Privacy Policy

1. Controller and contact

The controller of data relating to contact with Flowpeek, ordering and billing of our service, and account management and support is FLOWPEEK PROSTA SPÓŁKA AKCYJNA (Flowpeek P.S.A.), ul. Fryderyka Szopena 35C, lok. W164, 35-055 Rzeszów, Poland, Tax ID (NIP) 8133943331, National Court Register (KRS) No. 0001209078. For all matters concerning data, you can write to support@flowpeek.app or to the company's address.

This policy covers the flowpeek.pl website and processing related to the provision of the Flowpeek service. If you visit a store of one of our customers, please also read that store's policy: its owner decides on the purposes of measurement, active integrations and communication with its customers.

2. What data we process and for what purpose

We receive data directly from you, from the entity that created an account for you, from the course of using the service, and from the platforms connected by the customer and the payment operator. The scope depends on your relationship with Flowpeek.

• Contact and inquiries: email address, first name, content of the correspondence and data voluntarily provided in the message. When you ask about concluding an agreement, the legal basis is Article 6(1)(b) GDPR; in other matters, our legitimate interest in handling correspondence — point (f). The contact form on flowpeek.pl saves your first name, email address, message content, submission date, and the version and time of your acknowledgment of the privacy information, in order to document how the contact was handled. The message goes to the form inbox on the website server and to our CRM system, where we continue the conversation; only authorized members of the Flowpeek team have access to them. The team receives a notification about a new message in Google Chat. If the conversation leads to cooperation, we move the contact details within the CRM to the customer record. The form does not send email notifications.
• Scheduling meetings: full name, email address, the selected time slot and time zone, and information about which part of the website the booking came from (UTM parameters). You schedule online meetings, such as a Flowpeek demo or a free analytics review, in Calendly. The legal basis is steps taken at your request prior to entering into an agreement — point (b), and, as regards assessing which parts of the website lead to conversations, our legitimate interest — point (f).
• Account and performance of the agreement: login, email address, username, permissions, company, store and configuration details, service history and secured login credentials. The legal basis is the performance of the agreement — point (b); for the customer's authorized employees and access management, also our legitimate interest in handling this cooperation — point (f). The application may send notifications and reports configured by the user; these are part of account servicing and separate from the website's marketing newsletter.
• Billing: buyer details, Tax ID (NIP), address, order and payment identifiers, amounts and billing statuses, including purchases of Flowask credit packs, as well as aggregate data without any data of store customers: daily order counts and the number of dashboard domains that determine the plan, and the Flowask credit balance and usage (number of questions, AI summaries and credits used, without conversation content). The legal basis is the agreement (point (b)) and tax and accounting obligations (point (c)).
• Security and claims: information about logins, technical events, the IP address or its hash, and correspondence concerning a dispute. The website server records technical information about requests in logs kept for up to 7 days, and we protect the contact and newsletter forms against abuse with time-limited attempt counters based on a hash of the IP address and, for newsletter sign-ups, also of the email address; the counters are not used for advertising profiling. The legal basis is our legitimate interest in protecting the website and the service and in establishing, exercising or defending legal claims — point (f).
• The Flowpeek newsletter: email address, the content and version of the consent, the time and place of sign-up, and the status of the transfer to GetResponse. The data is used to send tips on e-commerce analytics and on using Flowpeek, on the basis of voluntary consent — Article 6(1)(a) GDPR — and consent to electronic communication. We keep a local history of sign-ups and consents in order to demonstrate that consent was given — legitimate interest, point (f). Signing up requires confirming the address via a message. Neither the contact form nor purchasing the service automatically subscribes you to the newsletter.
• Google Analytics 4 (Google Ireland Ltd.): with your consent, we collect visit statistics for the flowpeek.pl website — including pages visited, traffic source, approximate location, device and browser type, and pseudonymous identifiers stored in Google Analytics cookies. The sole purpose is to measure traffic and improve the website. The legal basis is consent — Article 6(1)(a) GDPR. The Google Analytics script runs in Consent Mode v2: until you choose “Accept all” or “Analytics only”, it does not store analytics cookies, and advertising signals (ad_storage, ad_user_data, ad_personalization) remain disabled even after acceptance. You can withdraw your consent at any time via the “Cookie settings” link in the website footer.
• Flowpeek Tracker (our own tool): with your consent, we collect visit statistics for the flowpeek.pl website: pages visited, traffic source (referring page address and UTM parameters), device and browser type, language, time on page and scroll depth, as well as clicks on the trial and meeting-booking buttons, form submissions, and use of the calculator and video. We determine the country, region and city from the IP address, and the address itself is not included in the measurement data. We tag the visitor and the session with random, pseudonymous identifiers. The tracker does not read form contents. The purpose is to measure traffic and improve the website. The legal basis is consent, Article 6(1)(a) GDPR. You can withdraw your consent at any time via the “Cookie settings” link in the website footer.
• GetResponse Web Connect (GetResponse S.A.): with your consent, we collect information about the flowpeek.pl pages you visit, your IP address, technical browser data and an identifier stored in the GetResponse tracking cookie. If you visit the website from a link in our message, GetResponse links these visits to your contact on our list, i.e., to your email address. The purpose is to check which messages lead to the website and to tailor subsequent messages to your interests. Such tailoring does not produce legal effects concerning you. The legal basis is consent, Article 6(1)(a) GDPR. The code runs only after you select “Accept all” in the cookie banner. You can withdraw your consent at any time via the “Cookie settings” link in the website footer.

