flowhelp Privacy Policy

Version 1.11 of 11 November 2026. Effective from 11 November 2026.

This is a translation of the Polish "Polityka prywatności flowhelp". The Polish version is binding; in case of any discrepancy, the Polish version prevails.

This policy explains what personal data we process in connection with the flowhelp service, for what purposes, on what legal basis, to whom we entrust it, how long we keep it and what rights you have. We have tried to write it plainly. If anything is unclear, write to us (contact details are in § 2).

§ 1. Definitions

1.1. Controller, we, us: DOLLABROS sp. z o.o., registered office in Poznań, Poland (details in § 2).

1.2. flowhelp or the Service: our AI assistant (chat) service for businesses, available through the website https://flowhelp.ai, the panel https://app.flowhelp.ai and the widget file server https://cdn.flowhelp.ai. The website https://flowhelp.ai is also referred to as the Website.

1.3. Customer: a business that has entered into an agreement with us to use the Service (including during the trial period).

1.4. Panel User: a person with an account in the panel (owner, administrator, editor or a person with view-only access in a Customer's workspace).

1.5. Workspace: a Customer's separate working area in the panel, with its knowledge, settings, conversations and team.

1.6. Widget: the chat window that a Customer embeds on its website with a single <script> tag.

1.7. Assistant: the AI language model that answers in the Widget on the basis of the materials indicated by the Customer.

1.8. Flow: our own Assistant on the flowhelp.ai website, which answers questions about flowhelp.

1.9. Visitor: a person using a website on which the Widget runs (a Customer's website or flowhelp.ai).

1.10. Lead: data that a Visitor submits through the contact form or a request to talk to a human in the chat window.

1.11. GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation).

1.12. Data Processing Agreement or DPA: the agreement on the processing of personal data (Article 28 GDPR) that forms part of the flowhelp Terms of Service.

1.13. EEA: the European Economic Area (the Member States of the European Union and Iceland, Liechtenstein and Norway).

1.14. Inbox: a panel feature in which the Customer receives e-mails sent to the assistant's address in our domain, usually forwarded from its own mailbox, and replies to them.

§ 2. Controller and contact

2.1. The controller of the personal data described in § 4-6, section 7.5 and § 8 is:

2.2. You can contact us about any matter concerning personal data:

1. by e-mail: hello@flowhelp.ai,
2. by post: at the registered office address above,
3. through the contact form in the chat window on https://flowhelp.ai.

2.3. We have not appointed a data protection officer (DPO), because the law does not require one in our case (Article 37 GDPR). Personal data matters are handled directly by the company's management board at the addresses in section 2.2.

§ 3. Who this policy applies to

3.1. This policy applies to five groups of people. In the first three we are the controller, which means we decide on the purposes and means of processing ourselves. In the fourth we generally act on behalf of the Customer as a processor; the exception is server logs and limit counters used for the security of the Service, for which we are the controller (section 7.5). In the fifth we act on behalf of the Customer as a processor.

3.2. Rules common to all groups (recipients, transfers outside the EEA, retention periods, rights, AI, cookies, security) are described in § 9-18.

§ 4. Customers and Panel Users

4.1. What data we process:

1. account data: e-mail address, first name (optional; if you do not provide it, we use the part of your e-mail address before the @ sign), password in the form of a cryptographic hash (we do not know your password), selected language and interface settings, information on whether the e-mail address has been confirmed, dates of creation and changes;
2. if you sign in with Google: the e-mail address, name and profile picture address from your Google account, the identifier of that account and the sign-in tokens Google issues to flowhelp; we do not receive your Google password;
3. data on acceptance of documents: the date of acceptance and the version identifier of the Terms of Service (including the DPA) and the Privacy Policy in force when the account was created (for version 1.0: "2026-10-01"); the registration form states: "By creating an account, you accept the terms of service and the privacy policy.";
4. login session data: IP address, information about the browser and device (User-Agent), session validity, active workspace;
5. web server log data when you use the panel: IP address, time, request, Referer and User-Agent (kept for 14 days, see § 11);
6. workspace and membership data: the workspace name and the Customer's website address, plan, trial period, use of limits, settings (including e-mail addresses for notifications and the address from which the Customer forwards mail to the Inbox, see § 6), team members' roles, invitations;
7. workspace event log: who (account identifier) performed a significant action in the panel and when (e.g. a role change, deletion of data), without conversation content; e-mail addresses are stored in it in masked form (e.g. ab***@domain.com);
8. if you take conversations in live chat: the setting of the "I take conversations" switch and information about your presence, which we keep only in our server's cache, without history; it expires about a minute after you close the panel. While the switch is on and the panel is open, the Widget shows Visitors to the Customer's website the first word of the first name in your account and its first letter as an initial, with the information that you are online, without a photo and without any part of your e-mail address. If the account has no first name or the first name is the part of your e-mail address before the @ sign (see point 1), the Visitor sees the label "Someone from the team" instead; you can change your first name in Settings → Profile. In a conversation you have taken over, the Visitor sees that you are typing (we do not store this signal in the database), and we store your replies in the conversation together with your account identifier and the name shown to the Visitor; as part of the conversation, this is the Customer's data, which we process as a processor (§ 7);
9. the content of correspondence with us (see § 8);
10. once payments are launched: data necessary for billing (see section 4.4).

