Your data,handled with care.

1. Who we are

Operator identity pending registration. Flowstarter is run by two people, Darius and Dorin, and is not yet incorporated, so there is no registered company name, registration number, VAT number or registered address to give you. All four are published here as soon as there are any. Until then the two of us are the controller, and the contact page reaches us.

We act as the data controller for this marketing site and as the data processor for the client sites and dashboards we build and host on your behalf. Data-protection questions go through the contact page.

2. What data we collect

We collect the smallest amount of data that lets us deliver the service safely.

• Account data: name, email, and (for paying clients) billing address and VAT number. Collected at sign-up and during invoicing.
• Intake answers: what you tell us about your business, and the public profiles you point us at, when you ask for a preview. This is the text your site is written from, and it is sent to the language-model gateway listed below.
• Uploaded content: copy, images, logos, and brand assets you (or your team) upload to your project.
• Cookies: a small number of cookies for sign-in, your theme and the country we infer. The full list is on the cookie page.

3. How we use your data

• Service delivery: building your site, hosting it, providing the smart editor, and answering support.
• Billing: generating invoices, processing payments and refunds, and meeting our tax obligations.
• Transactional email: confirmations, project updates, security alerts, and renewal notices.
• Security: deciding whether a request to this site is a person, a crawler or an attack.
• Marketing email: only with your explicit opt-in consent, and only to subscribers who actively chose to receive it.

4. Legal basis (GDPR Article 6)

• Contract performance: for everything we do to deliver and support your project.
• Legitimate interest: for security monitoring and fraud prevention.
• Legal obligation: for tax and accounting records.
• Consent: for marketing email and any optional cookie.

5. Analytics

We run no analytics at all. No Google Analytics, no Facebook Pixel, no cross-site advertising tracker, and no privacy-friendly alternative either. Nothing on this site counts your visit.

6. Subprocessors we share data with

Every third party that processes data on our behalf is below. We update this page before adding a new one.

7. Data-processing agreements

Each vendor below publishes the data-processing terms it offers, and the link in its row goes to them. We accept those terms as part of using the service. We do not claim a separately negotiated and counter-signed agreement with every one of them, because that is not what most of them offer. If you need a data-processing agreement from us for your own records, ask on the contact page and we will send one.

8. International transfers

Production hosting lives in the European Union: the servers in Germany and Finland, the database in the EU, and the booking software on our own machines. 7 of the vendors above are headquartered in the United States (Clerk, Cloudflare, Resend, Arcjet, OpenRouter, GitHub, Depot). Each of those transfers is covered by the European Commission's Standard Contractual Clauses, and where applicable, by the EU–US Data Privacy Framework.

9. How long we keep things

Two things are deleted on a timer by a job that runs against our own database.

• The preview site we generate during the intake, and any picture you upload while answering: deleted 14 days after it is made, by the preview reaper.
• The upload session behind the intake, when the preview it belonged to was never finished: deleted 24 hours after it is made, by the same job.

Everything else we hold for as long as it is useful to your project, and delete when you ask. We would rather tell you that than print a number nothing in the product counts.

• Your account and the people on your team: We hold it while the account exists, and delete it when you close the account or ask us to.
• Your project, its brief, and the files you uploaded to it: We hold it so we can keep building and supporting your site, and delete it when you ask.
• Invoices and payment records: Tax law requires us to keep these even after you ask us to delete everything else, so these are the one thing an erasure request does not reach.
• Support messages and anything you sent through the contact form: We hold these while they are useful, and delete them on request.

10. Your rights under GDPR

You have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: correct any inaccurate or incomplete data.
• Erasure: ask us to delete your data, subject to the tax-record obligation above.
• Portability: receive your data in a machine-readable format.
• Objection: object to processing based on legitimate interest.
• Restriction: limit how we process your data while a query is being resolved.
• Complaint: lodge a complaint with your national data-protection authority.

To exercise any of these rights, send the request through the contact page. We check that the request is really yours and answer within 30 days, which is the limit the GDPR sets. If the answer is going to take the whole window, we say so before it runs out rather than at the end of it.

11. Children

Flowstarter is not intended for anyone under the age of 16. We do not knowingly collect data from children. If you believe a child has submitted data to us, tell us on the contact page and we will delete it.

12. Changes to this policy

We update this page whenever our practices change. Material changes are announced by email to active clients at least 14 days before they take effect. The “last updated” date at the top of this page always reflects the latest revision.