Last updated: 2026-10-01

Privacy Policy

How we collect, use, share, and safeguard your information on oilflow.us.

We collect

Account info, trade profile, verification docs, technical & usage data

We use it for

Counterparty screening you order, KYC verification, payments, compliance

We never

Sell your data, use tracking cookies, or let AI train on your information

1. Information We Collect

  • Account information: Name, email, company name, country, role
  • Trade profile: Product preferences, volume ranges, payment terms, corridors
  • Verification documents: Registration certificates, director ID, trade references
  • Technical data: IP address, browser type, device information
  • Usage data: Login frequency, feature usage, listing activity

2. How We Use Your Information

  • Verify identity and conduct KYC/AML due diligence
  • Run the counterparty screens and files you order, and deliver them to you
  • Process payment for those orders
  • Communicate about your orders and the service
  • Improve the screening service and the site
  • Comply with legal and regulatory obligations

2A. Lawful Basis for Processing (GDPR)

Contractual necessity (Art. 6(1)(b)): Account, the orders you place, payments
Legal obligation (Art. 6(1)(c)): KYC/AML, sanctions screening, data retention
Legitimate interests (Art. 6(1)(f)): Security, fraud prevention, service improvement
Consent (Art. 6(1)(a)): Marketing communications, withdrawable at any time

3. Information Sharing

We do not sell your personal data. We share only when necessary:

  • Sanctions screening: Names checked against OFAC, UN, EU, UK lists
  • Stripe: Billing information for payment processing
  • Whop: When you pay for a Counterparty Screen by card: your name, email, card and billing details, and the counterparty name you enter at checkout. Whop processes the payment as merchant of record
  • Supabase: Database hosting (encrypted at rest)
  • Anthropic: AI services, data not retained for training
  • Law enforcement: When required by law or to prevent fraud

4. Data Retention

  • Verification records: 5 years after end of business relationship (AML requirement)
  • Transaction records: 6 years (tax and compliance)
  • Account data: Deleted on request, subject to legal retention above
  • Usage and technical data: Up to 2 years

5. Data Security

  • TLS encryption on all data in transit
  • Row-level security and role-based access controls
  • Regular security reviews of infrastructure and code
  • Verification documents stored with restricted access

For technical security details, see our Security page.

6. Your Rights

Access: Request a copy of data we hold about you
Correction: Request correction of inaccurate data
Deletion: Request deletion, subject to legal retention
Portability: Request data in a structured, machine-readable format
Withdraw consent: Where processing is consent-based, withdraw at any time

EU/UK residents: You may lodge a complaint with your local supervisory authority. See edpb.europa.eu.

6A. California Privacy Rights (CCPA)

Right to know: Categories and specific pieces of personal information collected
Right to delete: Request deletion, subject to legal retention
Right to opt out of sale: We do not sell personal information
Non-discrimination: We will not discriminate for exercising CCPA rights

CCPA requests: privacy@oilflow.us. Response within 45 days.

6B. Kenya Data Protection Act

Your data is processed per the Kenya Data Protection Act 2019. Complaints may be directed to the Office of the Data Protection Commissioner (ODPC).

7. Sub-processors

ProviderPurposeLocation
SupabaseDatabase & authUnited States
StripePaymentsUnited States
WhopCard checkout for the Counterparty Screen (merchant of record): buyer contact, card and billing details, the counterparty name entered at checkoutUnited States
AnthropicAI servicesUnited States
ResendEmail deliveryUnited States

8. International Data Transfers

Your data may be processed in the United States. For EEA/UK transfers, we rely on Standard Contractual Clauses (Decision 2021/914) and the UK IDTA. Copies available at privacy@oilflow.us.

9. Cookies

We use only session and security cookies, no advertising, no cross-site tracking.

10. EU Representative

EU representative details will be published here once appointed. Inquiries: privacy@oilflow.us.

11. Changes to This Policy

Material changes notified by email at least 30 days before taking effect.

12. Contact

OilFlow Network

privacy@oilflow.us · oilflow.us

We respond to all privacy requests within 30 days.

Platform Security →Terms of Service →