Privacy Policy

Humanitarian Ops (by United Flows)

Last updated: July 2026

1. Introduction

This Privacy Policy explains how Humanitarian Ops ("Humanitarian Ops", "we", "us", "our") handles personal data in connection with our website and platform for non‑governmental organizations and donor‑funded programs.

We take the protection of personal data seriously — particularly because our platform is used to support humanitarian programs involving vulnerable people. Your personal data is hosted in the European Union and handled in line with GDPR‑standard data protection principles.

This policy covers the personal data for which we decide the purpose — website visitors, people who contact us or request a demo, and account users. It does not cover the beneficiary and program data that our customers enter into the platform; that relationship is explained in Section 3.

If you have any question about this policy, contact us at info@unitedflows.com.

2. The data we handle, and why

We collect and use personal data for the following purposes:

We use personal data only where we have a proper basis to do so — for example, to take steps you have requested, to provide a service under a contract, to meet legal obligations, or for our legitimate interest in operating and securing the platform. Where we rely on consent (for example, marketing emails), you can withdraw it at any time.

We do not sell personal data, and we do not share it for third‑party advertising.

3. Two roles: our data, and our customers' data

Because Humanitarian Ops is a platform that organizations use to run their programs, we handle personal data in two different roles:

• When we are the controller — for website, enquiry, account and billing data described above — this Privacy Policy applies.
• When we are a processor — for the beneficiary, household and program data that a customer organization enters into the platform — the customer organization is the controller of that data, and we process it only on that organization's instructions. That relationship is governed by a separate Data Processing Agreement, not by this Privacy Policy.

If you are a beneficiary or program participant and want to exercise your rights over your data, please contact the organization that registered you. We will support that organization in responding.

4. How we share personal data

We share personal data only with service providers that help us operate, under agreements that require them to protect it:

• Hosting and database: our platform and data are hosted with Supabase, in the European Union (Frankfurt).
• Payment processing: billing is handled by a third‑party payment processor. We do not store full card numbers.
• Other operational providers (such as content delivery and, where applicable, product features that rely on third‑party services) process limited data needed to deliver those functions, under appropriate safeguards.

We may also disclose personal data where required by law, to protect our rights or users, or in connection with a business transfer — always with appropriate protection.

5. International transfers

Our users are largely in the Middle East, Türkiye, East Africa and South Asia, and our hosting is in the European Union. Some of our service providers may be located in other countries. Where personal data is transferred across borders, we rely on appropriate safeguards (such as recognized adequacy or standard contractual protections) to keep it protected.

For organizations with data‑residency or sovereignty requirements, Humanitarian Ops also offers on‑premises or private‑cloud deployment, which keeps program data within the organization's own infrastructure.

6. How we protect personal data

We use technical and organizational measures appropriate to the sensitivity of the data, including:

• Encryption in transit: TLS between your device and the platform.
• Encryption at rest: disk‑level encryption of the underlying database.
• Field‑level encryption of beneficiary identifiers: direct‑identifier fields (name, national ID, phone, address, date of birth, GPS location, notes, household head name) are encrypted at the application layer using per‑organization keys, and are decrypted only through role‑gated, audit‑logged functions — so access to identifiers is limited to authorized roles and is recorded.
• Access control and data isolation: role‑based permissions, with each organization's data separated from others'.

We describe controls that are actually implemented. Humanitarian Ops is not end‑to‑end encrypted, and we do not claim security certifications that have not been independently verified. No system is perfectly secure, but we work to protect personal data and to strengthen our controls over time.

7. How long we keep personal data

We keep personal data only as long as necessary for the purposes above — for example, to respond to your enquiry, to provide your account for as long as you use the service, and to meet legal, accounting and tax obligations. When personal data is no longer needed, we delete it or irreversibly anonymize it.

8. Your rights

Depending on your location and applicable law, you may have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted in certain circumstances;
• object to or restrict certain processing;
• receive data you provided in a portable format; and
• withdraw consent where we rely on it.

To exercise any of these, email info@unitedflows.com. We may need to verify your identity first, and we will respond within a reasonable time. You may also have the right to complain to a data protection authority in your jurisdiction.

9. Cookies

We use cookies and similar technologies that are necessary to operate the website and keep it secure. Where we use any non‑essential cookies or analytics, we will do so in line with applicable law and, where required, with your consent.

10. Children

Humanitarian Ops is intended for use by organizations and their staff, not by children. Where customer organizations process data about children as part of their programs, they do so as controllers and are responsible for applying appropriate protections and safeguarding standards.

11. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above and, where changes are significant, provide a more prominent notice.

12. Contact

For any privacy question or request, contact us at:

info@unitedflows.com