4.2. Purposes and legal bases:

4.3. Where we get data from, if not from you: if another Panel User invited you, we received your e-mail address and assigned role from that person. Your IP address and browser data come from your device when you log in. If you sign in with Google, the data listed in section 4.1(2) is provided to us, at your request, by Google Ireland Limited; signing in to your Google account itself takes place at Google, under Google's privacy policy (Google acts as a separate controller). A Google account with the same e-mail address as an existing Panel account is linked to that account, provided that its e-mail address has been confirmed beforehand.

4.4. Payments. Payments have not been launched yet, and the Service is free of charge during the trial period. Once they are launched, payments may be handled by an external operator acting as the seller (Merchant of Record). In that case the operator, as a separate controller, processes payment data under its own privacy policy, and we receive from it the information needed to maintain the account (e.g. the plan and subscription status). Before payments are launched, we will update this policy and name the operator.

4.5. Members of a team in the same workspace can see each other's first names, e-mail addresses and roles.

§ 5. Visitors to flowhelp.ai, including conversations with the assistant Flow

5.1. Visiting the website. Without your consent, the flowhelp.ai website does not use analytics tools, advertising pixels or third-party scripts, and its fonts are served from our server. We switch on visit statistics and advertising measurement only with your consent (section 5.6). Our server records technical data of each request in its logs: IP address, time, the address of the requested page (with parameters), response code, the referring page (Referer) and browser data (User-Agent). If you enter an address in the "your website address" field on flowhelp.ai and continue, it is passed to the panel as an address parameter (and into the panel server's logs).

5.2. Conversation with the assistant Flow. When you write to Flow, we process:

1. the content of your messages and the Assistant's answers, message times, language, your rating of answers (thumbs up or down), cited sources;
2. a random Visitor identifier stored in your browser's storage with no expiry (see § 16), which links subsequent conversations from that browser;
3. questions Flow could not answer (stored separately, not linked to the conversation, in order to improve the Assistant's knowledge; section 15.4 describes an exception);
4. for a few minutes (up to 2 hours for the contact-form limit): a cryptographic hash of your IP address, used only in the limit counter (the IP address itself is not stored in the conversation database);
5. an identifier of the current conversation stored in your browser's storage (see § 16), thanks to which, for 2 days after the last message, the conversation remains visible after you move to another page or come back to the website;
6. if a member of our team takes over the conversation: that person's replies and the other live chat data described in section 7.3 (live chat works on flowhelp.ai in the same way as on Customers' websites, but we are the controller of this data).

Message content is processed by the AI providers described in § 9 and § 15. Do not enter sensitive data, or data you do not want to share with us, in the conversation.

5.3. Contact form in the chat window. If you leave us your details (e.g. e-mail address, name, company, message), we store them in the database, linked to the conversation, and send a notification containing those fields and up to the 10 latest messages of the conversation to our mailbox hosted in the Gmail service (Google, see section 9.2). We keep this data until the matter is handled, for no longer than 12 months; after that we delete it manually in the panel and delete the notification from our mailbox.

5.4. Purposes and legal bases:

5.5. We do not send newsletters or marketing communications to addresses left in the form. We reply only regarding the matter you contacted us about.

5.6. Statistics and ad measurement with your consent. On your first visit to flowhelp.ai, a banner asks whether you agree to two things. You can agree to both, to one or to neither; without consent the website works the same way.

