Privacy Policy

Who We Are

Flowcite GmbH ("Flowcite", "we", "us", "our") operates the Flowcite marketing website (flowcite.com) and the Flowcite application (app.flowcite.com) — together, the "Services". For the purposes of the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG), Flowcite GmbH is the data controller for the personal data described in this policy.

Flowcite GmbH
Sonnenacker 61, 40489 Düsseldorf, Germany
Data-protection contact: privacy@flowcite.com · Compliance: compliance@flowcite.com
Company details: see our Imprint.

This policy explains what personal data we process, why, on what legal basis, who we share it with, and the rights you have. Content you create inside the application is processed to provide the Services to you.

Data We Collect

We collect personal data that you provide, data generated automatically when you use the Services, and — in limited cases — data from third parties such as our payment processor.

• Account data. When you register we collect your name, email address, country, and password (stored only as a secure hash).
• Payment data. Paid plans are billed through our payment processor Stripe. Stripe collects and processes your billing and card details; we do not store full card numbers and receive only limited billing information (e.g. billing name, plan, and payment status).
• Content you create. Documents, references, citations, notes, and other content you create or upload in the application, stored to provide the Services to you.
• Communications. When you contact us (for example via the contact form or by email), we keep your messages and contact details to respond and for our records.
• Usage and device data. Basic technical data such as pages viewed, approximate (country-level) location, device and browser type, and interactions — used to operate, secure, and improve the Services. On the website and app this measurement is performed with Google Analytics 4 and only after you consent (see Cookies & Analytics).

How & Why We Use Your Data

We process your personal data for the following purposes and legal bases under Art. 6(1) GDPR:

• Provide the Services — create and secure your account, deliver features, process your documents and references, and provide support. Legal basis: performance of a contract (Art. 6(1)(b)).
• Billing and payments — process subscriptions and payments via Stripe. Legal basis: performance of a contract and legal obligation (Art. 6(1)(b), (c)).
• Security and reliability — protect the Services and detect abuse, fraud, or technical problems. Legal basis: legitimate interests (Art. 6(1)(f)).
• Analytics to improve the Services — understand, in aggregate, how the website and app are used, via Google Analytics 4. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time.
• Communications — respond to your enquiries and send service messages; marketing emails only where you have opted in. Legal basis: contract, legitimate interests, or consent as applicable.
• Legal compliance — meet our legal obligations and respond to lawful requests. Legal basis: legal obligation (Art. 6(1)(c)).

Cookies & Analytics

We use strictly-necessary cookies to operate the website and application (including keeping you signed in), and Google Analytics 4 (GA4) loaded through Google Tag Manager (GTM) to understand, in aggregate, how the Services are used. Google acts as our processor for this analytics data. Analytics are governed by Google Consent Mode: analytics cookies are set and measurement runs only after you accept analytics, and advertising signals remain disabled at all times. We use no advertising cookies and no other third-party tracking. For the specific cookies, retention periods, and how to change your choice, see our Cookie Policy.

Sharing & Processors

We do not sell your personal data and we do not share it with advertising networks. We share personal data only with:

• Service providers (processors) acting on our instructions under data-processing agreements — including Stripe (payments), Google (GA4 / GTM analytics, consent-gated), and our hosting, email, and support providers.
• Legal and safety — where required by law, court order, or a lawful request, or to protect the rights, property, or safety of Flowcite, our users, or the public.
• Corporate transactions — if we are involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction, subject to this policy.

International Data Transfers

Our own infrastructure for the Services is located in the European Union (Germany). Some processors (for example Google and Stripe) may process data on servers outside the EEA, including in the United States. Where that happens, transfers are protected by an adequacy decision such as the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, together with appropriate technical and organisational safeguards.

Data Retention

We keep personal data only for as long as necessary for the purposes described above: account and content data for as long as your account is active and then for a limited wind-down period; billing records for the statutory retention periods (for example under German tax and commercial law); and analytics data for the retention period configured in GA4. We delete or anonymise data when it is no longer required.

Security

We use appropriate technical and organisational measures — including encryption in transit, access controls, and hosting in secured EU data centres — to protect your personal data against unauthorised access, loss, or misuse. No method of transmission or storage is perfectly secure, but we work to protect your data and will notify you and the competent authority of a personal-data breach where the law requires. Please keep your account credentials confidential.

Your Rights

Where the GDPR applies, you have the right, free of charge, to: access your personal data and receive a copy; have inaccurate data rectified; have your data erased; restrict or object to processing; receive your data in a portable, machine-readable format (data portability); and, where processing is based on consent, withdraw that consent at any time (this does not affect processing carried out before withdrawal).

To exercise any of these rights, contact privacy@flowcite.com. You also have the right to lodge a complaint with a data-protection supervisory authority — in our case the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, or the authority in your country of residence.

Children

The Services are intended for users aged 18 or older and are not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the revised version here with a new effective date and, where required, notify you.

Contact Us

For any question about this Privacy Policy or to exercise your rights, email privacy@flowcite.com or write to: Flowcite GmbH, Sonnenacker 61, 40489 Düsseldorf, Germany. For compliance matters, contact compliance@flowcite.com.

Last updated: July 2026