Last updated: October 31, 2026
Flowzao is operated by Basalticware, Lda., with registered offices in Ponta Delgada, Azores, Portugal. When this policy mentions "Flowzao", "we" or "us", it refers to Basalticware, Lda. You can reach us about data protection at hello@basalticware.com.
This policy covers the Flowzao website (flowzao.com), the web app (app.flowzao.com) and the Flowzao mobile app for iOS and Android. Where a section applies only to one of them, it says so.
Basalticware is the controller of the personal data it needs to provide and run Flowzao: your account and sign-in details, the billing contact of an organization, notification tokens, security and technical logs, and the data of visitors to this website.
The content that an organization keeps in Flowzao belongs to that organization: tickets, interventions, photos, drawn signatures and signer names, comments, attachments, time logs, feedback and ecosystem data. The organization is the controller of that content. Basalticware processes it as a processor, only on the organization's instructions and under our Data Processing Agreement. This policy also describes how we handle that content, but the organization decides what is recorded and who can see it. To exercise your rights over it, see section 9.
When you create an account, we collect your name, email address, and a password hash. If you sign in through Google or Microsoft, we receive your name, email, and profile picture from those providers.
If you use Sign in with Apple in the iOS app, Apple shares with us the name you choose to share (you can edit it at that moment) and your email address. If you choose to hide your email, Apple gives us a private relay address (ending in privaterelay.appleid.com) that forwards to your real address, and we never see the real one. We also store, encrypted, a token issued by Apple, so that we can revoke Flowzao's access to your Apple ID when you delete your account.
When you create an organization, we store the organization name, industry, and the members you invite. The tickets, comments, attachments, time logs and feedback ratings that the organization's users record are organization content (see section 1).
Intervention records are organization content too. When a technician records an intervention on a ticket, we store the arrival time, the work time, the photos added, the closing note and any internal note. If the client signs on the screen, we store the drawn signature and the name of the person who signed. If the client was not present, we store the reason given instead.
If you allow notifications in the mobile app, we store the push notification token of your device and whether it is an iOS or Android device, so that we can send you notifications.
We also collect technical data automatically. On the website and the web app, this includes your IP address, browser type, device information, and pages visited. In the mobile app, our servers receive your IP address and the requests the app makes to work; the app does not collect a browsing history. The web app uses cookies to keep you signed in; the website sets no cookies (see section 12). We do not use advertising cookies or third-party tracking scripts.
Camera and photo library: the app asks for access to the camera or to your photos only when you choose to add a photo to a ticket, and only the photos you pick or take are uploaded. You can refuse or withdraw this access in your device settings and still use the rest of the app.
Notifications: the app asks for permission to send notifications after you sign in. Notifications are optional and you can turn them off at any time in your device settings.
The app does not ask for access to your location, contacts or microphone.
On your device, the app keeps your sign-in session in the system's secure storage (the iOS Keychain or the Android Keystore) and a copy of recently loaded data so that screens open quickly when the connection is weak. Signing out removes this session from the app.
The app contains no advertising, does not track you across other companies' apps or websites, does not use the advertising identifier, and does not include third-party analytics or crash reporting tools.
You can delete your account inside the app. See section 10 and the account deletion page.
We use your information to operate the platform: authenticating you, delivering notifications about tickets and ecosystems by email and, in the mobile app, by push notification, processing payments, and generating reports. We send transactional emails for account verification, password resets, ticket assignments, and billing events. We do not send marketing emails unless you explicitly opt in. We analyze aggregate usage patterns to improve the product. This analysis does not identify individual users. We do not use your data to train machine learning models. We do not sell your personal information to anyone.
Flowzao's AI features are off unless an administrator of an organization connects that organization's own Anthropic (Claude) API key. We store the key encrypted. Flowzao does not provide or pay for AI usage, and it does not send your data to Anthropic or any other AI provider in any other case.
When an organization has connected its key, the ticket text, photos or documents needed for an AI feature are sent to Anthropic under the organization's own Anthropic account, for the features its users invoke or that the organization uses. These include suggesting the priority of a new ticket, drafting a resolution note from a technician's notes and photos, drafting a client report, proposing service levels from a contract, and sorting tickets received by email or through a QR code. Drafts and suggestions are shown to a person, who reviews them before they are used. For tickets received by email or QR code, the AI sets an initial priority, severity and type, which the team can change.
Anthropic processes this data under the terms the organization accepted with Anthropic. An administrator can disconnect the key at any time, which stops all AI features for that organization.
We use the following service providers to run Flowzao: Neon (PostgreSQL database hosting in the eu-central-1 region, Frankfurt), Cloudflare (application hosting, CDN, DDoS protection, and file storage in R2, in Western Europe), Stripe (payment processing for paid plans, which are managed on the web), and Resend (transactional email delivery). Each of these works under a data processing agreement.