3. Is providing data mandatory

Providing data is voluntary, but contact details are needed for us to reply, and account and billing data — to conclude and perform the agreement. Without the required data, these actions cannot be carried out. The scope of information required to issue billing documents is determined by law.

Do not send us passwords, card details or sensitive information in a regular message or in a question to the AI. Acknowledging the policy in a form is not consent to advertising.

The newsletter is free of charge and voluntary. It does not require an application account. Without an email address and consent, we cannot send the newsletter; unsubscribing does not affect your use of Flowpeek or the terms of your subscription.

4. Data of store visitors and customers

The store owner is the controller of the data of its visitors and customers. When we handle this data on the owner's instructions, Flowpeek acts as a processor under a data processing agreement. A custom domain and server-side implementation do not automatically change the roles or the obligations regarding consent.

Depending on the settings and the legal bases for processing, the application may receive pseudonymous visit identifiers, page views and page addresses, traffic sources, events, activity time, device parameters and order data: identifier, products, amounts, currency, status and returns. A pseudonymous identifier does not mean that the data ceases to be personal data.

Once Flowprofile is enabled, the integration may also transfer email addresses, phone numbers, customer identifiers and information about consents and their origin. Heatmaps may include click positions, scrolling and sampled mouse movement; the heatmap tracker itself does not collect the contents of form fields. A separately activated profile integration may transfer contact details from the account, order or supported forms.

A request concerning data from a specific store is best directed to its owner. Flowpeek assists the owner in handling data subject rights under the data processing arrangement; we do not treat mere access to store data as consent to our own marketing to the store's customers.

5. Cookies and browser storage

The marketing website does not run advertising pixels. There are two external measurement tools, and both operate only with your consent. Google Analytics 4 stores analytics cookies (_ga, _ga_*) only after you choose “Accept all” or “Analytics only” in the cookie banner; before you decide and after you reject, it operates with consent denied, without analytics or advertising cookies. We load the GetResponse Web Connect code only after you choose “Accept all”. It stores a GetResponse tracking cookie which, after you arrive from a link in our message, makes it possible to recognize subsequent visits. We load Flowpeek Tracker, our own measurement tool, only after you choose “Accept all” or “Analytics only”. It does not store cookies. In browser storage (localStorage, sessionStorage, IndexedDB), it keeps a random visitor identifier for 12 months, a session identifier, the consent status and a queue of unsent events. After rejection, the tracker deletes these identifiers and the queue, sends a single consent-withdrawal signal and stops measuring. Only a technical record of that decision then remains in browser storage. We save your choice in browser storage (localStorage, flowpeek_cookie_consent) for 12 months, after which we will ask again. You can change it at any time via “Cookie settings” in the footer. After rejection, we delete Google Analytics cookies from the website domain, and after you withdraw marketing consent, we no longer run the GetResponse code. The website does not delete a previously stored GetResponse cookie; you can do so in your browser settings. Fonts, graphics and the presentation video are served from the website's own files. The video loads after you open the player and does not use an external video service. A third-party service logo is not that service's tracking script.

Strictly necessary cookies may keep you logged in and protect forms against abuse. The application dashboard uses a session cookie. The contact and newsletter forms on flowpeek.pl use flowpeek_contact_form, and the team panel for handling submissions uses flowpeek_contact_admin. These are session cookies; the back office ends the login after 30 minutes of inactivity or after 8 hours. Newsletter sign-up connects the Flowpeek server with GetResponse; we do not embed a GetResponse form on the website, and the Web Connect tracking code runs only with the consent described above.

