Privacy Policy

This Privacy Policy explains how Flowstart Kft. processes personal data in connection with the digitalemployees.eu service. It is written to meet the requirements of the EU General Data Protection Regulation (GDPR).

1. Controller

The data controller for the account and website data described here is Flowstart Kft.For the content you and your users put into the service, you are the controller and we act as your processor — see our Data Processing Agreement. You can reach us at info@flowstart.eu.

2. What data we process

• Account data: name, work email, organization name, authentication identifiers, and role.
• Organization content:the material you use the service on — chat conversations, uploaded documents and files, and the data the digital employee reads from the systems you connect (for example Microsoft 365 email and calendar). You control this content.
• Usage and billing metadata: logs of actions and approvals (audit events), token and usage counters, tier and subscription status, and technical metadata such as timestamps. Payment card details are handled by our payments provider, not by us.

3. Purposes and legal bases

• Providing the service (Art. 6(1)(b) — contract): creating and running your account, operating the digital employee, and processing organization content on your instructions.
• Security, audit, and service improvement (Art. 6(1)(f) — legitimate interests): keeping audit logs, enforcing usage limits and tenant isolation, preventing abuse, and understanding aggregate product usage. We balance these interests against your rights.
• Billing (Art. 6(1)(b) / (c)): processing subscriptions and meeting our accounting and tax obligations.
• Consent (Art. 6(1)(a)): where we ask for it specifically, for example certain optional communications. You can withdraw consent at any time.

4. How the AI processing works

When the digital employee reasons over your content, that content is sent to Microsoft Azure OpenAI for inference. This processing takes place in the EU, and your content is not used to train Microsoft’s or OpenAI’s models. As part of Azure OpenAI’s standard abuse-monitoring, a sample flagged by automated systems may be transiently retained for up to 30 days, stored in the EU and, if reviewed, reviewed by reviewers located in the EEA. We do not make a blanket “zero-retention” claim.

5. Sub-processors

We use the following sub-processors to run the service. All customer-content processing takes place within the EU.

We keep this list current. If we add or replace a sub-processor we will update this page, and for customers under a signed DPA we will provide notice as set out there so you can object.

6. EU processing

We host and process organization content within the European Union (Azure Sweden Central), consistent with the EU Data Boundary framing. Where a sub-processor could involve any transfer outside the EU/EEA, it is covered by appropriate safeguards such as Standard Contractual Clauses.

7. Retention

We retain account data and organization content for the life of your accountso the service works across sessions. When you ask us to delete your data, or after your account is closed, we delete or anonymize it, subject to short backup-rotation periods and any records we must keep for legal, tax, or security reasons (such as invoices and certain audit logs).

8. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, and port your personal data, and to object to processing based on legitimate interests. To exercise these rights — including data export or deletion — email info@flowstart.eu. We handle these requests as a manual process and respond within 30 days. (This email process is the current way to request export or deletion; it replaces self-service buttons in the app.)

9. Cookies and analytics

We use cookieless product analytics (PostHog EU) and set no advertising or tracking cookies. Because we do not use non-essential cookies, we do not show a cookie-consent banner. We use only the strictly necessary cookies needed to keep you signed in and to operate the service.

10. Complaints

If you believe we have not handled your personal data lawfully, you can lodge a complaint with the Hungarian supervisory authority, the National Authority for Data Protection and Freedom of Information (NAIH), or with the supervisory authority in your EU country of residence or work.

11. Changes

We may update this Policy as the service evolves. Material changes will be notified in advance by email or in-product notice. The “Last updated” date above reflects the current version.

12. Contact

Privacy questions and rights requests: info@flowstart.eu.