Data Processing Agreement

When you put your customers' contact details, your email, and your invoices into Flowtiq, you are handling personal data about people who are not our customers. Under the GDPR that makes you the controller of that data and us your processor, and it requires the two of us to have a written agreement about how we handle it. This is that agreement.

It applies automatically to every workspace and forms part of the Terms of Service. You do not need to ask us for a copy or negotiate it before you can rely on it. Where this document and the Terms of Service disagree about personal data, this document wins.

It is entered into between you, the workspace owner, and [registered legal entity name] of [registered business address].

This agreement covers the personal data you bring into or generate inside your workspace about other people: your contacts and their details and notes, the deals and activity history attached to them, the email you sync and send, your invoices and the clients named on them, your meetings and their attendees, and any files you upload.

It does not cover data where we are the controller in our own right, because it is about our relationship with you rather than about your customers: your account and your colleagues' accounts, your billing records, our security audit trail, and our product analytics. How we handle those is described in the Privacy Policy, and you are not our processor for any of it.

The subject matter is the provision of the Flowtiq service. The nature and purpose of the processing is whatever is needed to run the features you use: storing and displaying your records, syncing and sending mail through your own connected mailbox, syncing your calendar, publishing your social posts, producing your invoices, and generating AI output when you ask for it.

Processing lasts as long as your workspace exists, and ends as described in section 10.

Data subjects are the people you choose to record: your customers and prospects, the people who email you, the clients you invoice, and the people who attend your meetings.

Categories of personal data are names, email addresses, telephone numbers, employer and job title, country, social profile addresses, the free-text notes you write about someone, the full content of email messages and their metadata, meeting titles and agendas, invoice amounts and payment history, and any personal data inside files you upload.

• We process your data only on your instructions. Your instructions are these documents plus the actions you and your colleagues take in the app. If we ever believe an instruction breaks data protection law we will tell you.
• We do not use your data for our own purposes, and we do not sell it, share it for advertising, or use it to train AI models.
• Everyone who can reach your data is bound by confidentiality, and access is limited to the people who need it to run and support the service.
• We keep the security measures in section 7, and we help you meet your own obligations under Articles 32 to 36 with the information we hold.

You give us general authorisation to use the subprocessors below. Each is bound by data protection terms no less protective than these.

Supabase

Postgres database, authentication, and file storage for the avatars, company logos and post images you upload. Provisioned for us through Lovable Cloud.

Cloudflare

Hosting and the edge network that serves the app and its server functions.

Lovable

The platform Flowtiq is built and hosted on. Four separate roles: the gateway that routes every AI request, the broker that handles Google sign-in, the gateway behind workspace-level connectors, and the sender of account email such as your sign-up confirmation, workspace invitations, magic links and password resets.

Google Gemini

Runs the models behind every AI feature, reached through the Lovable gateway rather than directly. We use the Gemini Flash family; which specific version powers a given feature can change.

Google (Gmail, Calendar)

Only if you connect a Google account. Mail and calendar data flows both ways, and outbound mail is sent from your own address.

LinkedIn

Only if you connect it, to publish posts on your behalf.

Meta (Facebook, Instagram)

Only if you connect it, to list your Pages, read their engagement figures, and publish posts.

OpenAI

Only if you paste in your own OpenAI key under workspace integrations. We use it to check the key is valid; no Flowtiq feature runs on it.

Paddle

From the date paid subscriptions open. Paddle will take payment as merchant of record and handle sales tax and VAT. It receives no data from us today, and we never receive card details.

We will give you at least 30 days' notice by email before adding or replacing a subprocessor that handles workspace data. If you object on reasonable data protection grounds within that period, and we cannot offer a workable alternative, you may terminate and we will refund any prepaid fees for the period you no longer receive.

Note that Google, LinkedIn and Meta appear here only where you have connected your own account. In those cases we act on your instruction to reach an account you control, and your own agreement with that platform continues to apply alongside this one.

The technical and organisational measures we take are described in full, and with their limits stated, on the Security page. In summary: tenant isolation enforced in the database rather than in application code, encryption of stored credentials with AES-256-GCM under a server-side key, HTTPS in transit, hashed passwords, privileged operations confined to server-side code, an append-only audit trail, and least-privilege scopes when connecting to a provider.

We review these measures as the product changes, and we will not weaken them during the life of this agreement.

If we become aware of a personal data breach affecting your data we will tell you without undue delay and in any event within 48 hours of becoming aware of it. We will tell you what we know, what we are doing about it, and what we recommend you do, and we will keep telling you as we learn more. We will not wait until we have a complete picture before making contact.

Notifying your own supervisory authority and the affected people is your responsibility as controller. We will give you what you need to do it.

If someone contacts us directly about data in your workspace, we will not answer for you. We will tell them to contact you, and tell you that they got in touch.

Most requests you can satisfy yourself inside the app, since you can read, correct, export and delete your own records. Where you cannot, email us and we will help within the time your own deadline allows.

For audits, we will answer reasonable written questions about our processing and provide the documentation we hold, once a year or after a breach. We are a small team and do not currently hold an independent security certification, so we do not offer on-site audits or complete third-party questionnaires beyond that. The Security page is deliberately specific so that most questionnaires can be answered from it.

You can delete your data at any time: individual records from the app, and the whole workspace from Settings, which removes the records and empties the files you uploaded.

When your subscription ends we keep the workspace for 30 days so you can come back or ask for a copy, then delete it. Say the word and we will delete it sooner. Two exceptions survive: records we are legally required to keep for tax and accounting, and our security audit trail, which holds who did what rather than your customers' data and ages out on its own 400-day schedule.

Ask us before deletion and we will provide your data in a structured, commonly used format. We do this by hand today rather than through a self-service export.

Our subprocessors are largely United States based, so your data is transferred outside the UK and EEA. Those transfers rely on the European Commission's standard contractual clauses, the UK international data transfer addendum where relevant, and equivalent safeguards in each subprocessor's own data protection terms. Where a subprocessor offers a choice of hosting region, the region we have chosen is stated in the Privacy Policy.

Anything about this agreement, including a request for a countersigned copy, goes to hello@flowtiq.ai.