Flowpeek measurement in a store has a separate configuration. The tracker uses localStorage, sessionStorage and an IndexedDB queue, among other things for identifiers, consent status and undelivered events. It does not create its own identifying cookie. These technologies are also subject to privacy rules; the “first-party” label does not replace the required consent.

The scope and duration of measurement in a store are described by its controller. You can manage consents in the tool provided by the store and delete website data in your browser. Blocking the necessary session may make it impossible to log in or submit a form.

6. Recipients, integrations and data from Google

Access to data may be given to authorized members of our team and to providers of hosting, infrastructure, email, technical support and accounting services — to the extent necessary for the given service and on an appropriate legal basis. Data may also be disclosed to authorities entitled to receive it under the law.

The flowpeek.pl website, including the contact form, the submissions inbox and the local history of newsletter sign-ups, runs on a server provided by Hetzner Online GmbH in Germany (European Union), which we administer using the CloudPanel control panel. Form data is stored on this server outside the publicly accessible website files. Hetzner processes it solely to the extent of maintaining the infrastructure.

We forward messages from the contact form to our CRM system (RISE software), which runs on a server provided by dhosting.pl Sp. z o.o. in Poland. The connection is encrypted and each submission is signed with the website's key; we do not transfer the IP address. A notification about a new message — with the first name, email address, the beginning of the message and the source of the submission — is sent to the team in Google Chat, a Google Workspace service provided by Google Ireland Ltd. Data may be transferred to Google LLC in the United States; the legal basis is the European Commission's decision on the EU-US Data Privacy Framework, in which Google LLC participates.

The application infrastructure provider is Hetzner Online GmbH. We use dedicated servers in Germany, in the European Economic Area. This location concerns the hosting of the Flowpeek application. Data transferred to the AI provider powering Flowask (OpenAI by default, or the provider chosen by the customer when using their own API key, see Section 7) and through active integrations may also be processed outside the EEA.

Payments are processed by Stripe. After selecting the trial button, you go to the Stripe form, where you enter your payment details; you also pay through Stripe for Flowask credit packs purchased in the dashboard. The Flowpeek website does not store your full card number. Stripe may also process data for its own payment and security purposes, as described in its policy.

We schedule online meetings through Calendly, a service of Calendly LLC from the United States. After selecting the “Book a demo” button or signing up for an analytics review, you go to the Calendly website in a new tab; the Flowpeek website does not embed the Calendly calendar or Calendly scripts. Calendly processes booking data on our behalf, and on its own website it uses its own cookies, described in its policy. Data may be transferred to the United States; Calendly states that it participates in the EU-US Data Privacy Framework, for which the European Commission has issued an adequacy decision.

We entrust the handling of the newsletter to GetResponse S.A., based in Gdansk, Poland. After an active form is submitted, we transfer the email address and the newsletter list identifier to GetResponse. The service handles sign-up confirmation, sending and unsubscribing. After you select “Accept all” in the cookie banner, GetResponse also receives information about visits to flowpeek.pl as part of Web Connect (see Sections 2 and 5). The data is processed on our behalf under a data processing agreement; detailed information about recipients and safeguards is available at support@flowpeek.app.

Once you give consent, website visit statistics are processed by Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland) as part of Google Analytics 4. Data may be transferred to Google LLC in the United States; the legal basis for such a transfer is the European Commission's decision on the EU-US Data Privacy Framework, in which Google LLC participates. We do not combine Google Analytics data with form data or enable Google advertising features.

We collect Flowpeek Tracker data in our Flowpeek application, on servers provided by Hetzner Online GmbH in Germany. We do not transfer it to advertising providers and do not enable ad click identifiers in it.

In the application, the transfer of data to store, advertising and marketing platforms depends on the integrations enabled by the store owner. The catalog of supported tools does not in itself mean that data is transferred to all of them. The scope of sub-processors and authorizations for entrusted data is set out in the documentation of the specific implementation.

Data from Google Analytics 4 and Google Ads. The store owner can connect a Google Analytics 4 or Google Ads account in the dashboard using the “Sign in with Google” button. Flowpeek then receives access only to the extent accepted on the Google consent screen and retrieves only the data needed for that store's reports. We process this data on the customer's instructions.

From Google Analytics 4, with read-only permission, we retrieve the list of properties available to the account and aggregate statistics for the selected property: sessions, users, engagement, conversions, transactions and revenue by day, channel, source, campaign and device type, as well as transaction identifiers with their source. We do not change the configuration of the GA4 property.

