Privacy policy for the Chamberflow app

Chamberflow is the member app for chambers of commerce that run their membership on Chamberflow. Your chamber is the organisation you belong to; VentureLK LLC operates the software on its behalf. Your chamber’s own privacy notice, on its website, covers everything it holds about you.

What the app uses

Your email address, to sign you in. We email you a six-digit code; the app stores no password. Your name and membership, which your chamber recorded when it admitted your organisation. Your events, tickets and invoices, which are your chamber’s records about you. Your phone’s push token, only if you allow notifications, so the chamber’s notices and event reminders reach you. Your company’s directory choices, if you change them in the app.

What it does not do

It does not track you across other apps or websites, does not use advertising identifiers, does not read your contacts or location, and does not store payment card details: payments happen on your chamber’s payment provider’s own page.

Who sees your data

Your chamber’s staff, who hold your records.

Other members of your chamber, through the member directory, when your company is listed: its name, industry, city, website and other company details, its membership type and the year it joined, its description if the company shows it, and the primary contact’s email and phone only if the primary contact chooses to show them. If your chamber makes its directory public, anyone can see the listing.

The providers that run the platform for your chamber, under contract, each for what its line says:

• Vercel Inc.: hosts the application, in its Singapore region.
• Neon Inc.: the database, on Amazon Web Services in Singapore.
• Documents uploaded to the chamber's document library: kept in the database, or in private file storage on Vercel, and served only to people signed in to the chamber. Some documents uploaded before the library moved behind sign-in may still be held in public file storage, at an address that is not listed anywhere, until they are moved.
• Vercel Blob: hosting for the public images on the chamber's website and newsletters. These are published pictures, which can show people (event photographs, for example).
• Resend Inc., United States: delivers email, from sign-in codes and invoices to newsletters, and, where open and click tracking is switched on for the domain the email is sent from, reports whether each campaign email was opened and whether a link in it was clicked. Mail from a chamber that has verified its own sending domain is sent from Resend's European (Ireland) region.
• Mistral AI, France: the writing assistant chamber staff use to draft, processing in Europe, on paid terms under which Mistral does not use the data to train its models. It sees only what a task needs: the record a message is about, which can include a name and email address; text staff paste in for it to read, such as notes, an email or a venue's proposal; when staff prepare renewals, the members being prepared (up to twelve at a time), with their primary contact, invoices, event attendance and recent notes; when staff ask the workspace assistant a question, a summary of the chamber: up to 30 member companies with their membership type and renewal outlook, the totals owed, events and email statistics; when staff work the sales pipeline, the prospects on it, with their contacts' names, titles, emails and notes; when staff plan or review an event, its details, speakers, sponsors, income and costs; when staff match a bank transfer to a member, the payer's name and the member companies' names; and when staff ask about a document, that document's text. It never sees passwords or card numbers.
• Expo (650 Industries, Inc.), United States: delivers notifications to the member app. When someone allows notifications, it receives their phone's push token, and then the title and text of each notification sent to it.
• The chamber's payment provider (Stripe, or Newebpay in Taiwan), when the chamber takes payments online: takes the payment on its own page and receives the payer's email address, the amount and what it is for.
• LY Corporation (LINE), Japan: only when the chamber has connected its LINE account and someone links theirs to it. It carries the chamber's event reminders to them on LINE, so it receives each reminder's text.
• GitHub Inc., United States: when the nightly backup is switched on, it keeps an encrypted copy of the whole database for 30 days.
• Sentry (Functional Software, Inc.): only when error reporting is switched on, it receives reports of errors in the application. Request contents, cookies and the signed-in person's email address are removed before a report is sent.
• Vercel Web Analytics: counts visits to the chamber's public website without cookies (the page, the page that linked to it, and the kind of device and browser). It is not used on the member portal or the staff pages.

Beyond these, nobody receives your data unless the law requires it or you or your chamber ask for it to be sent somewhere. We do not sell data.

Signing in and out

The app keeps a sign-in token in your phone’s secure storage and uses it to get a new access token every fifteen minutes. You can sign out at any time from Profile. Your chamber can sign you out of the app at any time, and you are signed out when it removes you from its records or your membership ends: the app stops working for you within fifteen minutes. A sign-in the app has not used for sixty days ends on its own.

Your rights

You can see what the app holds about you inside the app. To correct it, ask your chamber. To have your data deleted, ask your chamber, which passes the request on to us; we act on it within ten working days and confirm in writing what we did. You can also write to lawrence@chamberflow.ai.

Security

Data travels encrypted. Sign-in codes are stored hashed, expire in ten minutes and are burned after five wrong attempts. Access tokens last fifteen minutes, and the token that renews them is stored on our side only as a hash.