1. Statistics (Google Analytics). We check how many people visit the website, where they come from (e.g. from a search engine, an ad or a link), which subpages they read and for how long. Google Analytics stores cookies with a random identifier in your browser (see § 16) and passes to Google: the addresses of the subpages you visit and the referring page, events on the page (e.g. scrolling, clicking a link leading outside the website, submitting a form, without the content typed into the fields), browser and device data, an approximate location determined from the IP address (Google Analytics does not store the IP address itself) and the time of the visit. We view the results only in aggregated reports.
2. Marketing (Meta pixel). We measure whether our ads on Facebook and Instagram bring new people, and we may show our ads to people who have visited flowhelp.ai. The Meta pixel stores cookies in your browser (see § 16) and passes to Meta the address of the subpage you visit, the information about the visit, browser and device data and your IP address. If you have a Facebook or Instagram account, Meta may link this data to your account.

Both tools are loaded onto the website by Google Tag Manager, and only after your consent: without it, the website sends no requests to Google or Meta. You can change or withdraw your consent at any time in “Cookie settings” in the footer of every flowhelp.ai page; after withdrawal we delete the cookies of these tools from your browser. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal. We remember your choice in your browser for 12 months (flowhelp:consent, see § 16), without any identifier. If your browser sends a Global Privacy Control signal, we treat it as a refusal and do not show the banner.

Google Analytics is provided to us by Google Ireland Limited as our processor. With regard to the Meta pixel, for the collection of data on our website and its transmission to Meta we are a joint controller together with Meta Platforms Ireland Limited (Article 26 GDPR; the arrangement is set out in Meta's addendum for joint controllers, the “Controller Addendum”). Further processing, e.g. displaying ads, is carried out by Meta as a separate controller, under its own privacy policy. We describe the recipients and the transfer of data to the USA in sections 9.2 and 10.3.

§ 6. Recipients of e-mails from flowhelp

6.1. This applies to people whose e-mail address was entered in the panel by a Panel User, in particular:

1. a developer to whom a Panel User sent the Widget installation code (the "Send to a developer" feature): we process the e-mail address and a short note added by the sender (up to 500 characters), and information on who sent the message and from which workspace; replies to that message go to the sender's e-mail address;
2. a person invited to a team: we process the e-mail address, the assigned role, the status and expiry date of the invitation (7 days) and information on who is inviting;
3. a person to whose address notifications are sent about a new Lead or a request to talk to a human: we process that person's e-mail address set in the action or workspace settings (or, if none is set, the e-mail address of the workspace owner). We process the address itself as controller under this policy. The content of such a notification (the Visitor's form data and an excerpt of the conversation) is the Customer's data, which we process as a processor under the Data Processing Agreement (§ 7).
4. the recipient of the Inbox test message: we process the e-mail address from which the Customer forwards mail to the Inbox (entered in the Inbox settings) and, at a Panel User's request, send to it a test message that checks whether forwarding works.

6.2. Source of data: your address was provided to us by the Panel User who sent the message or invitation or set the notification address or the address forwarded to the Inbox. Each of these messages carries a short footer with our company name and a link to this policy. Replies that the Customer sends from the Inbox are not among the messages described in this section and do not carry that footer (section 7.8).

6.3. Purpose and legal basis: sending the message requested by the Panel User and handling the invitation, notifications or the Inbox, under Article 6(1)(f) GDPR (legitimate interest: ours and the Customer's in enabling the Customer to use the Service, including working with its team, installing the Widget and connecting the Inbox).

6.4. We do not store the developer's full e-mail address from the "Send to a developer" feature in the database; only its masked form (e.g. ab***@domain.com) remains in the workspace event log. We pass the full address to the e-mail operator (Resend) solely for sending. An invitation (valid for 7 days) is deleted automatically 30 days after it expires, whether or not it was accepted; if the workspace is deleted, the invitation is removed at the latest when the workspace's data is permanently deleted, that is 30 days after the workspace is deleted. If you do not want to receive such messages, write to us or to the person who provided your address.

§ 7. Visitors to our Customers' websites and people who e-mail our Customers

7.1. Who is the controller. If you talk to an Assistant on another company's website (our Customer's), the controller of your data is that company. It decides whether and how it uses the Widget, what knowledge the Assistant uses, which fields the contact form has, how long conversations are kept and to whom Leads are passed. We process this data on behalf of the Customer and on its instructions, as a processor, under the Data Processing Agreement. We do not use it for our own purposes.

7.2. Information about the processing can be found in the Customer's privacy policy. The Customer can enter the address of its privacy policy in the panel; the Widget then shows a "Privacy policy" link with the request for consent to the conversation and below the contact form and the form for requesting contact with a human.

