Privacy Notice

Last updated 10 October 2026

Who we are

Cabinet Flow is a CRM for cabinet makers operated by Rora Labs Ltd (trading as RoraLabs), a company registered in England & Wales, company number 17174536, registered office Unit A, 82 James Carter Road, Mildenhall, Suffolk, IP28 7DE, England. ICO registration ZC152425. Contact: [email protected].

For the account and billing details of the businesses that sign up, RoraLabs is the controller. For the business data a customer enters into Cabinet Flow (leads, clients, quotes, jobs, payments), the customer is the controller and RoraLabs is its processor — see our Data Processing Agreement.

What we collect

• Account data — name, work email, company name, password (stored hashed by the authentication service). Purpose: to create and run your account. Basis: contract.
• Business data you enter — the leads, clients, quotes, jobs and payment records of your business, which may include your customers' names, contact details and addresses. We process it only to provide the service to you.
• Technical data — IP address and request logs at our web server and at Cloudflare, used to deliver and secure the service. Basis: legitimate interests.
• Billing data — if you take a paid plan, payment is handled by our payment provider; we do not store card numbers.

Cookies and analytics

This website and the Cabinet Flow app do not use advertising or analytics cookies. The app stores a sign-in session on your device, which is strictly necessary for you to stay logged in. Product analytics are not currently enabled in Cabinet Flow.

Who we share data with

We do not sell personal data. Our sub-processors are listed in the sub-processor schedule: self-hosted database and authentication (Supabase) on RoraLabs-operated servers in the UK, and Cloudflare for network delivery and protection.

International transfers

Our servers are in the UK. Cloudflare may process request data globally under its own data-protection terms. Where a transfer outside the UK occurs we rely on an adequacy regulation or the UK International Data Transfer Addendum.

Retention

Account and business data are kept while your account is active. When you close your account we delete or anonymise it within 90 days, except records we must keep by law (for example invoices). Server logs are kept for up to 90 days.

Your rights

Under UK data protection law you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to our processing, to data portability, and to withdraw consent where we rely on it. Email [email protected]; we respond within one month. You may complain to the Information Commissioner's Office at ico.org.uk. If you are a customer's client and want to exercise your rights, please contact the business that holds your data; we will assist them.

Changes

We will update this page and its date when this notice changes.