted third-party service providers and sub-processors to deliver the Platform. These providers process data on our behalf under contractual obligations that are no less protective than the commitments in this Privacy Policy. Our current sub-processors are listed in Section 9 below and maintained on our Sub-Processor List page. We do not authorize any sub-processor to use your data for its own purposes.

5.2 Legal and Regulatory Disclosures

We may disclose Account Registration Data, Technical Usage Data, or other information if required to do so by law, regulation, court order, subpoena, or other governmental authority, or in response to a lawful request from law enforcement. We may also disclose information to protect our rights, property, safety, or the rights, property, or safety of others, including to prevent fraud or enforce the terms of the EULA.

5.3 Business Transfers

In the event of a merger, acquisition, corporate reorganization, or sale of all or substantially all of our assets, we may transfer Account Registration Data, Technical Usage Data, and billing information to the acquiring entity. We will provide notice of such transfer and any choices you may have, where required by applicable law. Licensee Data remains subject to the terms of the EULA and the acquiring entity must honor those terms.

5.4 What We Do Not Share

We do not share Licensee Data with third parties for their own independent commercial purposes. We do not sell personal information to data brokers or advertising networks. We do not share your data for cross-context behavioral advertising. Sub-processor access is strictly limited to what is necessary to provide the contracted service.

Section 6 — Cookies and Tracking Technologies

The Platform uses cookies and similar tracking technologies for the following purposes: (a) Essential cookies — required for the Platform to function, including authentication, session management, and tenant context; (b) Preference cookies — remembering your interface settings, including your selected station on the line-side console; (c) Analytics and performance cookies — understanding aggregated feature usage and diagnosing errors; and (d) Security cookies — detecting anomalous sessions and rate-limiting abuse.

Essential and security cookies cannot be disabled without preventing the Platform from functioning. Full details, including cookie names and durations, are described in our Cookie Policy.

Section 7 — Data Security

We implement appropriate technical and organizational measures designed to protect your information, including TLS 1.2+ encryption in transit, encryption at rest for stored data, role-based access control, row-level tenant isolation enforced at the database layer, and server-side authorization on all privileged operations. A full description is available on our Security page.

No method of transmission or storage is completely secure. While we work to protect your information using commercially reasonable safeguards, we cannot guarantee absolute security.

Section 8 — Data Retention and Deletion

We retain Account Registration Data and Licensee Data for as long as your subscription remains active. Upon cancellation, your data remains accessible until the end of the then-current paid Subscription Term.

You may request permanent deletion of all Licensee Data — including parts, locations, loops, cards, move history, and audit records — at any time by contacting us. Deletion is performed upon verified request and is irreversible. We may retain certain records where required to comply with legal, tax, or accounting obligations, or to resolve disputes and enforce our agreements.

Section 9 — Sub-Processors

The following third parties process data on our behalf. This list is reviewed regularly and maintained in full on our Sub-Processor List page, including the categories of data each provider accesses.

Section 10 — Your Privacy Rights

Depending on your jurisdiction, you may have the right to request access to, correction of, deletion of, or a portable copy of your personal data, and to object to or request restriction of certain processing. You may also have the right to withdraw consent where processing is based on consent.

Where FLOWOFKANBAN acts as a processor on behalf of a business customer, requests concerning Licensee Data should be directed to that business customer as the controller. We will assist our customers in responding to such requests. To exercise a right or ask a question, contact privacyflowofkanban@oandpadvisoryservices.com. We will respond within the timeframe required by applicable law.

Section 11 — International Data Transfers

The Platform and its sub-processors are hosted in the United States. If you access the Platform from outside the United States, your information will be transferred to, stored in, and processed in the United States. Where required, such transfers are made pursuant to appropriate safeguards, including the Standard Contractual Clauses approved by the European Commission, as described in our Data Processing Addendum.

Section 12 — Children's Privacy

The Platform is a business-to-business tool intended solely for use by commercial entities and their Authorized Users. It is not directed to individuals under the age of eighteen (18), and we do not knowingly collect personal data from children. If we learn that we have collected such data, we will delete it promptly.

Section 13 — Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page with a revised "Last Updated" date and provide notice of material changes via email to the address on file or through an in-Platform notification at least fourteen (14) calendar days before the changes take effect.

Section 14 — Contact Us

O and P Advisory Services, LLC — publisher of FLOWOFKANBAN.