Flowjoy ("we," "our," or "us") is committed to protecting your personal information. This Privacy Policy explains what data we collect, how we use it, and your rights relating to that data when you visit flowjoy.online or use our SaaS platform and agency services. If you have questions, email us at [email protected].
1. Who We Are
Flowjoy is a software agency and SaaS provider. For the purposes of data protection law, Flowjoy is the data controller responsible for your personal data collected through our website and services.
2. Data We Collect
We collect the following categories of data:
Account & Contact Information
Name, email address, company name, and any information you voluntarily submit via our contact form, intake forms, or at account creation.
Usage & Technical Data
IP address, browser type, operating system, pages visited, time on page, and other analytics data collected via cookies or similar technologies.
Communications
Emails, messages, or project briefs you send us as part of an agency engagement or support request.
Payment Information
We do not store payment card details ourselves. Payments are processed by a third-party provider (e.g. Stripe) and subject to their privacy policy.
Content You Upload
Any data, files, or content you upload to the Platform while using our SaaS features.
3. How We Use Your Data
We use your data to:
- Provide, operate, and maintain our Platform and Agency Services.
- Respond to enquiries, contact form submissions, and support requests.
- Process invoices and payments for services rendered.
- Send transactional emails (e.g. onboarding, invoices, project updates).
- Improve and personalise our website and Platform through aggregated analytics.
- Comply with legal obligations and enforce our Terms of Service.
We do not sell your personal data to third parties, use it for unsolicited advertising, or share it beyond what is necessary to deliver our services.
4. Legal Basis for Processing
We process your data under one or more of the following legal bases under UK/EU GDPR:
- Contract: Processing is necessary to perform a contract with you (e.g. delivering services you've paid for).
- Legitimate Interests: We have a legitimate interest in operating and improving our business, provided your rights are not overridden.
- Legal Obligation: We may need to process data to comply with applicable laws (e.g. tax records).
- Consent: Where we rely on your consent (e.g. marketing emails), you may withdraw it at any time.
5. Cookies
We use cookies and similar tracking technologies to understand how visitors interact with our website and to keep you logged in on the Platform. Types of cookies we use:
- Strictly necessary: Required for the Platform to function (e.g. session authentication).
- Analytics: Help us understand usage patterns so we can improve the product (e.g. page views, traffic sources).
You can control cookies via your browser settings at any time.
6. Third-Party Services
We use trusted third-party services to help operate our business. These providers act as data processors under our instruction and are contractually bound to protect your data:
- Stripe – Payment processing
- Google – Authentication and analytics
- Cal.com – Meeting scheduling
- Amazon Web Services / Vercel – Hosting and infrastructure
7. Data Retention
We retain personal data only as long as necessary for the purpose it was collected, or as required by law. Account data is retained for the duration of your subscription plus up to 2 years after termination. You may request deletion of your data at any time (see Section 8). Anonymised analytics data may be retained indefinitely.
8. Your Rights
Under UK/EU GDPR and similar laws, you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Request deletion of your personal data (right to erasure).
- Object to or restrict certain types of processing.
- Data portability — receive your data in a structured, machine-readable format.
- Withdraw consent where processing is based on consent.
- Lodge a complaint with a supervisory authority (in the UK: the ICO at ico.org.uk).
To exercise any right, email us at [email protected]. We will respond within 30 days.
9. Security
We implement appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. However, no internet transmission is 100% secure. We recommend keeping your account credentials confidential and notifying us promptly of any suspected breach.
10. Children's Privacy
Our services are not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, please contact us and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy periodically. We will post the revised policy on this page with an updated date and, where changes are material, notify you by email. Continued use of our services after the effective date constitutes acceptance of the updated policy.