How Your Data Is Handled

Sharing your business data — sales, invoices, payroll, operational documents — is a big deal. This page explains in plain English what we do with it, where it lives, and what happens when we're done. No legalese. If anything here isn't clear, ask us before signing anything.

What data you'll typically share

For a typical engagement we'll ask for, roughly, the last 12 months of:

• Sales data — exports from your point-of-sale or transaction system
• Supplier invoices — PDFs, scans, or photos of paper invoices
• Payroll — shift hours, roles, and labor cost (exported from your payroll system)
• Operational documents — process docs, floor plans, equipment lists, hours of operation
• Industry-specific items — recipes, formulas, protocols, or other proprietary content as relevant

We will not ask for, store, or process:

• Customer credit-card information
• Personal medical or HR records beyond what's needed to compute labor cost
• Tax filings or bank statements (unless we explicitly agree to a financial-flow analysis)

Where the data lives

Default — for diagnostics, audits, and one-time engagements

• Your data sits in an encrypted database on Elliott's work machine — never uploaded to a shared cloud drive or public storage.
• All file uploads (your invoices, photos, scans) stay local and encrypted at rest.
• Nothing is shared with vendors or used to train any AI model.

For web-app and dashboard builds where you need ongoing access

• We provision a dedicated Supabase project for your engagement, configured under your business name.
• Supabase is a US-based managed service with SOC 2 Type II compliance.
• The project runs on the Supabase free tier in most cases — sufficient for small-business workloads for the foreseeable future.
• At engagement end, we transfer ownership of the Supabase project to you. You hold the keys; we no longer have access.
• All data encrypted at rest. Nothing trained on, ever.

If you'd prefer the entire analysis to run on a laptop at your business that never connects to the cloud, that's available too — just say the word during onboarding.

Who sees it

Only Elliott. Within Unleashing Flow, Elliott is the sole person handling your data. We don't use contractors or virtual assistants. Mac Steele runs business development and introductions — he doesn't access client systems or datasets. No part of your data is shared with a third party without your written approval each time.

When AI tools (Claude, GPT) help us analyze your data, those tools are configured to not train on the content you share with us. This is a contractual obligation between us and the AI providers, not a setting we can forget to toggle.

What we will NOT do without your written permission

• Post your numbers — even anonymized — on LinkedIn, in a newsletter, on the website, or in a sales deck
• Use your engagement in marketing material of any kind
• Share your proprietary content (formulas, recipes, protocols, processes) with anyone, for any purpose, ever, in any form
• Approach your suppliers, employees, or customers
• Hire your employees, or recommend them to anyone, for at least 12 months after our engagement ends

What happens when we're done

Within 60 days of engagement end:

1. All your data is deleted from our working database and from local files.
2. All uploaded files (invoice PDFs, photos, scans) are deleted from storage.
3. For web-app and dashboard builds: ownership of the Supabase project is transferred to you, and we revoke our own access.
4. You receive a signed Data Destruction Certificate confirming this is done.
5. The only thing we retain is a high-level engagement summary for our own records — no SKU-level numbers, no proprietary content, no customer or employee data.

If we have an ongoing retainer, deletion happens within 60 days of the retainer ending, not after each monthly cycle.

If something goes wrong

In the unlikely event of any data breach or unauthorized access affecting your information:

• You'll be notified within 24 hours
• We will fully cooperate with any investigation

In one sentence

Your data is encrypted, only Elliott touches it, never used for marketing without your written approval each time, and deleted within 60 days of when we finish — with the Supabase project handed over to you if we built one.

Read it. Ask questions. Then we can talk about whether the engagement makes sense.