Flowtly – Privacy Policy

Current version Effective from .

1. General provisions

This Privacy Policy explains how Flowtly Prosta Spółka Akcyjna (“Flowtly”, “we”, “our”, “us”) collects, processes, and protects personal data, as well as what rights users have in relation to their data.

The Policy complies with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, “GDPR”) and other applicable data protection laws. This Policy applies to all users of the Flowtly Platform and to individuals whose personal data are processed in connection with its operation.

2. Data controller

The data controller is Flowtly Prosta Spółka Akcyjna (Flowtly PSA), with its registered office at ul. Młynarska 8/12, 01-194 Warsaw, Poland, entered in the Register of Entrepreneurs under KRS 0001188143, NIP 5273180297, REGON 542625051, with a share capital of PLN 15,800.

You can contact us:

3. Categories of data processed

We process the following categories of personal data:

  • Registration and subscription data: name, surname, e-mail address, password, organization name, position, billing data (address, tax ID), and the scope of the selected subscription plan.
  • Employment and HR data: names, PESEL or national identification numbers, e-mail addresses, employment data, remuneration, working time, qualifications, and leave records.
  • Contractor and invoicing data: business name, address, tax ID, payment terms, bank account numbers, invoice identifiers, and tax information.
  • Sensitive data: only when voluntarily provided and necessary for the performance of the contract (e.g. health information in the context of sick leave, trade union membership for contribution purposes, or demographic data for equality reporting).
  • Technical data and integrations: data obtained via Kontomatik (bank account history) used for reconciliation and reporting, error logs from Sentry (Functional Software Inc.), server logs, IP addresses, and cookies.
  • Publicly available data: data from KRS, REGON, CEIDG, and other public registers used for verifying contractors.
  • Other data provided by users: profile photos, avatars, uploaded files (e.g. invoices or payment confirmations), and content of correspondence with our support team.

Flowtly processes data for the following purposes:

  • Provision of services and account management: registering organizations, managing permissions, tracking working time, leave management, invoicing, project budgeting, and reporting.
  • Contract performance: issuing invoices, collecting subscription fees, providing technical support, and ensuring service availability.
  • Communication with users: responding to inquiries, providing updates, and notifying of service changes.
  • Legal obligations: accounting, tax settlements, and document archiving.
  • Legitimate interests of Flowtly: ensuring security, preventing fraud, improving services, and pursuing or defending legal claims.
  • Advertising measurement: measuring which of our advertising campaigns bring visitors to our website who start the demo or contact our sales team, only with your consent (see section 11).

Personal data are not processed for any purposes other than those listed above without prior notification and, where required, the user’s consent.

5. Automated processing and profiling

Except for the automated screening of new organizations described below, Flowtly does not make decisions producing legal effects on users or significantly affecting them based solely on automated data processing or profiling.

Some algorithms may support internal features such as workload analysis, resource allocation, or budget prediction, but the final decisions are always made by authorized persons. We may use aggregated, anonymized data for analytical and statistical purposes to improve our services.

Automated screening of new organizations. When you sign up for a trial or create a new organization, an automated check screens the signup to prevent fraudulent and abusive organizations, such as placeholder or test accounts, organizations impersonating well-known institutions, and signups with disposable e-mail addresses. The check uses the organization name you enter, your e-mail address, the country and language of the signup, your IP address, and whether a signup with the same organization name, e-mail address or IP address was refused shortly before. Part of the check is performed by an AI model provided by Anthropic PBC (see section 6). If the check concludes that the signup is likely fraudulent or abusive, the organization is not created and the signup is refused. This decision is made by automated means, without review by a person. If the check is temporarily unavailable, the signup cannot be completed at that moment and can be retried later.

This screening is necessary for entering into the contract with you, because it allows us to create your organization safely (Article 22(2)(a) GDPR). If your signup was refused, you have the right to obtain a review of the decision by a person, to express your point of view and to contest the decision, by writing to business.support@flowtly.eu.