For the mobile app, Expo delivers push notifications and app updates. Push notifications reach your device through the Apple Push Notification service (iOS) or Firebase Cloud Messaging by Google (Android). The text of a notification, for example a ticket title and the name of the person who assigned it, passes through these services.
If you sign in with Apple, Google or Microsoft, that provider processes your sign-in under its own privacy policy. Anthropic receives data only as described in section 5, under the organization's own account.
Within the Flowzao platform, your data visibility depends on your role. Organization owners and admins see all data within their organization. Technicians see only the tickets assigned to them and their own performance data. In shared ecosystems, each organization can only manage its own users. The ecosystem owner cannot see individual users from other organizations.
Your primary data is stored in a Neon PostgreSQL database in the eu-central-1 region (Frankfurt, Germany), in the European Union. File attachments, including photos added in the mobile app, are stored in Cloudflare R2, in a bucket located in Western Europe.
The application runs on Cloudflare Workers, on Cloudflare's global network: each request is processed in the Cloudflare data centre closest to the user, which can be outside the European Union. Emails and push notifications pass through the providers listed in section 6, some of which are outside the European Union. For these transfers we rely on adequacy decisions of the European Commission or on its Standard Contractual Clauses.
Payment data is processed and stored by Stripe, which maintains PCI DSS Level 1 compliance. We do not store credit card numbers or full payment details on our servers.
All data in transit is encrypted using TLS 1.3. Data at rest in the database is encrypted by Neon. Passwords are hashed using scrypt with a unique salt per user. We do not store plaintext passwords. The tokens issued by Apple for Sign in with Apple and the AI keys connected by organizations are stored encrypted. API authentication uses session tokens with configurable expiration. Access to production infrastructure is restricted and requires multi-factor authentication. We review access permissions regularly and follow the principle of least privilege.
If you are located in the European Economic Area, you have the following rights regarding your personal data. The right to access: you can request a copy of all personal data we hold about you. The right to rectification: you can update your information directly in the platform or request corrections. The right to erasure: you can delete your account, which triggers deletion of your personal data within 30 days. The right to restrict processing: you can request that we limit how we use your data. The right to data portability: you can request your data in a machine-readable format. The right to object: you can object to processing based on legitimate interests. To exercise any of these rights, email hello@basalticware.com. We will respond within 30 days. If you are unsatisfied with our response, you may lodge a complaint with the Portuguese Data Protection Authority (CNPD) or your local supervisory authority.
For organization content (see section 1), the organization is the controller, so send requests about that content to the organization. If you send them to us, we will pass them on and help the organization respond.
You can delete your account in the mobile app (Profile > Settings > Danger zone > Delete account), in the web app (Profile > Danger zone > Delete account), or by emailing hello@basalticware.com from the address of your account.
When you delete your account, it is marked as deleted and you are signed out. If you own an organization, that organization, its ecosystems and its subscription are ended too. If you used Sign in with Apple, we ask Apple to revoke the tokens that give Flowzao access to your Apple ID. Your personal data is then removed as described in section 11.
Account data is retained for as long as your account is active. If you delete your account, we remove your personal data within 30 days. Some data may persist in encrypted backups for up to 90 days before being purged. Billing records and invoices are retained for 7 years to comply with Portuguese tax law. Push notification tokens are kept while a device is registered and are removed when you sign out of the app on that device. Anonymized analytics data may be retained indefinitely as it cannot be linked back to an individual. Outbox events and system logs are retained for 90 days for debugging and audit purposes.
The website (flowzao.com) does not set any cookies. If you switch between the light and dark theme on the website, your choice is saved in your browser's local storage so that it is kept on your next visit; nothing is saved if you do not switch. You can clear it in your browser settings. The website has no analytics, advertising or third-party tracking, and its fonts are served from our own domain.
The web app (app.flowzao.com) uses cookies only to keep you signed in. They are strictly necessary for the service you asked for, so they do not need your consent, and the web app cannot be used without them. They are secure and HTTP-only, and they are set for the whole flowzao.com domain so that sign-in works across Flowzao's addresses. For that reason your browser also sends them when you visit the website, which does not use them. They are removed when you sign out or when your session expires.
The mobile app does not use cookies for tracking; it keeps your session as described in section 3.
Flowzao is a business platform. It is not intended for use by anyone under 16 years of age. We do not knowingly collect information from children. If we learn that we have collected data from a child under 16, we will delete it promptly.
We will update this policy when our practices change. If we make a significant change, we will notify you by email or through a notice in the platform before the change takes effect. Minor changes (clarifications, formatting) may be made without notice. The "Last updated" date at the top of this page reflects when the policy was last revised.
For any questions about this privacy policy or how we handle your data, contact us at hello@basalticware.com. Our registered address is in Ponta Delgada, Azores, Portugal.