Privacy policy

This policy explains which personal data we process when you visit flowsystems.no, contact us or sign up your company for Flow, and what Flow does with email from Google accounts connected to Flow.

Controller

FoxTech AS, org. no. 938 340 102, Kobbervikdalen 66, 3036 Drammen, Norway, is the controller for the data on this website. Contact us at post@flowsystems.no.

For the data a customer enters in Flow, the customer is the controller and FoxTech the processor. This is governed by the data processing agreement with each customer.

What we collect, and why

• The contact form: your name, company, email, phone and message. We use them to reply and follow up. The legal basis is our legitimate interest in answering enquiries, or steps prior to a contract (GDPR Article 6(1)(f) and (b)).
• Sign-up: the company’s name, org. number and address, the contact person’s name, email and phone, the preferred Flow address and payment method. We use them to enter into and perform the agreement, set up Flow and invoice (Article 6(1)(b)). Invoices and payments are kept under the Norwegian Bookkeeping Act (Article 6(1)(c)).
• Card payments: handled by Stripe. We never see your card number, only whether the payment went through.
• Brønnøysund Register lookups: when you search for your company on the sign-up page, your browser fetches the data directly from data.brreg.no. The register then sees your IP address.
• Abuse protection: to limit the number of submissions we keep a one-way hash of your IP address for up to 24 hours. We do not store the IP address itself. Our web host may log IP addresses for a short period for operations and security.

Cookies

We only use cookies that are necessary for the site to work: one that protects the forms against abuse (flowsid, deleted when you close the browser), and one that remembers the sign-in for people with access to the preview or administration. We use no analytics or marketing cookies, so we do not ask for consent.

Who we share data with

• Gigahost AS (Norway) hosts the website and the Flow servers.
• Stripe (Stripe Payments Europe Ltd., Ireland) processes card payments.
• Cloudflare stores encrypted backups of Flow in the EU.

Enquiries and sign-ups are also stored in our own customer system, which is Flow. We never sell personal data.

Google accounts in Flow

When a customer connects a Google account (Gmail) to Flow, the user gives Flow access to the email in that account. Flow reads, stores and sends email only for the features the user uses in Flow: to show the email in Flow, link it to the right customer and send email on the user’s behalf.

• The customer is the controller for the email, and FoxTech is the processor under the data processing agreement with the customer.
• The email is stored in Flow with the providers listed above.
• We do not sell the data, use it for advertising or use it to train AI models.
• No one at FoxTech reads the email unless the customer has given us access to get help, it is needed to fix a security issue or stop abuse, or the law requires it.
• The user can disconnect the Google account from Flow at any time, or remove Flow’s access in their Google account at myaccount.google.com/permissions. The user can also ask us to delete the email Flow has fetched by writing to post@flowsystems.no.

Flow’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How long we keep data

We keep enquiries as long as we need them for follow-up, and no longer than two years after the last contact if no customer relationship follows. Customer data is kept for as long as the agreement lasts. Accounting records are kept for five years under the Bookkeeping Act.

Your rights

You can ask for access to, correction of and deletion of your data, ask us to restrict processing, object to it and receive your data. Write to post@flowsystems.no. If you believe we process your data unlawfully, you can complain to the Norwegian Data Protection Authority (Datatilsynet).

Changes

If we change this policy, we publish the new version here.