MeterFlow Legal
Privacy Policy
Last updated: 24 October 2026
This Privacy Policy explains how MeterFlow, operated by Fulvio Antonio Cosco Barletta, a sole trader trading as MeterFlow (“we”, “us”), collects, uses, and protects personal data when you use our website and the MeterFlow service (the “Service”). We act as the data controller for the personal data described below. For questions or to exercise your rights, contact support@meter-flow.com.
1. Data we collect
- Account data — your name, email address, hashed password, and organisation name, provided at registration.
- Billing data — your subscription tier and billing status. Payment details (card number, billing address) are collected and stored by Paddle, not by us; we receive only a customer/subscription reference and transaction metadata.
- Service data you submit — usage events, customer external identifiers, meters, plans, and credit transactions you send through the API or SDK. You control what this contains.
- Technical data — IP address, request metadata, and server logs generated when you use the Service (used for security, rate limiting, and debugging, with a request ID for support correlation).
- Support correspondence — the emails you send to our support address and our replies.
2. Cookies and local storage
The website and the dashboard store a few small values in your browser’s local storage: your theme preference, your language preference, and (in the dashboard) your session token. These are strictly necessary for the site to work, so no consent banner is shown. We do not use third-party advertising or tracking cookies. Any web analytics we run are cookieless and aggregate-only, and do not identify individual visitors.
3. How we use data and our lawful bases
| Purpose | Lawful basis (GDPR / UK GDPR Art. 6) |
|---|---|
| Providing and operating the Service (accounts, API, dashboard) | Performance of a contract |
| Processing payments and managing subscriptions | Performance of a contract |
| Sending transactional email (verification, password reset, welcome) | Performance of a contract |
| Answering support requests | Performance of a contract / legitimate interests |
| Security, fraud prevention, rate limiting, backups, and debugging | Legitimate interests |
| Complying with legal and tax obligations | Legal obligation |
4. Sub-processors we share data with
We use a small set of providers to run the Service. Each processes only the data needed for its function:
| Provider | Purpose | Data |
|---|---|---|
| Paddle Paddle.com Market Ltd (UK) / Paddle.com Inc. (US) | Merchant of record: checkout, payments, invoicing, sales tax and VAT | Name, email, billing address, payment details, transaction history |
| Hostinger Hostinger International Ltd (Cyprus / Lithuania) | Virtual private server hosting the API, background workers and the primary database | All Service data at rest (account, billing references, usage events, ledger) |
| Backblaze Backblaze, Inc. (US) | Off-site storage of encrypted database backups (B2) | Full database snapshots, encrypted client-side before upload (Backblaze only holds ciphertext) |
| Cloudflare Cloudflare, Inc. (US) | DNS, edge network and static hosting of this website and the dashboard (Cloudflare Pages) | Technical connection data (IP address, request metadata) |
| Grafana Labs Raintank, Inc. dba Grafana Labs (US); logs stored in its UK region | Application log storage, search and alerting (Grafana Cloud Loki), kept 14 days | Technical log lines: request paths, status codes, request ids, IP addresses, error messages |
| Resend Resend, Inc. (US) | Transactional email delivery (verification, password reset, welcome) | Name, email address, email content |
We do not sell your personal data. We only share it with these providers, or where required by law. This list is also published, with our change-notice commitment, in the Data Processing Agreement.
5. International transfers
We are based in the United Kingdom. Several of our providers are headquartered in the United States and may process data there or in other countries outside the UK and the European Economic Area. Where that happens, transfers are protected by appropriate safeguards: the UK International Data Transfer Agreement or Addendum, the European Commission’s Standard Contractual Clauses, or an adequacy decision (including the UK Extension to the EU–US Data Privacy Framework where the provider is certified).
6. Retention
We keep account and billing data for as long as your account is active and as required to meet legal, tax, and accounting obligations. Service data you submit is retained according to your plan (including the analytics-retention window shown on the pricing page) and is deleted or anonymised when no longer needed. Encrypted database backups are kept on a rolling schedule and expire automatically within six months. You can request deletion of your account at any time.
7. Your rights
Subject to applicable law, you have the right to:
- access the personal data we hold about you;
- correct inaccurate data;
- request erasure of your data;
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw consent where processing is based on consent;
- lodge a complaint with your local data-protection authority — in the UK, the Information Commissioner’s Office (ICO).
To exercise any of these, email privacy@meter-flow.com. We will respond within the timeframe required by law (normally one month).
8. Security
We use industry-standard measures to protect data, including encryption in transit (HTTPS), hashed passwords (bcrypt), hashed API keys, role-based access controls, and client-side encrypted off-site backups. No system is perfectly secure, but we work to protect your data and to notify you of any breach as required by law.
9. Children
The Service is not directed to individuals under 18, and we do not knowingly collect their personal data.
10. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email or a notice in the dashboard, and the “last updated” date above will change.
11. Contact
Data controller: Fulvio Antonio Cosco Barletta, a sole trader trading as MeterFlow, 15 Corbet Close, London SM6 7GB, United Kingdom. Privacy contact: privacy@meter-flow.com. We are a small business and have not appointed a Data Protection Officer; all requests are handled by the operator personally.