From Google Ads, we retrieve the list of available accounts and the results of the selected account: campaign cost, clicks, impressions and conversions, click identifiers (gclid), which we store only as a hash, and the results and status of products in shopping campaigns. If the store owner enables Customer Match audiences, Flowpeek creates an audience list in the owner's Google Ads account and uploads to it SHA-256 hashes of the email addresses and phone numbers of store customers who have consented to the use of their data in advertising and to ad personalization. We remove people who withdraw their consent from this list.

Data from Google is visible only to the team of the given store. We do not sell it, share it with other customers, or use it for our own advertising or to train AI models. In Flowask's default mode and with the customer's own OpenAI key, aggregate results from GA4 and Google Ads may be sent to OpenAI solely as context for a question asked by the user (Section 7). AI summaries in email notifications use only Flowpeek measurement data and do not contain data retrieved from Google. We do not transfer data retrieved from Google to DeepSeek.

We store Google access tokens encrypted and delete them when the integration is disconnected in the dashboard. You can also revoke access at any time in your Google account settings: myaccount.google.com/permissions. We delete data retrieved from Google together with the dashboard after the subscription expires (Section 8).

Flowpeek’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

7. Flowask, predictions and processing outside the EEA

Flowask, the dashboard's AI assistant, answers questions in a chat and prepares AI summaries in email notifications. It operates in one of two modes. In the default mode, billed in Flowask credits, we send queries to the OpenAI API from the Flowpeek account. The API service provider is OpenAI (OpenAI Ireland Ltd in Ireland and OpenAI, L.L.C. in the United States), which processes this data on our behalf; for store data that we process on the customer's instructions, it is a sub-processor. According to OpenAI's terms, data sent through the API is not used to train models by default.

We send OpenAI the question, the most recent messages in the conversation and a limited table of aggregate report results for the selected store, and, for summaries in emails, the aggregate results of the report the message concerns. The model has no access to the database and cannot change data. Filters limit the transfer of recognized identifying data and secrets, but they do not guarantee the anonymity of arbitrary text entered by the user, so do not enter personal data in your questions. Conversation history is linked to the account and the store scope; users can delete their conversations.

In the own API key mode, the customer connects an OpenAI or DeepSeek key and chooses a model. The same information, except for data retrieved from Google Analytics 4 and Google Ads (with a DeepSeek key, Flowask answers without it, see Section 6), is then sent to the chosen provider within the customer's account and under the customer's agreement with that provider, and no Flowask credits are consumed. The agreement with the provider, including the data processing terms and the legal basis for transferring data outside the EEA, is concluded and maintained by the customer. The mere choice of a provider, holding an API key or the provider's publication of a model agreement does not confirm that the appropriate agreements have been concluded.

The place of processing depends on the provider and the API account settings. OpenAI may process data outside the EEA, in particular in the United States; in the default mode, the transfer is based on the safeguards provided for in the data processing agreement with OpenAI. DeepSeek's public policy states that data is processed and stored in the People's Republic of China. Hosting the Flowpeek application in Germany does not cover the AI provider's operations, and using your own API key does not ensure an exclusively European data location. Information about the Flowpeek configuration, the roles of the parties and the safeguards for data transfers is available at support@flowpeek.app.

The history saved in the dashboard is deleted together with its data after the subscription expires. This does not mean that questions, answers or other information already processed by the AI provider are deleted at the same time. Retention and deletion on the provider's side follow from the terms of its service: in the default mode, from the OpenAI API terms for the Flowpeek account, and with the customer's own API key, from the rules and settings of the customer's account with that provider.

We do not make decisions based solely on automated processing that produce legal effects concerning, or similarly significantly affect, people who contact Flowpeek. In a store, Flowpredict may assess behavior and purchase intent, and automations may execute the customer's rules. The store's controller is responsible for the legal basis for such profiling and for providing information about it and its consequences.

8. How long we keep data

The moment a cancellation is submitted does not by itself end access or delete data. The dashboard works until the end of the current billing or trial period. After the subscription expires, the dashboard is blocked for 30 days, during which the customer can recover it. After that time, the dashboard and all data collected in it are deleted, and we keep a copy of the dashboard's database for a further 30 days solely to restore the dashboard at the customer's request, and then delete it permanently.

