Whose data it is, where it lives, and how to get it back.

Who is responsible for what, where data is stored, which providers process it, how long it is kept, and how to ask for a copy or deletion. Last updated 5 October 2026. VentureLK LLC, Delaware, United States, operates Chamberflow.

Where the data is

The application and the database run in Singapore. The providers below handle data elsewhere, as each line says. Card numbers never reach Chamberflow: they are entered on the payment provider’s own page.

• Vercel Inc.: hosts the application, in its Singapore region.
• Neon Inc.: the database, on Amazon Web Services in Singapore.
• Documents uploaded to the chamber's document library: kept in the database, or in private file storage on Vercel, and served only to people signed in to the chamber. Some documents uploaded before the library moved behind sign-in may still be held in public file storage, at an address that is not listed anywhere, until they are moved.
• Vercel Blob: hosting for the public images on the chamber's website and newsletters. These are published pictures, which can show people (event photographs, for example).
• Resend Inc., United States: delivers email, from sign-in codes and invoices to newsletters, and, where open and click tracking is switched on for the domain the email is sent from, reports whether each campaign email was opened and whether a link in it was clicked. Mail from a chamber that has verified its own sending domain is sent from Resend's European (Ireland) region.
• Mistral AI, France: the writing assistant chamber staff use to draft, processing in Europe, on paid terms under which Mistral does not use the data to train its models. It sees only what a task needs: the record a message is about, which can include a name and email address; text staff paste in for it to read, such as notes, an email or a venue's proposal; when staff prepare renewals, the members being prepared (up to twelve at a time), with their primary contact, invoices, event attendance and recent notes; when staff ask the workspace assistant a question, a summary of the chamber: up to 30 member companies with their membership type and renewal outlook, the totals owed, events and email statistics; when staff work the sales pipeline, the prospects on it, with their contacts' names, titles, emails and notes; when staff plan or review an event, its details, speakers, sponsors, income and costs; when staff match a bank transfer to a member, the payer's name and the member companies' names; and when staff ask about a document, that document's text. It never sees passwords or card numbers.
• Expo (650 Industries, Inc.), United States: delivers notifications to the member app. When someone allows notifications, it receives their phone's push token, and then the title and text of each notification sent to it.
• The chamber's payment provider (Stripe, or Newebpay in Taiwan), when the chamber takes payments online: takes the payment on its own page and receives the payer's email address, the amount and what it is for.
• LY Corporation (LINE), Japan: only when the chamber has connected its LINE account and someone links theirs to it. It carries the chamber's event reminders to them on LINE, so it receives each reminder's text.
• GitHub Inc., United States: when the nightly backup is switched on, it keeps an encrypted copy of the whole database for 30 days.
• Sentry (Functional Software, Inc.): only when error reporting is switched on, it receives reports of errors in the application. Request contents, cookies and the signed-in person's email address are removed before a report is sent.
• Vercel Web Analytics: counts visits to the chamber's public website without cookies (the page, the page that linked to it, and the kind of device and browser). It is not used on the member portal or the staff pages.

Security, in one paragraph

The detail is on the security page. The short version is what a board usually asks.

• Everything travels over TLS. On a production deployment, payment-provider credentials are encrypted with AES-256-GCM when they are saved. Staff passwords are bcrypt hashes; members have no password and sign in with a one-time code sent to their email.
• Every session of a chamber’s own staff is bound to that chamber. Sensitive actions, such as exporting data, changing a member record, managing staff logins, changing payment or sending settings and signing documents, are written to an audit log with a name against them.
• Marketing email goes only to contacts who have consented, every message carries an unsubscribe link, and suppressions are honoured across campaigns.

Your rights, and how to use them

For your own data held by a chamber, write to the chamber; its notice names the address. For anything VentureLK LLC holds as controller, write to us.

• A copy of what we hold about you, correction of anything wrong, deletion of what we no longer need, and an end to any marketing.
• Write to lawrence@chamberflow.ai. We act within ten working days and confirm in writing what we did.
• A chamber’s members ask their chamber, which passes a request for its records on to us; we act on it within ten working days too.
• If you are in the European Union you can also complain to your local data protection authority; in Taiwan, to the authority responsible for the Personal Data Protection Act.