7.3. What we process on the Customer's behalf:

1. the content of the conversation (your messages, the Assistant's answers and the replies of a member of the Customer's team, if that person takes over the conversation), time, language, your rating of answers, cited sources;
2. a random Visitor identifier stored in your browser's storage with no expiry (see § 16), which links subsequent conversations from that browser, and its cryptographic hash;
3. if the Customer has configured the Widget this way: the identifier of your account in the Customer's service (e.g. a customer number), passed on by the Customer's website; the Customer decides which identifier it passes on;
4. questions the Assistant could not answer (stored separately, not linked to the conversation; section 15.4 describes an exception);
5. data from the contact form or a request to talk to a human (the fields are defined by the Customer, e.g. e-mail, name, telephone, message); the Customer receives them by e-mail, together with up to the 10 latest messages of the conversation, at the notification address it has chosen;
6. content that the Customer adds as the Assistant's knowledge (websites, notes, question-and-answer pairs, including pairs prepared from replies in conversations that were taken over, see section 15.4, and files); from a file we store its name and the text read from it, and we keep the file itself only until its text has been read, for no longer than 24 hours (see section 15.8); this content may contain personal data for which the Customer is responsible;
7. in a conversation taken over by a member of the Customer's team: that person's account identifier and the name you see next to their replies, and information on when that person joins and leaves the conversation;
8. an identifier of the current conversation stored in your browser's storage (see § 16), thanks to which, for 2 days after the last message, the chat window shows the conversation after you move to another page of the same website or come back to it.

Live chat. Members of the Customer's team with access to its workspace see conversations in the panel in real time and can take over a conversation. When a member of the Customer's team is taking conversations, the chat window shows that person's first name and initial (or the label "Someone from the team", section 4.1(8)). If you ask to talk to a human while a member of the Customer's team is online, we notify the Customer's team in the panel and record the time of this request in the conversation. In a conversation that has been taken over, the Assistant does not answer and replies are written by a member of the Customer's team. The chat window always shows who is replying: the Assistant (labelled "AI") or a human from the Customer's team, and when a member of the Customer's team joins and leaves the conversation. The member of the Customer's team sees whether your chat window is connected and, in a conversation that has been taken over, that you are typing; the content of a message becomes visible only after you send it. You see that the member of the Customer's team is typing. We do not store these signals in the database.

7.4. What we do not store. We do not store your IP address or browser data in the conversation database.

7.5. Server logs and limit counters: here we are the controller. When a Customer's website loads the Widget from our servers (the Widget scripts, its configuration) and when the Widget sends requests to our API, our servers record in their logs the IP address, time, request, referring page (Referer, usually the address of the Customer's page) and browser data (User-Agent). This happens when the page loads, even before you start a conversation. In addition, for a few minutes (up to 2 hours for the contact-form limit), we use a cryptographic hash of your IP address in limit counters. We process this data as controller, not on the Customer's behalf:

1. purpose: ensuring the security of the Service, detecting attacks and preventing abuse;
2. legal basis: Article 6(1)(f) GDPR (legitimate interest: security and continuity of a Service provided to many Customers); you may object (section 12.1 point 6);
3. retention: logs 14 days, IP address hash from 5 minutes to 2 hours;
4. recipients: our hosting provider (OVH) and, to the extent necessary for a specific maintenance task, the provider of AI tools supporting server administration (section 9.1); we do not pass this data to the Customer.

For matters concerning this data, contact us (§ 2), not the Customer.

7.6. Assistant image. If the Customer has set an image (avatar) for the Assistant from its own address, your browser downloads it directly from that address, and its operator may see your IP address.

7.7. How to exercise your rights. Please address any request for access, erasure, rectification or other request concerning a conversation, a Lead or questions to the Customer, i.e. the owner of the website where you had the conversation (for the server logs in section 7.5, contact us). In the panel, the Customer can delete individual conversations, any Lead and the unanswered questions shown in the panel, and export conversations; we delete other questions on its instruction. If you write to us, we will forward your request to the Customer without undue delay and help it fulfil the request. To make it easier to find the data, please give the address of the website where you had the conversation and the approximate time of the conversation.

7.8. E-mails in a Customer's Inbox. A Customer can forward mail arriving at its own e-mail address (e.g. its customer service address) to an address in our domain and reply to it in the panel (the Inbox). If you write to such an address of a Customer or receive a reply from the Inbox, the controller of your data is the Customer, and we process it on behalf of the Customer and on its instructions, as a processor. We do not use it for our own purposes. Information about the processing can be found in the Customer's privacy policy.