6. Data recipients

Personal data may be disclosed to:

  • Flowtly employees and authorized collaborators, bound by confidentiality obligations,
  • Google Cloud (hosting and infrastructure, including databases, file storage, and Firebase services),
  • Anthropic PBC (AI features — the content of documents submitted for analysis, such as invoices and contracts, and text entered in features that use AI, such as work descriptions; and signup screening data, namely the organization name, e-mail address, country and language of the signup, and IP address, used to screen new organizations for fraud and abuse as described in section 5),
  • Stripe (payment processing),
  • Kontomatik (bank account data integration),
  • Functional Software Inc. (Sentry) for monitoring system errors,
  • Postmark (ActiveCampaign, Inc.), our transactional e-mail service provider, for sending transactional e-mails from the Flowtly application, which contain names, e-mail addresses and invoice data,
  • external accountants, lawyers, and IT service providers, to the extent necessary to perform services, and
  • public authorities, when required by law.

All third-party providers process data under written data processing agreements and according to Flowtly’s instructions. We do not sell personal data. We may publish only aggregated, anonymized statistics.

Partner privacy policies:

7. Transfer of data outside the EEA

Flowtly’s servers are located within the European Economic Area. In some cases, data may be transferred to service providers outside the EEA (e.g. the United States, in the case of Stripe, Sentry or Postmark), and to Anthropic, which processes the content sent to our AI features. In such situations, we ensure appropriate safeguards are applied, such as Standard Contractual Clauses or adequacy decisions under GDPR.

8. Data retention periods

We store personal data only for as long as necessary to fulfill the purposes for which they were collected, including legal or contractual obligations. After this period, data are deleted or anonymized unless further retention is required by law or to protect Flowtly’s legitimate interests.

9. User rights

Users have the following rights under the GDPR:

  • Access to their personal data.
  • Rectification of inaccurate data.
  • Erasure of data (“right to be forgotten”).
  • Restriction of processing.
  • Data portability to another controller.
  • Objection to processing based on legitimate interest.
  • Withdrawal of consent (where processing is based on consent).
  • Lodging a complaint with the President of the Personal Data Protection Office (UODO).

To exercise any of these rights, please contact us at business.support@flowtly.eu or in writing at the address of our registered office.

10. Data security

We apply organizational and technical measures to protect data against unauthorized access, loss, alteration, or disclosure. We use encrypted connections (HTTPS), regular backups, access control mechanisms, and up-to-date security procedures. Only authorized employees or contractors have access to data, within the scope necessary to perform their duties.

11. Cookies and our website

The Platform uses essential cookies necessary for proper functioning. Analytical cookies are set only if the user agrees via the cookie bar; they help us understand behaviour and improve our services. The Platform does not use cookies for marketing or advertising purposes. Users can manage their choices in the cookie bar at any time or block cookies in their browser; disabling certain cookies may limit some functionalities of the Platform.

Our website. Our website (flowtly.eu and our country domains, such as flowtly.pl, flowtly.de and flowtly.fr) does not place cookies or use similar storage on your device for analytics or spam protection. It places cookies for advertising measurement, and loads the scripts that set them from Google and Meta, only if you accept them in the cookie banner, and it loads a YouTube video only when you press play, as described below. Apart from that, it does not load scripts or fonts from third parties such as Google.

Website analytics (Umami). We measure how the website is used with Umami, an open-source analytics tool that we run ourselves at stats.flowtly.eu, on our Google Cloud infrastructure in the European Union. Umami does not use cookies and stores nothing on your device. It records the address of the page you visit, the page that referred you, your browser, operating system, device type, screen size and language, your approximate location (country, region and city) derived from your IP address, and clicks on some buttons, such as those leading to the contact form. To count visits without cookies, Umami derives a pseudonymous identifier from your IP address and browser details combined with a value that changes every month; your IP address itself is not stored. We use this data only to understand which pages are useful and to improve the website, on the basis of our legitimate interest (Article 6(1)(f) GDPR), and we do not share it with third parties for their own purposes.

