Privacy policy
This policy explains how [legal entity name], [street and number], [postcode] [city], Belgium, company number [BE 0xxx.xxx.xxx] ("Flowhawk", "we") handles personal data about people who visit this site, sign up or use the app. For telemetry your systems send to Flowhawk, your company is the controller and we are its processor: that is covered by the data processing agreement.
What we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Account: name, email, password hash, sign-in method (GitHub or Google if you choose), two-step sign-in secret | To create your account and let you sign in safely | Contract |
| Workspace membership, role, invitations | To run the workspace and its permissions | Contract |
| Security records: sign-in times, IP address, browser, audit log of sensitive actions | To protect accounts and investigate abuse | Legitimate interest (security) |
| Billing: company name, address, VAT number, top-ups and invoices. Card details are handled by Stripe; we never see the full card number | To take payment and keep tax records | Contract, legal obligation |
| Free trial checks: your card's fingerprint and country from Stripe (never the card number), your email address and a one-way key of your network address | To give each person, card and company one free trial | Legitimate interest (preventing abuse) |
| On-call contact details: phone number, push subscription | To page you when you are on call | Contract |
| Support emails you send us | To answer you | Contract, legitimate interest |
| Product emails: whether you want onboarding and product update emails | To send only the emails you want | Legitimate interest, consent where needed |
We don't use advertising trackers or analytics cookies, and we don't sell personal data.
Cookies
This site sets no cookies. The app sets only cookies it needs to work: a session cookie that keeps you signed in and a short-lived one during sign-in with GitHub or Google. These are strictly necessary, so no consent banner is needed. Fonts are served from our own servers, so no request goes to Google when you load a page.
Who we share it with
Only with the service providers that help us run Flowhawk, under contracts that protect the data. The full list, with what each does and where, is on the subprocessors list. The main ones: Hetzner (hosting, Germany), Stripe (payments), Resend (email), Cloudflare (DNS and our email inbox) and Anthropic (the AI model). We share data with authorities only when the law requires it.
Transfers outside the EU
Flowhawk runs in Germany. Some providers are in the United States or can reach data from there (Stripe, Resend, Cloudflare, Anthropic). For those we rely on the EU-US Data Privacy Framework where the provider is certified, and the European Commission's standard contractual clauses otherwise.
How long we keep it
- Account and workspace data: while the account exists. When you delete your account or workspace, we delete it within 30 days, and from backups within 14 days after that.
- Security and audit records: about 13 months.
- Free trial checks: kept after a workspace is deleted, so a card or address can't start a second trial; ask us to erase them after 2 years.
- Invoices and payment records: 7 years, as Belgian tax law requires.
- Support emails: up to 2 years after the conversation ends.
Your rights
You can ask to see, correct, export or delete your personal data, to restrict or object to how we use it, and to withdraw consent at any time. Most of this is self-service: change your email in Settings > Security, download your data and delete your account in Settings, and turn product emails off with the link in any of them or in Settings > Security. For anything else, email hello@flowhawk.dev; we answer within one month.
If you think we handle your data wrongly, you can complain to the Belgian Data Protection Authority (dataprotectionauthority.be) or the authority where you live.
Changes
We post changes here and email account owners about any that matter.
Contact
[legal entity name], [street and number], [postcode] [city], Belgium, company number [BE 0xxx.xxx.xxx]. Email hello@flowhawk.dev.