MeterFlow Privacy Policy
Last updated: 11 November 2026
This Privacy Policy explains how MeterFlow, operated by Fulvio Antonio Cosco Barletta, a sole trader trading as MeterFlow (“we”, “us”), collects, uses, and protects personal data when you use our website and the MeterFlow service (the “Service”). We act as the data controller for the personal data described below. For questions or to exercise your rights, contact support@meter-flow.com.
1. Data we collect
- Account data — your name, email address, hashed password, and organisation name, provided at registration; a profile picture, if you add one; the times of your last login and of your acceptance of the Terms; and, when you reached the sign-up page through a link carrying campaign tags (
utm_source,utm_medium,utm_campaign), those tags, kept with the organisation you create. - Team invitations — the email address and role of a person an organisation owner or admin invites, to which we send the invitation email.
- Billing data — your subscription tier and billing status. Payment details (card number, billing address) are collected and stored by Paddle, not by us. Paddle notifies us of each subscription and payment change: we keep a customer/subscription reference, and each notification as received for 90 days (it may include the cardholder’s name and payment-method details such as the card type and last four digits), after which only its type, date and outcome remain.
- Service data you submit — usage events, customer external identifiers, meters, plans, and credit transactions you send through the API or SDK. You control what this contains.
- Technical data — IP address, request metadata, and server logs generated when you use the Service (used for security, rate limiting, and debugging, with a request ID for support correlation). Log lines also record the organisation and project a request was for.
- Support correspondence — the emails you send to our addresses or through the help form, and our replies.
2. Cookies and local storage
The website and the dashboard store a few small values in your browser’s local storage: your theme preference, your language preference, and (in the dashboard) your session token. These are strictly necessary for the site to work, so no consent banner is shown. We do not use third-party advertising or tracking cookies. Any web analytics we run are cookieless and aggregate-only, and do not identify individual visitors.
3. How we use data and our lawful bases
| Purpose | Lawful basis (GDPR / UK GDPR Art. 6) |
|---|---|
| Providing and operating the Service (accounts, API, dashboard) | Performance of a contract |
| Processing payments and managing subscriptions | Performance of a contract |
| Sending transactional email to account holders (welcome and verification, password reset, usage-quota warnings, payment-failure notices) | Performance of a contract |
| Answering support requests | Performance of a contract / legitimate interests |
| Security, fraud prevention, rate limiting, backups, and debugging | Legitimate interests |
| Knowing which channels bring us customers (the campaign tags of the link you signed up through) | Legitimate interests |
| Complying with legal and tax obligations | Legal obligation |
4. Sub-processors we share data with
We use a small set of providers to run the Service. Each processes only the data needed for its function:
| Provider | Purpose | Data |
|---|---|---|
| Paddle Paddle.com Market Ltd (UK) / Paddle.com Inc. (US) | Merchant of record: checkout, payments, invoicing, sales tax and VAT | Name, email, billing address, payment details, transaction history |
| Hostinger Hostinger International Ltd (Cyprus / Lithuania) | Virtual private server hosting the API, background workers and the primary database | All Service data at rest (account, billing references, usage events, ledger) |
| Backblaze Backblaze, Inc. (US) | Off-site storage of encrypted database backups (B2) | Full database snapshots, encrypted client-side before upload (Backblaze only holds ciphertext) |
| Cloudflare Cloudflare, Inc. (US) | DNS, edge network and static hosting of this website and the dashboard (Cloudflare Pages); cookieless, aggregate visit statistics for this website (Web Analytics); the help form’s spam check (Turnstile); forwarding of email sent to our addresses (Email Routing) | Technical connection data (IP address, request metadata); help-form messages and emails to our addresses, in transit |
| Google Google LLC (US) | Mailbox hosting: receiving and storing the emails sent to our addresses, and our replies | Support correspondence: senders’ names, email addresses and message content |
| Grafana Labs Raintank, Inc. dba Grafana Labs (US); logs stored in its UK region | Application log storage, search and alerting (Grafana Cloud Loki), kept 14 days | Technical log lines: request paths, status codes, request ids, IP addresses, error messages |
| Resend Resend, Inc. (US) | Transactional email delivery: welcome and email verification, password reset, organisation invitations, usage-quota warnings, payment-failure notices, and help-form messages to our inbox | Name, email address, email content |
We do not sell your personal data. We only share it with these providers, or where required by law. This list is also published, with our change-notice commitment, in the Data Processing Agreement.
5. International transfers
We are based in the United Kingdom. Several of our providers are headquartered in the United States and may process data there or in other countries outside the UK and the European Economic Area. Where that happens, transfers are protected by appropriate safeguards: the UK International Data Transfer Agreement or Addendum, the European Commission’s Standard Contractual Clauses, or an adequacy decision (including the UK Extension to the EU–US Data Privacy Framework where the provider is certified).
6. Retention
We keep account and billing data for as long as your account is active and as required to meet legal, tax, and accounting obligations. Service data you submit is retained according to your plan and is deleted or anonymised when no longer needed. In particular, live usage events are kept for your plan’s analytics-retention window shown on the pricing page (45, 90, 180 or 365 days) and then deleted; test usage events are deleted after 30 days; and a test subscription with no usage for 90 days is deleted together with its test credit balance and ledger. Payment-provider notifications (Paddle’s, and those of the providers our customers connect) are kept as received for 90 days, then reduced to each event’s type, date and outcome. Application logs are kept for 14 days. Encrypted database backups are kept on a rolling schedule and expire automatically within six months. You can delete your account yourself, from your profile in the dashboard, once the organizations you own are deleted; an organization’s owner deletes it from the Dashboard. An organization’s projects are switched off at once; the organization, or the account, is deleted once 30 days have passed, unless you cancel before then. You can also request deletion by email at any time.
7. Your rights
Subject to applicable law, you have the right to:
- access the personal data we hold about you;
- correct inaccurate data;
- request erasure of your data;
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw consent where processing is based on consent;
- lodge a complaint with your local data-protection authority — in the UK, the Information Commissioner’s Office (ICO).
Organisation owners and admins can also download a project’s usage events, credit ledger, subscriptions and credit reservations themselves, as CSV or JSON Lines, from the Projects table in the dashboard.
To exercise any of these, email privacy@meter-flow.com. We will respond within the timeframe required by law (normally one month).
8. Security
We use industry-standard measures to protect data, including encryption in transit (HTTPS), hashed passwords (bcrypt), hashed API keys, role-based access controls, and client-side encrypted off-site backups. No system is perfectly secure, but we work to protect your data and to notify you of any breach as required by law.
9. Children
The Service is not directed to individuals under 18, and we do not knowingly collect their personal data.
10. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email or a notice in the dashboard, and the “last updated” date above will change.
11. Contact
Data controller: Fulvio Antonio Cosco Barletta, a sole trader trading as MeterFlow, 15 Corbet Close, London SM6 7GB, United Kingdom. Privacy contact: privacy@meter-flow.com. We are a small business and have not appointed a Data Protection Officer; all requests are handled by the operator personally.