Spam protection on our forms. The contact sales form and the startup programme form are protected by our own check instead of a third-party captcha. The form contains a field that is hidden from people and that automated programs tend to fill in, the form reports how long it was open before it was sent, and our server counts how many forms were sent from each IP address within a 10-minute period, and how many it receives in total, to stop repeated sending. For this check the IP address is kept only in the server’s working memory and is not saved anywhere by the check: it stops counting after 10 minutes and is deleted the next time the server processes a form after that, or when the server shuts down. Like every request to our servers, the form request is also recorded in our hosting provider’s server logs (see section 3). The hidden field and the time are used only to accept or reject the submission and are not stored. Nothing is stored on your device. The legal basis is our legitimate interest in protecting the forms from abuse (Article 6(1)(f) GDPR).

Advertising measurement (Google Ads and Meta Pixel). With your consent, we load Google Ads conversion tracking (the Google tag), provided by Google Ireland Limited, and the Meta Pixel, provided by Meta Platforms Ireland Limited, so that we can measure which of our advertising campaigns bring visitors who start the demo or send a request through the contact sales form. We use them for advertising measurement only: not for remarketing, not to build audiences and not to show you personalised ads. Once the tags are loaded, your browser sends Google and Meta your IP address, information about your browser and device, the address of the page you are visiting, the identifiers stored in their cookies and, if you arrived through one of our ads, the identifier of that ad click. When you start the demo or your contact sales request is accepted, the tags report only that this happened: no form content, name or e-mail address is sent to Google or Meta. In Google Consent Mode, ad personalisation and the use of your data for advertising (ad_personalization and ad_user_data) stay denied even after you accept, and Google signals are switched off. For the Meta Pixel, automatic configuration and advanced matching are switched off, and we do not create custom audiences from visitors to our website. Meta’s measurement of conversions on users’ devices is switched on and is used only for the same measurement. We and Meta Platforms Ireland Limited are joint controllers for collecting this data on our website and transmitting it to Meta (Article 26 GDPR). Google and Meta process the data they receive under their own responsibility, as described in the Google Privacy Policy and the Meta Privacy Policy, and may transfer it to Google LLC and Meta Platforms, Inc. in the United States; these transfers rely on the EU–US Data Privacy Framework, under which both companies are certified, and on Standard Contractual Clauses. The tags set these cookies on our domain: _gcl_au, and _gcl_aw after a click on a Google ad, for up to 90 days; _fbp, and _fbc after a click on a Meta ad, for up to 90 days. The legal basis is your consent (Article 6(1)(a) GDPR, together with the national provisions implementing Article 5(3) of Directive 2002/58/EC on storing information on your device).

Your consent and how to withdraw it. A cookie banner on every page of flowtly.eu and our country domains asks for your choice, with an “Accept” and a “Decline” button of the same size. Until you accept, the advertising measurement tags are not loaded and nothing is sent to Google or Meta; in Google Consent Mode, every type of consent starts as denied. If you decline, nothing is loaded. You can change your choice or withdraw your consent at any time with the “Cookie settings” button in the footer of every page. When you withdraw it, the tags stop sending data, the cookies listed above are deleted from our domain and no later page loads the tags; cookies that Google or Meta have set on their own domains can be deleted in your browser. Your choice is kept in your browser’s local storage under the name flowtly-marketing-consent so that we can respect it, and only once you have chosen. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

YouTube videos. Our tutorial pages can show YouTube videos in YouTube’s privacy-enhanced mode (youtube-nocookie.com). Nothing is loaded from YouTube until you press play on a video. When you press play, the video loads from YouTube, a service of Google Ireland Limited, which receives your IP address, information about your browser and device and the address of the page, and may store information on your device. YouTube processes this data under its own responsibility, as described in the Google Privacy Policy, and may transfer it to Google LLC in the United States under the EU–US Data Privacy Framework. The legal basis is your consent, which you give by pressing play (Article 6(1)(a) GDPR).

12. Final provisions

This Privacy Policy is an integral part of the Flowtly Terms and Conditions. It may be updated periodically; users will be informed of material changes in advance. In the event of discrepancies between language versions, the Polish version shall prevail. This Policy is effective as of 29 October 2026.