For users in the European Economic Area (EEA), Switzerland, and the United Kingdom, we use cookies in accordance with:

• Regulation (EU) 2016/679 (GDPR)

• Directive 2002/58/EC (ePrivacy Directive)

• Polish Telecommunications Law

• UK GDPR and PECR

For users in the United States

This Policy complies with:

• California Consumer Privacy Act (CCPA), as amended by CPRA

• Virginia CDPA

• Colorado CPA

• Connecticut CTDPA

• Utah UCPA

• Other applicable state privacy laws

Cookies are small text files stored on your device when you visit a website.

We may also use:

• Local storage

• Session storage

• Pixels

• Web beacons

• SDKs

• API session tokens

We use cookies to:

• Authenticate users

• Secure sessions

• Prevent fraud

• Maintain API integrations

• Improve system performance

• Analyze usage patterns (with consent)

• Process subscription payments

Strictly necessary cookies are used because they are essential to provide the Service requested by you (ePrivacy exemption; GDPR Art. 6(1)(b) and/or 6(1)(f)).

All non-essential cookies (including analytics and functional cookies) are used only after obtaining your explicit consent under GDPR Article 6(1)(a).

Non-essential cookies are not placed on your device until you provide consent through our Cookie Banner.

A. Strictly Necessary Cookies (Always Active)

Purpose:

• User authentication

• Session management

• CSRF protection

• Load balancing

• Secure API synchronization

• Fraud prevention (payment processing)

These cookies cannot be disabled as they are essential for platform functionality.

B. Functional Cookies (Consent Required)

Purpose:

• Remember dashboard layout

• Save language preferences

• Store warehouse views

C. Analytical & Performance Cookies (Consent Required)

Purpose:

• Measure system usage

• Identify API latency

• Improve user experience

• Monitor uptime

We may use: Google Analytics, Mixpanel

Where technically possible:

• IP anonymization is enabled

• Data retention is limited

• Data processing agreements are in place

D. Payment & Security Cookies

Provider: Stripe, Inc.

Purpose:

• Payment authentication

• Fraud detection

• Subscription processing

These may be categorized as strictly necessary when used solely to complete a transaction initiated by you.

When connecting your account to third-party Marketplace Platforms (e.g., Amazon, Shopify):

• You may be redirected to their domains.

• Those platforms may set their own cookies.

• ExactFlow does not control those cookies.

We encourage you to review their respective cookie policies.

Where cookie data results in transfers outside the EEA/UK:

• Transfers are protected by EU Standard Contractual Clauses (SCCs)

• Supplementary safeguards such as encryption are applied

• UK Addendum applies where required

Consent Management

Upon your first visit, you can:

• Accept all cookies

• Reject non-essential cookies

• Customize preferences

You may withdraw or modify your consent at any time via the "Cookie Settings" link in our website footer.

Withdrawal of consent does not affect the lawfulness of processing before withdrawal.

Global Privacy Control (GPC)

We recognize and honor browser-based opt-out signals such as Global Privacy Control (GPC) where legally required.

Browser Controls

You may configure your browser to block cookies. However, blocking strictly necessary cookies will prevent the Service from functioning properly.

ExactFlow does not sell personal information.

We do not share personal information for cross-context behavioral advertising as defined under CPRA.

• Session cookies: deleted upon logout

• Persistent cookies: retained for a maximum of 24 months

• Analytics data: retained according to configured platform retention settings

We may update this Cookie Policy to reflect changes in technology, law, or operational requirements.

Material changes will be communicated through our website or dashboard notification.

EXACTFLOW PROSTA SPÓŁKA AKCYJNA

Stanisława Bodycha 87, 05-816 Reguły, Polska

Email: privacy@exactflow.com

EU Supervisory Authority:

Prezes Urzędu Ochrony Danych Osobowych (UODO) – Poland

Users in the US may contact their state Attorney General where applicable.