Privacy Policy
Last updated: 10 October 2026
1. Our Commitment to Your Privacy
Nomad Flow ("we", "us", "our") is a specialist consultancy that helps accounting software companies grow through their accounting channel, and helps accounting firms adopt change. We are committed to protecting your privacy. This policy explains how we collect and use your personal and business data across our website (nomadflow.co.uk), our consulting services, and our online tools.
We are registered with the Information Commissioner's Office (ICO) in the United Kingdom. We process all personal data according to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. The Information We Collect
We collect and process the following data:
- Personal Identification Information: Name, email, phone number, and job title.
- Business Information: Data provided during our audits and reviews, including process maps, tech-stack details, and documentation of operational friction.
- Technical data: Pages visited, referring site, country, browser and device type, collected by Vercel Web Analytics. It sets no cookies and stores no IP address: visitors are counted from a one-way code that cannot be turned back into a person. See section 6.
- Calculator usage: We record that a calculator was opened and that a calculation was run, through the same analytics. We never store the figures you enter, not your revenue, customer numbers, churn rates or any result worked out from them.
3. Legal Basis for Processing
We process your data under the following legal bases:
- Contract: To deliver the services you have hired us for.
- Legitimate Interests: To conduct industry research into the "Activation Gap," improve our consulting frameworks, and engage in B2B networking.
- Legal Obligation: To meet tax or regulatory requirements.
4. How We Use Your Information
- Service delivery: Managing the work we do for accounting software companies, accounting firms, and video production clients.
- AI-Assisted Analysis: We use secure AI tools to transcribe and synthesise meeting notes during our audits and reviews. These tools are configured to ensure data is not used to train public models.
- Anonymised Benchmarking: We may aggregate data to create industry reports. No individual or firm will be identifiable in these reports.
5. Data Retention
We hold personal data for as long as necessary to provide our services. Typically, this is the duration of our engagement plus 6 years for legal and tax purposes. Raw video footage and meeting recordings from audits are retained for 12 months following project completion unless otherwise agreed in writing.
6. Cookies, website tools and who processes your data
We do not sell your data. This website sets no cookies for tracking or advertising, so it shows no cookie banner. It uses the following services. Each one sees only the data needed to do its job.
- Vercel (hosting, and Speed Insights, which measures page load times without cookies).
- Vercel Web Analytics (visitor statistics, cookieless; see section 2).
- Google Fonts and YouTube (typefaces and embedded video). Your browser requests these from Google's servers, which see your IP address.
- Cloudflare Turnstile (checks a form is sent by a person, not a script).
- Resend (sends our emails: newsletter confirmations, calculator results, replies to the contact form).
- Google Calendar (the booking pages our "Book a call" buttons open).
- Nomad Central (our own customer system) where enquiries, newsletter sign-ups and scorecard results are stored.
For client work we also use subcontractors (specialist editors or analysts) bound by confidentiality, and our CRM, accounting software and secure cloud storage. Some of these providers process data outside the UK (for example Google Workspace). We make sure those transfers comply with UK GDPR through standard contractual clauses or the UK Extension to the EU-US Data Privacy Framework.
7. Your Rights
Under UK law, you have the right to access, correct, or delete your personal data. You may also object to processing or request data portability. To exercise these rights, use the contact form on the Work with Leigh page.
8. Intellectual Property
This policy is limited to data privacy. Ownership of deliverables and our methodology is defined in your specific Statement of Work (SOW).
9. Contact Us
Leigh Stallard
Nomad Flow
Through the contact form on the Work with Leigh page
Appendix: Data Processing Addendum (DPA)
For SaaS Vendors and Accounting Firms
This Addendum applies when Nomad Flow ("the Processor") processes personal data on behalf of a Client ("the Controller") during the course of consulting engagements, specifically regarding audits, reviews and video production.
1. Scope of Processing
The Processor will handle data only to perform the services defined in the Statement of Work. This includes:
- Transcribing meeting recordings for audit analysis.
- Reviewing user onboarding journeys and CRM data snippets.
- Creating instructional or commercial video assets.
2. Use of Artificial Intelligence
The Processor uses AI tools (e.g., Google Gemini, Fathom, or Otter.ai) to assist in data synthesis. The Processor warrants that:
- All AI tools used are "Closed System" enterprise versions.
- Zero-Retention Policy: Data processed through these tools is not used by the provider to train foundational AI models.
- Input data is encrypted both in transit and at rest.
3. Sub-Processors
The Processor may engage third-party sub-processors (e.g., freelance video editors or junior analysts). All sub-processors are subject to written agreements providing the same level of data protection as set out in this Addendum.
4. Technical and Organisational Measures
The Processor maintains industry-standard security measures, including:
- Multi-Factor Authentication (MFA) on all business accounts.
- Encrypted cloud storage for all client deliverables.
- Regular deletion cycles for raw meeting footage.
5. Data Breach Notification
The Processor will notify the Client without undue delay (and within 48 hours) upon becoming aware of any personal data breach.
6. Termination
Upon termination of the services, the Processor will, at the Client's request, delete or return all personal data, except where retention is required by UK law.