Privacy Policy

RepFlow is a field CRM for pharmaceutical and medical sales reps. This policy explains what personal data we hold and how we use it. The service is provided by Edgars Laizāns, trading as North Light Press, a sole trader established in Latvia (EU). Contact: hello@northlightpress.net.

1. Account data we hold

When you create an account we store your name, email, and organisation name. If you subscribe to a paid plan, payment metadata (customer ID, subscription status, plan) is held by Stripe. We never see or store card numbers.

2. Customer-entered content (important)

Inside RepFlow, our customers enter personal data about third parties — doctor names, clinic details, contact info, visit notes, and optional photos, audio recordings, and GPS check-in coordinates.

For that third-party data, the customer is the data controller and RepFlow acts as a processor on their behalf. Customers are responsible for having a lawful basis to hold this data and for complying with any national rules on processing healthcare-professional information (including transparency and promotion rules).

3. Sub-processors

• Lovable — hosting and Lovable Cloud database/storage. Receives all account and customer content stored in the app.
• Google Gemini (via the Lovable AI gateway) — turns visit notes (text and audio) into structured CRM fields. Receives the note contents you submit for structuring.
• Stripe — payments and billing. Receives billing name, email, and payment details you enter at checkout.
• OpenStreetMap / Nominatim — address geocoding for the map. Receives clinic address strings to return coordinates.

4. Data location

Data is stored in the EU where available. AI processing may occur outside the EU under standard contractual clauses.

5. Retention

We keep your data for as long as your account is active. Data is deleted on request — email us and we will remove your workspace and its contents.

6. Your GDPR rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data (rectification)
• Have your data erased
• Receive your data in a portable format
• Object to specific processing
• Lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija)

7. Cookies

We use only the cookies needed to keep you signed in. No advertising or cross-site tracking cookies.

8. Security

Data is encrypted in transit. Access to workspace content is restricted by row-level access control so one organisation cannot see another's data.

9. Contact

Questions or requests: hello@northlightpress.net.