Skip to main content

Privacy policy

Last updated: 15 March 2026

This privacy policy describes how Flowayz (hereafter "we", "our" or "Flowayz") collects, uses and protects your personal data in accordance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and the French Data Protection Act.

1. Data controller

The controller of your personal data is:

2. Data collected

2.1 Account data

When you sign up and use your account:

  • First name, last name, email address
  • Password (stored in encrypted form)
  • Company name, industry
  • Profile picture (optional)
  • Theme and language preferences

2.2 Project data

As part of your use of our services:

  • Briefs and requirements documents
  • Generated technical specifications
  • Quotes, invoices and contracts
  • Uploaded files and documents
  • Messages and comments exchanged through the client portal

2.3 Billing data

  • Payment information (processed by our provider Mollie; we do not store your card numbers)
  • Billing address
  • Transaction history
  • Intra-community VAT number (where applicable)

2.4 Browsing data

  • IP address
  • Browser type and operating system
  • Pages viewed and time spent
  • Cookies (see our Cookie policy)

3. Legal bases for processing

Purpose Legal basis
Providing the service (account, projects, billing) Performance of the contract (Art. 6.1.b GDPR)
Improving the service and usage statistics Legitimate interest (Art. 6.1.f GDPR)
Analytics cookies (Google Analytics, Microsoft Clarity) Consent (Art. 6.1.a GDPR)
Sending marketing communications Consent (Art. 6.1.a GDPR)
Legal and tax obligations Legal obligation (Art. 6.1.c GDPR)
Security and fraud prevention Legitimate interest (Art. 6.1.f GDPR)

4. Retention periods

Type of data Retention period
Account data Duration of registration + 3 years after account deletion
Project data Duration of registration + 1 year after deletion
Billing data 10 years (statutory accounting obligation)
Browsing data / logs 13 months maximum
Analytics cookies 13 months maximum (in line with CNIL recommendations)

5. Your rights

Under the GDPR, you have the following rights over your personal data:

  • Right of access: obtain a copy of your personal data
  • Right to rectification: correct inaccurate or incomplete data
  • Right to erasure: request deletion of your data (subject to legal obligations)
  • Right to portability: receive your data in a structured, machine-readable format
  • Right to object: object to the processing of your data on legitimate grounds
  • Right to restriction: request that processing be restricted in certain circumstances
  • Right to withdraw consent: withdraw your consent at any time (without affecting the lawfulness of processing carried out beforehand)

To exercise these rights, contact us at dpo@flowayz.com. We will reply within 30 days.

6. Processors and recipients

Your data may be shared with the following processors, strictly as part of providing our services:

Processor Purpose Location
Google (GA4) Audience analytics and statistics (with consent) USA (standard contractual clauses)
Microsoft (Clarity) Behavioural analytics, heatmaps (with consent) USA (standard contractual clauses)
Mollie B.V. Payment processing (subscriptions, SEPA/card mandates) Netherlands (EU)
SendGrid (Twilio Inc.) Sending transactional and notification emails (confirmation, reset, onboarding) USA (Data Privacy Framework + standard contractual clauses)
Resend Sending marketing emails and the newsletter (double opt-in only) USA (standard contractual clauses)
Sentry (Functional Software Inc.) Error tracking and application monitoring (pseudonymised, PII filtered out) USA (standard contractual clauses)
Umami Cookieless audience analytics (self-hosted) EU (self-hosted on our servers)
Contabo GmbH Hosting of the application and the database Germany (EU)
Cloudflare Inc. User file storage (Cloudflare R2), CDN, DDoS protection, Turnstile anti-bot widget on sign-up EU jurisdiction configured for EU data (standard contractual clauses)
Deepseek AI content generation (primary AI provider). Prompts may contain data relating to the controller's own clients (names, project briefs). Minimisation is being rolled out. China (standard contractual clauses + documented TIA)
Anthropic PBC (Claude) AI content generation (fallback AI provider). No-training clause enabled — your prompts are not used to train the models. USA (Data Privacy Framework + standard contractual clauses)
Google LLC Google Analytics 4 (with consent only), Google Calendar (on explicit connection by the user) USA (Data Privacy Framework + standard contractual clauses)

7. Transfers outside the European Union

Some of our processors are located outside the European Union (United States, China). These transfers are governed by:

  • Standard contractual clauses (SCC) approved by the European Commission
  • The EU-US Data Privacy Framework where applicable
  • Additional technical measures (encryption, pseudonymisation) where necessary

8. Cookies

Flowayz uses cookies to run the site, measure audience and improve the user experience. For details on the cookies used and how to manage your preferences, see our dedicated Cookie policy.

9. Data security

We implement appropriate technical and organisational measures to protect your data:

  • Encryption of data in transit (TLS/HTTPS)
  • Password hashing (bcrypt)
  • Restricted access to data (principle of least privilege)
  • Regular, encrypted backups
  • Security monitoring and alerting (Sentry)
  • Regular updates of dependencies and of the framework

10. Complaint to the CNIL

If you consider that the processing of your personal data breaches the GDPR, you have the right to lodge a complaint with the French data protection authority (Commission Nationale de l'Informatique et des Libertés — CNIL):

  • Website: www.cnil.fr
  • Address: CNIL - 3 Place de Fontenoy - TSA 80715 - 75334 Paris Cedex 07, France
  • Phone: +33 1 53 73 22 22

11. Contact

For any question about this privacy policy or the protection of your data:

12. Changes to this policy

We reserve the right to amend this privacy policy at any time. In the event of a substantial change, we will inform you by email or through a notification in the application. The date of the last update is shown at the top of this page.