CChamberflow
Privacy

Whose data it is, where it lives, and how to get it back.

Who is responsible for what, where data is stored, which providers process it, how long it is kept, and how to ask for a copy or deletion. Last updated 12 October 2026. VentureLK LLC, Delaware, United States, operates Chamberflow.

Two roles

Chamberflow is a platform chambers of commerce run their membership on. Whose data it is decides who answers for it.

  • A chamber’s members, applicants, event guests and subscribers: the chamber is the controller. It decides why the data is collected and how it is used. VentureLK LLC, which operates Chamberflow, is the processor and acts only on the chamber’s instructions under a written agreement. Each chamber publishes its privacy notice on its website at /privacy.
  • Visitors to this website and people who ask us for a demo: VentureLK LLC is the controller. We keep the name, organisation and email address you give us on the demo form so that we can reply, and nothing else about you.
  • Staff accounts on the platform: a name, an email address and a password stored as a bcrypt hash, plus an audit log of what each account did and when.
  • The audit log keeps a network address only for staff sign-ins, failed staff sign-ins, two-factor steps, the platform operator entering a chamber, agreements signed or declined electronically and refused requests. It keeps the browser only for agreements signed or declined electronically.
  • People a chamber asks to sign an agreement electronically: the signing record keeps their name, email address, signature, the time of each step, and the network address and browser they signed from. The network address is printed on the agreement’s certificate of completion.
  • People who apply to join a chamber: a one-way fingerprint of the network address the application was sent from is kept with it, only to stop abuse of the form.

Where the data is

The application and its database run on Amazon Web Services in Singapore. Card numbers never reach Chamberflow: they are entered on the payment provider’s own page.

  • Amazon Web Services: hosts the application and its database, in Singapore.
  • Mistral AI, France: the writing assistant chamber staff use to draft, processing in Europe. It sees only what a task needs, such as the record a message is about or text staff paste in for it to read, and it never sees passwords or card numbers.
  • Supporting service providers that deliver email and app notifications, take online payments when the chamber uses them, and keep the service backed up and running. Each receives only what it needs for its task.

How long it is kept

A chamber decides its own retention for its members’ records. These are the platform’s rules.

  • A chamber can download everything it holds, as one file, from Settings, any day, without asking us.
  • When a chamber stops using Chamberflow, its data is deleted on its written request, except for the financial records it must keep, which are exported to it first.
  • One-time sign-in codes expire within minutes and are stored only as hashes.
  • The database keeps a short point-in-time history for recovery from mistakes, and encrypted nightly backups are kept for 30 days.
  • Demo-form enquiries are kept while we are in contact and removed when you ask.

Security, in one paragraph

The detail is on the security page. The short version is what a board usually asks.

  • Everything travels over TLS. On a production deployment, payment-provider credentials are encrypted with AES-256-GCM when they are saved. Staff passwords are bcrypt hashes; members have no password and sign in with a one-time code sent to their email.
  • Every session of a chamber’s own staff is bound to that chamber. Sensitive actions, such as exporting data, changing a member record, managing staff logins, changing payment or sending settings and signing documents, are written to an audit log with a name against them.
  • Marketing email goes only to contacts who have consented, every message carries an unsubscribe link, and suppressions are honoured across campaigns.

This website

We measure this site without following you around the web.

  • Page views are counted without cookies. There is no Google Analytics, no advertising pixel and no third-party font.
  • The only cookies are the ones that keep a signed-in person signed in and one that remembers which chamber a host belongs to.

Your rights, and how to use them

For your own data held by a chamber, write to the chamber; its notice names the address. For anything VentureLK LLC holds as controller, write to us.

  • A copy of what we hold about you, correction of anything wrong, deletion of what we no longer need, and an end to any marketing.
  • Write to lawrence@chamberflow.ai. We act within ten working days and confirm in writing what we did.
  • A chamber’s members ask their chamber, which passes a request for its records on to us; we act on it within ten working days too.
  • If you are in the European Union you can also complain to your local data protection authority; in Taiwan, to the authority responsible for the Personal Data Protection Act.

The security detail is on the security page. The privacy policy for the Chamberflow member app is at /mobile/privacy.