Handing any part of your ordering and customer data to a new system is a serious decision, so we want to be plain about how OptiFlow treats your data. In short, OptiFlow is an AI layer that reads and acts on the systems you already run. Your data stays inside your world, it is protected in transit and at rest, and access is tightly controlled. This page sets out exactly how.
Your systems stay your systems
OptiFlow does not replace your ERP or CRM and it does not take a copy of your whole database. It connects to the platform you already run, whether that is Kerridge, Intact, Ibcos or another trade system, and works with the live data it needs for the task in hand, such as a stock check, a price for a given account, or a new order. Because there is no rip and replace and no mass export, your data keeps living where it always has, under the controls you already trust.
Protected in transit and at rest
All traffic between OptiFlow and your systems runs over encrypted connections, so data cannot be read as it moves. Anything we do hold is encrypted at rest as well. We keep only what is needed to do the job and for a sensible period, rather than hoarding data with no purpose. The principle throughout is least data, least time, least access.
Access is controlled and logged
Access to your data is limited to the specific connections and permissions you agree, and every action OptiFlow takes can be traced. Orders, enquiries and changes are logged, so there is a clear record of what happened and when. Your team stay in control, with a person confirming the actions that matter rather than the system acting unchecked.
GDPR and UK data protection
OptiFlow is built and run with UK and EU data protection law in mind. We process personal data only for the agreed purpose, we support your obligations as the data controller, and we can put the terms of that in writing through a data processing agreement. If a customer exercises their rights, or you need to know what is held and why, we can help you answer clearly.
Built for the trade, run in the UK
OptiFlow is a UK company serving UK merchants and suppliers, and we host and run the service accordingly. You deal with people who understand the trade and the rules that apply here, not a distant platform with no line of sight to your business. If your own customers or auditors ask how their data is handled, we will give you straight answers you can pass on.
What this means for the Otis kiosk
The same principles carry through to Otis Depot, our in branch kiosk. Between customers the chat resets itself, so one shopper never sees another shopper’s session. Payment is handled through established, secure payment methods, and the kiosk works from your live stock and pricing rather than storing card details on the device. You can read more about how the flow works on the how Otis Depot works page.
Frequently asked questions
Do you take a copy of our whole database?
No. OptiFlow connects to your live systems and works with the data it needs for each task, such as a stock check or a new order. There is no mass export and no rip and replace.
Is our data encrypted?
Yes. Traffic between OptiFlow and your systems runs over encrypted connections, and anything we hold is encrypted at rest. We keep only what is needed and only for as long as it is needed.
Are you GDPR compliant?
OptiFlow is built and run with UK and EU data protection law in mind. We process personal data only for the agreed purpose, support your role as data controller, and can put the terms in writing through a data processing agreement.
Where is the service hosted?
OptiFlow is a UK company serving UK merchants and suppliers, and we host and run the service in line with UK data protection expectations.
Is the Otis kiosk safe for customers?
Yes. The kiosk resets its chat between customers so sessions are never shared, it works from your live stock and pricing, and payment is handled through established, secure payment methods rather than storing card details on the device.
Can you sign a data processing agreement?
Yes. We can put the terms of how we process data in writing so you and your auditors have a clear record.