1. what we process: the e-mail addresses of the sender and recipients and the name from the message header, the subject and content of the message (including earlier correspondence quoted in it) and its metadata, i.e. message identifiers, selected technical headers (e.g. a flag showing that a message was sent automatically), sender verification results (SPF, DKIM and DMARC) and the names, types and sizes of attachments, and for replies from the Inbox also their content, the author from the Customer's team and the delivery status;
2. basis: we process this data under the Data Processing Agreement concluded with the Customer (Article 28 GDPR); the legal basis for processing your data (e.g. replying to your message or performing a contract with you) is determined by the Customer as controller;
3. retention: like conversations in Customers' Widgets, i.e. according to the Customer's retention setting (30, 90 or 365 days or no limit, 90 days by default), and in any case until the thread is deleted on the Customer's instruction or the workspace is deleted (§ 11);
4. recipients: Resend (section 9.1, item 5), which receives messages sent to the Inbox, keeps a copy of a received message with its attachments for up to 30 days on servers in the EU (Ireland) and sends replies from the Inbox; our hosting provider (OVH); the Customer and its team in the panel; if the Customer uses draft replies prepared by the Assistant or automatic replies (autopilot), also AI model providers, on the terms in section 15.9;
5. rights: address any request concerning this correspondence to the Customer; if you write to us, we will forward it to the Customer as described in section 7.7. Deleting a thread in the Inbox does not delete messages from the Customer's mailbox or from yours.

§ 8. Contacting us, complaints and notices

8.1. When you write to us (by e-mail, by post, through the form in the chat window or by asking for an invite code on the sign-up page), file a complaint or report content that you consider illegal, we process your contact details, the content of the message and the data needed to handle the matter. We send an invite code request (your e-mail address and, if you provide it, your website address) by e-mail to hello@flowhelp.ai and handle it like other messages (section 8.3); for 2 hours we use a cryptographic hash of your IP address in the limit counter of this form.

8.2. Legal bases:

1. replying to a message: Article 6(1)(f) GDPR (legitimate interest: conducting correspondence);
2. complaints concerning the Service: Article 6(1)(b) GDPR (performance of the contract);
3. notices of illegal content and information about decisions: Article 6(1)(c) GDPR in conjunction with Articles 16 and 17 of Regulation (EU) 2022/2065 (Digital Services Act);
4. establishment, exercise or defence of legal claims: Article 6(1)(f) GDPR.

8.3. We also handle messages sent to hello@flowhelp.ai in the Inbox of our flowhelp panel, in the same way as Customers handle their mail (section 7.8): Resend receives them and keeps a copy for up to 30 days, and we send our replies through Resend (section 9.1, item 5). We are the controller of this data and keep it like the rest of our correspondence with you (§ 11).

§ 9. Who we share data with

9.1. Processors (subcontractors). We use the providers listed below, only to the extent needed to provide their services. The entities in items 1, 2, 4, 5 and 6 process data on our behalf on the basis of agreements concluded with those entities, including standard contractual clauses where data leaves the EEA. The entities in item 3 process data as sub-processors of OpenRouter, under agreements concluded by OpenRouter. The same entities process data entrusted to us by Customers, as the sub-processors listed in Annex A to the Data Processing Agreement.

9.2. Other recipients:

1. the Customer and its team: we make data of Visitors to the Customer's websites and the correspondence in its Inbox (§ 7) available to the Customer, and team members' data (first name, e-mail, role) to the other members of the same workspace; the first names and initials of team members who take conversations in live chat, and the first name next to their replies, are also seen by Visitors to the Customer's website (section 4.1(8));
2. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), the provider of the Gmail service in which we keep our mailbox, acting under its own terms: it receives the messages you send us by e-mail and notifications of Leads and contact requests from conversations with Flow on flowhelp.ai (notifications of Leads from Customers' websites do not reach our mailbox; only messages you send us yourself do, including requests concerning conversations on Customers' websites, which we forward to the Customer); Google may transfer data to the USA on the basis of safeguards under Chapter V GDPR (the adequacy decision for the EU-US Data Privacy Framework or SCC);
3. Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA), the provider of the Email Routing service, which forwards messages sent to addresses in the flowhelp.ai domain (e.g. hello@flowhelp.ai, but not Inbox addresses, which Resend receives, section 9.1) to our Gmail mailbox; Cloudflare processes them as our processor under its Data Processing Addendum and may transfer data to the USA on the basis of safeguards under Chapter V GDPR (the adequacy decision for the EU-US Data Privacy Framework or SCC);
4. public authorities and courts: only where an obligation to disclose data arises from the law;
5. the payment operator: once payments are launched (see section 4.4).
6. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), only if you consent to statistics on flowhelp.ai: the provider of Google Analytics and Google Tag Manager, processing data as our processor under Google's data processing terms (section 5.6); Google may transfer data to Google LLC in the USA (section 10.3);
7. Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland), only if you consent to marketing on flowhelp.ai: the provider of the Meta pixel; for the collection of data on our website and its transmission to Meta we are joint controllers, and beyond that Meta processes the data as a separate controller (section 5.6); Meta may transfer data to Meta Platforms, Inc. in the USA (section 10.3).