We treat separately the documents and information that Flowpeek processes as a controller, outside the data of the dashboard being deleted. Their retention requires its own purpose and legal basis; it does not serve to preserve an analytics archive of the store. We apply the following rules:

• Dashboard, account and configuration: available for the duration of an active subscription. After it expires, the dashboard is blocked for 30 days (the customer can recover it) and then deleted together with the saved settings and integration credentials.
• Data collected in the dashboard: traffic, events, orders, profiles, reports and AI conversation history are deleted 30 days after the subscription expires. A copy of the deleted dashboard's database is kept for a further 30 days solely to restore the dashboard at the customer's request, and is then permanently deleted. Make any exports you need before the dashboard is deleted.
• Correspondence and support outside the dashboard: until the matter is closed; where they document an agreement or a dispute, to the extent necessary for the applicable limitation period for claims. We do not retain the store's entire analytics history for this purpose.
• Meetings scheduled in Calendly: we keep booking data for the time needed to hold the meeting and handle the matter it concerns; further arrangements before concluding an agreement are treated as correspondence.
• Website contact form: we keep messages in the form inbox for no longer than 365 days from submission (the exact period is stated next to the form), and older ones are deleted automatically when the inbox is handled and daily by a cleanup job. We may delete a message earlier, once it has been handled. The retention of the form inbox is separate from further correspondence on the matter and from the CRM record.
• Contacts in the CRM system: we keep the form message and contact details as correspondence — until the matter is closed, and if the conversation leads to cooperation, for its duration and the applicable limitation period for claims. Notifications in Google Chat are subject to the retention settings of our Google Workspace account.
• Newsletter: we use the address for sending until you unsubscribe or the newsletter is discontinued. Unsubscribing blocks further sending; limited information about the unsubscription and consent may remain in GetResponse in order to respect the opt-out and demonstrate that we acted lawfully. The local form history on the website server covers the last 90 days; older entries are deleted automatically. This history is not a list of active subscribers. In the event of an erasure request, we also check the data held by the email delivery provider.
• Attempt limits in forms: counters based on a hash of the IP address or email address expire after the protection window (from a few minutes to an hour) and are then deleted.
• Website web server logs: up to 7 days, after which they are deleted automatically.
• Google Analytics 4: user-level and event-level data is retained in Google Analytics for 14 months and then deleted automatically; aggregate statistical reports do not identify individuals. We remember your choice in the cookie banner in your browser for 12 months.
• Flowpeek Tracker: we delete page views and events after about 90 days. The visitor identifier in the browser expires after 12 months, and rejecting consent deletes it immediately.
• GetResponse Web Connect: information about visits remains in GetResponse at most until the contact is removed from the list. Changing your choice in “Cookie settings” stops the collection of new data; you can request deletion of data about earlier visits at support@flowpeek.app.
• Flowpeek billing documents, including invoices for the service: for the period resulting from tax and accounting obligations, calculated according to the rules applicable to the document. Retaining a subscription invoice does not mean retaining the store customers' orders from a deleted dashboard.
• Separate information on security and claims: for the time needed to investigate an incident or to establish and defend claims, to the extent necessary and on an appropriate legal basis. These are not copies of dashboard data that would allow the account to be restored.
• Data processed by Flowpeek as a controller solely on the basis of consent: until consent is withdrawn or the purpose ceases earlier. Proof that consent was given or withdrawn may be retained to the extent necessary to demonstrate that we acted lawfully.
• Data transferred to AI providers and the customer's independent accounts: in Flowask's default mode, the retention period follows from the OpenAI API terms for the Flowpeek account, and with the customer's own API key and in the customer's other services, from their configuration and the customer's agreements with those providers. Deleting the Flowpeek dashboard does not amount to the simultaneous deletion of information on their side.

9. Your rights

You may request access to your data, its rectification, erasure or restriction of processing and, in cases provided for by law, data portability. You may object to processing based on legitimate interest, in particular to direct marketing.

You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it. The scope of individual rights depends on the legal basis and the circumstances — e.g., the obligation to retain a billing document may limit the possibility of erasing it. You can withdraw consent for Google Analytics, Flowpeek Tracker and GetResponse Web Connect via “Cookie settings” in the website footer. You can unsubscribe from the newsletter via the link in the message or by contacting support@flowpeek.app.

Write to support@flowpeek.app, describing your request. We may ask for information necessary to confirm your identity. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland.

10. Updates to this information

We update this policy when the way we process data or the scope of our services changes. The version number and the downloadable document help you keep the text you have read. If a change requires additional information or consent, publishing a new policy does not by itself replace it.