Legal

Privacy Policy

Last updated: October 30, 2026

1. Who we are

FlowSentric is operated from Germany. Contact: hello[at]flowsentric.com. We are the data controller for your personal data under the EU General Data Protection Regulation (GDPR).

2. Data we collect

Account data: Name, email, password hash, profession (optional).
Usage data: Conversations, agent configs, workflows, uploaded files — all stored encrypted and tenant-isolated.
Technical data: IP address (hashed for sessions), browser user-agent, timestamps.
Payment data: Processed by Stripe. We never store full card numbers.
Visitors of our customers' chat widgets: When you chat with an assistant a FlowSentric customer has placed on their website or in their app, that customer is the controller and we process the chat only on their behalf, as their processor (GDPR Art. 28). This covers your messages, details you enter (such as your name or e-mail address), files you send, and technical data (your IP address — kept with the conversation only as a keyed, irreversible value — and your browser type). When the customer has masking switched on (the default), names, e-mail addresses, phone numbers and similar details are replaced by placeholders before a message is sent to an AI provider. The privacy policy of the website you are chatting on applies; to exercise your rights, contact that business — we help them answer.
Contact & enquiry data: If you use our contact form, we process the name, email, company and message you submit (plus your IP address and browser, for spam protection) to respond to your enquiry. Legal basis: steps taken at your request prior to a contract and our legitimate interest in answering enquiries (GDPR Art. 6(1)(b) and (f)).

3. How we use your data

To provide and improve the FlowSentric platform.
To enforce plan limits, billing and security.
To communicate service updates (you can opt out).
We never sell your data or use it to train AI models.

4. AI model providers

When you use a third-party model (OpenAI, Anthropic, Google, etc.), your prompt is sent to that provider's API. Our PII masking layer removes sensitive data before it leaves FlowSentric. Each provider's own privacy policy applies to data they receive. You can pin requests to EU or US regions.

5. Data retention

Account data: retained while your account is active + 30 days after deletion request.
Conversations & files: retained per your plan's history settings; deletable at any time.
AI Sessions (Party): deleted automatically 30 days after the session ends, together with its messages, participants and notes. A session you delete yourself is erased within 24 hours.
Files visitors attach in an embedded chat widget: deleted automatically after the period the widget's owner sets — 90 days unless they choose otherwise, never more than 365 days.
Conversations in a customer's chat widget, with the details entered in them: kept for the period the customer sets — deleted automatically 30 days to 2 years after the last message (one year unless they choose otherwise), or kept until the customer deletes them if they choose so. The customer can delete them at any time.
Logs & audit trail: retained per plan tier (7–365 days).

6. Your rights (GDPR Art. 15–22)

You have the right to access, rectify, erase, restrict processing, data portability and object to processing. To exercise any right, email hello[at]flowsentric.com. We respond within 30 days. You also have the right to lodge a complaint with your local data-protection supervisory authority (GDPR Art. 77).

7. Security

Data is encrypted in transit (TLS) and stored on encrypted EU infrastructure. Application secrets and integration tokens are encrypted at rest with rotating keys. Access is role-based with strict tenant isolation. We conduct regular security audits.

8. Cookies

This marketing website sets no cookies. It keeps three small entries in your browser's local storage: your answer to the privacy notice, the chat widget's entries described below, and nothing else. To see which pages help, it uses Umami, a cookieless analytics tool we host ourselves: it counts page views, referring sites, browser type, country and clicks on the main buttons, stores nothing on your device and keeps no IP address or profile. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in improving the site). You can object at any time with “Reject” in the privacy notice, or with your browser's Do Not Track or Global Privacy Control setting; Umami then does not load. The application (app.flowsentric.com) uses a session cookie for authentication only.

The chat widget our customers embed keeps a few entries in your browser's local storage so the chat works: a random value that ties the chat to your browser, the open chat (until it ends), and — where the website lets you continue an earlier chat — a random key that brings it back for at most 30 days ("New chat" deletes it). They are strictly necessary for the chat you asked for (§ 25 (2) no. 2 TDDDG) and are never used for tracking or advertising.

9. Third-party processors

Stripe — payment processing (PCI-DSS compliant).
Microsoft 365 — transactional & contact-enquiry email delivery.
AI providers — as selected by you (OpenAI, Anthropic, Google, etc.). Where a provider processes data outside the EU/EEA, transfers rely on adequacy decisions or EU Standard Contractual Clauses; you can pin requests to EU regions.
Infrastructure — EU-based hosting.

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email or in-app notification at least 14 days before they take effect.

11. Contact

For privacy questions or to exercise your GDPR rights:
hello[at]flowsentric.com