9.3. We do not sell personal data. For advertising purposes, data goes only to Meta and only if you consent to marketing on flowhelp.ai (section 5.6). We do not share data from the panel, from conversations or from our Customers' websites for advertising purposes.

§ 10. Transfers of data outside the EEA

10.1. Some of the providers described in § 9 have their registered office or infrastructure outside the EEA (mainly in the USA). In that case data is transferred on the basis of the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR) or other safeguards provided for in Chapter V GDPR, as indicated in the table in section 9.1.

10.2. In the case of deAPI, computations may take place on GPU servers in various countries, including outside the EEA. Only text is transferred in that case (excerpts of the Customer's content, and Visitors' questions and the content of Inbox messages only in the situations described in sections 15.1 and 15.9), without the Visitor identifier or IP address. If such a question contains personal data, that data is transferred with it (see section 15.5).

10.3. If you consent to statistics or marketing on flowhelp.ai (section 5.6), data from Google Analytics and from the Meta pixel may be transferred to Google LLC and Meta Platforms, Inc. in the USA. Both companies participate in the EU-US Data Privacy Framework, so the transfer takes place on the basis of a European Commission adequacy decision (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023, Article 45 GDPR) and, as a fallback, on the basis of standard contractual clauses.

10.4. You can obtain a copy of the safeguards applied, or information on where they have been made available, by writing to the address in § 2.

§ 11. How long we keep data

11.1. After these periods expire, we delete or anonymise the data. We may keep it longer only where it is needed for the establishment, exercise or defence of legal claims or where the law requires it, and only to the extent necessary.

§ 12. Your rights

12.1. To the extent that we are the controller of your data, you have the following rights:

1. the right of access to the data and to obtain a copy of it (Article 15 GDPR);
2. the right to rectification of inaccurate or incomplete data (Article 16 GDPR); you can change your first name, password and language yourself in Settings → Profile, and we will change your e-mail address at your request;
3. the right to erasure of data (Article 17 GDPR); you can delete your account yourself in Settings → Profile;
4. the right to restriction of processing (Article 18 GDPR);
5. the right to data portability (Article 20 GDPR), with respect to data you have provided to us and that we process on the basis of a contract or consent by automated means;
6. the right to object to processing based on legitimate interest (Article 6(1)(f) GDPR), on grounds relating to your particular situation (Article 21 GDPR); after an objection we will stop processing the data for that purpose unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims;
7. the right to lodge a complaint with a supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland (https://uodo.gov.pl), or with the data protection authority in the country where you live or work.

12.2. The only processing we base on your consent is visit statistics and ad measurement on flowhelp.ai (section 5.6). You can withdraw your consent at any time in “Cookie settings” in the footer of the website, as easily as you gave it; withdrawal does not affect the lawfulness of processing carried out before withdrawal (Article 7(3) GDPR). If a Customer asks for consent to a conversation in the Widget, this is the Customer's mechanism, and questions about it should be addressed to the Customer.

12.3. Send your request to the address in § 2. We will reply without undue delay and no later than within one month; in complex cases this period may be extended by a further two months, of which we will inform you within the first month. Exercising your rights is free of charge. If we have reasonable doubts as to your identity, we may ask for additional information (e.g. to write from the e-mail address linked to the account).

12.4. If your data comes from a conversation on our Customer's website, section 7.7 applies, and if it comes from correspondence in a Customer's Inbox, section 7.8 applies.

§ 13. Do you have to provide data

13.1. Providing an e-mail address and password is a condition for creating an account and using the panel. The first name is optional.

13.2. Talking to Flow and filling in the contact form are voluntary. Without your contact details we will not be able to reply to you outside the chat window.

13.3. Once payments are launched, providing billing data will be required to purchase a paid plan, and its processing will result from the law.

§ 14. Automated decision-making and profiling

14.1. We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). We do not profile Panel Users or Visitors to our Customers' websites for marketing purposes. If you consent to marketing on flowhelp.ai (section 5.6), Meta may use the pixel data to match and show you our ads; this does not produce legal effects concerning you or similarly significantly affect you.

14.2. The AI Assistant automatically writes answers to questions on the basis of the Customer's materials, in the chat and, if the Customer uses it, also in the Inbox (draft replies and autopilot, section 15.9). It does not assess people and does not make decisions about them. Automated technical mechanisms, such as message limits or blocking traffic that looks like an attack, serve the security of the Service and are not decisions within the meaning of Article 22 GDPR.

§ 15. How AI works and what data goes to model providers

15.1. Knowledge search. Questions put to the Assistant and the excerpts of content the Customer has added as knowledge are converted into numeric vectors (embeddings). This allows the Assistant to find the excerpts that match the question. We convert questions on our own server in Germany (OVH) and the Customer's content excerpts via deAPI. Only when our server is temporarily unable to process a question do we send it to deAPI for this purpose, so that the Assistant can still answer.

15.2. Writing answers. To write an answer, we send the following through OpenRouter to the provider of the selected model:

1. instructions for the Assistant (including the Customer's settings),
2. up to 6 matching excerpts of the Customer's knowledge (the text and title of the source and, for a web page, also its address; the title of an excerpt from a file is the file name),
3. the Visitor's question,
4. up to the 6 latest messages of the conversation (including replies of a member of the Customer's team with the first name shown to the Visitor, if the conversation was taken over).

15.3. What we do not send to the model: the Visitor identifier, IP address, the address of the page where the conversation takes place, contact-form data or the user identifier passed on by the Customer.

15.4. Panel. The "Suggest an answer" feature converts the question into a vector in the same way as the chat (section 15.1) and sends the question and the matching knowledge excerpts to the model. During account setup we fetch the Customer's public home page and send its domain name and the initial excerpts of its text to the model, in order to suggest a welcome message. After a takeover of a conversation ends, the panel can prepare a draft knowledge entry (a question and an answer) from the replies of the member of the Customer's team: we then send the model, through OpenRouter and on the terms in section 15.6, up to the 40 latest messages of that conversation, with the first name shown to the Visitor next to each reply of the member of the Customer's team. The model is instructed to leave out personal data and one-off promises. We save the draft as a suggestion attached to an unanswered question and linked to that conversation. It is added to the Customer's knowledge only when a member of the Customer's team reviews and saves it; from then on the Assistant uses it when answering other Visitors. This is not model training (section 15.6). The welcome-message suggestion and draft knowledge entries use a fixed low-cost model, regardless of the model tier chosen by the Customer (section 9.1).

15.5. No redaction of data. We do not automatically remove personal data from the content of questions. If a Visitor enters personal data in a question, it is sent together with the question to the model provider and, in the situation described in section 15.1, also to deAPI. We therefore ask you not to enter sensitive data, document numbers, health data or passwords in the chat.

15.6. Model training. We do not train or fine-tune AI models on Customers' or Visitors' data. We route requests only to providers that, according to OpenRouter, do not collect data from requests (setting data_collection: deny). Providers may process requests for a limited time on the terms set out in their agreements, e.g. to detect abuse.

15.7. AI labelling. The chat window always states that the conversation is with AI (an "AI" badge and an information sentence that the Customer cannot remove), in accordance with Article 50(1) of Regulation (EU) 2024/1689 (Artificial Intelligence Act). Answers created by AI may contain errors. In live chat, the chat window distinguishes the Assistant's answers, labelled as AI, from the replies of a member of the Customer's team, signed with that person's first name or the label "Someone from the team" (section 7.3). Replies sent automatically from the Inbox (autopilot) are labelled in their content as prepared by an AI assistant (section 15.9).

15.8. Files added as knowledge. The Customer can add files to the Assistant's knowledge (e.g. PDFs, Word and Excel documents, photos). We read the text of files on our own server in Germany (OVH), except for scans and photos, i.e. pages whose text cannot be read directly: we send the image of such a page through OpenRouter, on the terms in section 15.6, to a fixed text-recognition model (currently Google Gemini, section 9.1), without the file name or any other data, with an instruction to transcribe the text exactly. We save the text that has been read as the text of the file's pages; the Customer can review and correct it in the panel, and from then on we process it like the rest of the Customer's knowledge (sections 15.1 and 15.2). We do not keep the file itself: we delete it right after its text has been read and, if reading fails, no later than 24 hours after upload (§ 11). We do not automatically remove personal data from files or from the images sent to the model, so the Customer should add only the files the Assistant needs in order to answer.

15.9. Inbox. If the Customer uses draft replies or the autopilot (where they are available in its plan), we send through OpenRouter to the model provider, on the terms in section 15.6, the instructions for the Assistant, the content of the messages in the thread (including data the sender provided in them), matching excerpts of the Customer's knowledge and examples of earlier replies by the Customer's team; we convert the message content into a vector in the same way as a chat question (section 15.1). From replies by the Customer's team, the panel can prepare a draft knowledge entry, as it does from a conversation that was taken over (section 15.4). A draft reply is sent by a member of the Customer's team after reviewing it; the only reply sent without human approval is a reply from the autopilot, if the Customer has switched it on, and it is labelled in its content as prepared by an AI assistant. We do not automatically remove personal data from the content of messages (section 15.5).

§ 16. Cookies and browser storage

16.1. We use cookies and browser storage that are necessary for the features you knowingly use without asking for consent. We store analytics and advertising cookies (Google Analytics, the Meta pixel) only after your consent in the banner on flowhelp.ai (section 5.6). Under Article 399 of the Polish Electronic Communications Law of 12 July 2024 (Prawo komunikacji elektronicznej), storing information on your device does not require your consent where it is strictly necessary to provide a service you have explicitly requested. This is the case for the entries in the table in section 16.2 marked as necessary: the session cookie is necessary for you to use the panel after logging in, flowhelp_locale remembers the panel language you chose yourself, the Visitor identifier and the conversation identifier are created only when you start using the chat and serve to conduct that conversation, flowhelp:consent remembers your choice in the consent banner, and flowhelp:theme remembers the website theme (light or dark) you chose with the switch. We describe below everything we store in your browser.

16.2. Without your consent, the flowhelp.ai website does not set cookies. Below we list all cookies and browser storage entries we use.

16.3. The Widget on Customers' websites does not use cookies. A Customer may use its own cookies on its website; they are described in the Customer's privacy policy.

16.4. You can delete cookies and site data in your browser settings at any time. Deleting the session cookie will log you out of the panel, and deleting the Visitor identifier will start a new conversation. You can change or withdraw your consent to statistics and marketing in “Cookie settings” in the footer of every flowhelp.ai page; after withdrawal we delete the Google Analytics or Meta pixel cookies from your browser. The Meta pixel may also read Meta's own cookies from the facebook.com domain if your browser allows it (e.g. while you are logged in to Facebook); they are described in Meta's cookie policy, and you can delete them in your browser settings.

§ 17. Security

17.1. In particular, we apply the following measures:

1. encrypted connections (TLS 1.2 and 1.3) and HSTS on the website and in the panel;
2. a firewall that blocks incoming traffic by default; the application is not reachable from the internet directly, only through a reverse proxy server;
3. separation of Customers' data at database level (Row-Level Security), verified by automated tests;
4. passwords stored only as cryptographic hashes (salted scrypt);
5. team roles that determine access to data in the panel; export of conversations only for the owner and administrator;
6. limits on login attempts and messages, an allowlist of domains for the Widget and HMAC signatures for Customers' user identifiers and, in the Inbox, verification of the signature of events from the e-mail provider and a limit on the number of replies sent;
7. data minimisation in logs (application logs without the content of conversations or e-mails, e-mail addresses masked; database diagnostic logs may exceptionally contain fragments of content) and short log retention periods;
8. daily database backups, kept for 14 days;
9. administrative access to servers only for authorised members of the management board; administration is supported by AI tools (section 9.1, item 6), which access data only to the extent necessary for a specific task.

17.2. We do not currently offer two-factor authentication, so we recommend using a strong password that you do not use for other services.

17.3. No method of transmitting or storing data is completely secure. If a personal data breach occurs, we will act in accordance with Articles 33 and 34 GDPR and, for data entrusted to us by Customers, notify the Customer in accordance with the Data Processing Agreement.

§ 18. Changes to the policy and entry into force

18.1. We may change this policy, e.g. when the Service's features, providers or the law change. The current version is always available on flowhelp.ai, with its version number and effective date.

18.2. We will inform the owners and administrators of workspaces of material changes before they take effect, by e-mail and at the workspace notification address (if one is set), and additionally in the panel. Changes to the list of processors for data entrusted to us by Customers are announced in accordance with the Data Processing Agreement.

18.3. The Polish version of this policy is binding. Versions in other languages are translations; in case of any discrepancy, the Polish version prevails.

18.4. This policy, version 1.10 of 7 November 2026, is effective from 7 November 2026.