Draft: this text is not final yet.
Privacy Policy
Last updated: 2026-11-05
This Privacy Policy explains how [company legal name not set], [registered address not set] ([company registration / vat number not set]) ("we", "us") handles personal data in connection with FlowCall: our website https://flowcall.si, the customer area https://app.flowcall.si, the agent studio, the website widget and the voice and chat agents our customers build (together, the "Service"). It is our only privacy policy and covers both the website and the application.
1. Two roles
- We are the controller for data about our customers and their users (accounts, purchases, support, billing, security) and about visitors to our website.
- Our customers are the controllers for the data their agents handle: the people who call or chat with an agent, the contacts in their call lists, their website visitors and the content they upload. We process that data only on their behalf and on their instructions, under the data processing terms in section 11 of our Terms of Service. If you talked to an agent built by one of our customers, that business is responsible for your data; please contact them first. We will pass your request on if you contact us.
2. Data we collect
When you buy or redeem a licence code. Your name, email address, what you bought, order and transaction numbers, the date, refund or chargeback status, and the affiliate or partner who referred you. Payments are handled by our checkout partner LaunchpadJV; we never receive your card details.
Your account. Name, email address, password (stored only as a secure hash), two-factor sign-in settings, your workspaces and team members, your settings and brand choices, your minute balance and its history, and messages you send to support.
Use and security data. IP address, browser and device information, sign-in times, pages and features used, error logs, and a record of administrative actions on your account. The bot protection on our forms checks the browser to tell people from automated traffic.
Content in the studio (processed for our customers). Agent instructions and settings, documents uploaded to the knowledge base, call lists and their columns (for example names and phone numbers), connections to third-party accounts (their access keys are stored encrypted), and the data created when agents talk to people:
- call and chat recordings and transcripts;
- caller or recipient phone numbers, call times, durations and results;
- details the agent collects during the conversation (for example a name, an appointment time or a reason for calling);
- for the website widget: the visitor's voice, IP address and the page the widget was opened on; for the "call me back" form: name, phone number and the consent given.
Website visitors. We count visits and clicks on our sales pages without identifying you; the referring affiliate or campaign travels in the link, not in a cookie. Analytics or advertising tags run only if you accept them in the cookie banner. See our Cookie Policy.
We do not ask for and do not want special categories of data (such as health, religion or financial account data) or identity documents. Customers must not use the Service to collect such data unless the law allows it and they have taken the necessary measures.
3. Why we use it and our legal basis
| Purpose | Legal basis (EU/UK GDPR) |
|---|---|
| Create and run your account, deliver what you bought, apply your minutes and plan limits | Performance of our contract with you |
| Process purchases, refunds, chargebacks and licence codes; keep accounting records | Contract; legal obligation |
| Send service emails (welcome, password, security, changes to the Service or terms) | Contract; legitimate interest |
| Support, troubleshooting and improving the reliability of the Service | Legitimate interest |
| Protect the Service: bot protection, fraud and abuse prevention, outbound call safety rules, logs | Legitimate interest; legal obligation |
| Send product news and offers to customers | Legitimate interest for similar products (you can opt out at any time); consent where the law requires it |
| Analytics and advertising on our website | Consent (cookie banner) |
| Comply with the law and enforce our terms | Legal obligation; legitimate interest |
| Process customers' content and conversations | On our customers' instructions (we are their processor) |
We do not sell personal data, and we do not use customers' content or conversations to train AI models.
4. AI processing
To run an agent, the caller's speech is converted to text, the text is sent to an AI language model that writes the agent's reply, and the reply is turned back into speech. Documents in the knowledge base are converted into search data so the agent can answer from them. These steps are performed by specialised technology providers acting as our sub-processors under contracts that do not allow them to use the data for their own purposes or to train their models. The agent's answers are produced automatically; they are not decisions about you with legal or similarly significant effects made by us.
5. Who receives data
- Service providers (processors): hosting and storage; speech recognition, AI language model and speech synthesis providers; email delivery; bot protection; our checkout partner LaunchpadJV; and the email marketing tool we use for customer emails. A list of our sub-processors is available on request at [contact email for legal and privacy requests not set].
- Services you connect: when you connect a phone carrier, calendar, CRM or webhook, we send it the data needed for that connection (for example a phone number and call audio to your carrier, or a booking to your calendar). The connected service handles that data under its own terms.
- Agencies and resellers: if your workspace is managed by an agency, or you redeemed a reseller's licence code, that agency or reseller can see your workspace or your usage as their plan allows.
- Authorities and advisers: when the law requires it, to protect rights and safety, or to our lawyers and accountants.
- A buyer of our business, if we sell or merge it, under the same protections as this policy.
6. International transfers
Some of our providers are located outside the European Economic Area, in particular in the United States. Where a country does not have an adequacy decision, we use the European Commission's Standard Contractual Clauses and additional safeguards where needed. You can ask us for a copy at [contact email for legal and privacy requests not set].
7. How long we keep data
- Account and purchase data: while your account is open; after closing, we delete it within 30 days, except records we must keep by law (such as accounting records, kept for the period the law requires).
- Recordings, transcripts and other studio content: until the customer deletes them (or asks us to) or closes the account, and then within 30 days.
- Security and system logs: up to 12 months; the record of administrative actions on an account: while the account is open.
- Backups: encrypted backups are kept for about 60 days and then overwritten; deleted data disappears from them within that time.
- Website statistics: counts without personal data, kept as long as useful.
- Marketing: until you opt out or the customer relationship ends.
8. Security
We use encrypted connections, store passwords only as hashes and third-party access keys encrypted, limit and log administrative access, require two-factor sign-in for staff, keep the servers patched, and take encrypted daily backups. No system is completely secure; if a personal data breach puts you at risk, we will inform you and the authorities as the law requires.
9. Your rights
Depending on where you live, you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct it;
- delete it;
- restrict or object to how we use it, including at any time to direct marketing;
- give you your data in a portable format;
- withdraw a consent you gave, without affecting earlier processing.
Write to [contact email for legal and privacy requests not set]. We answer within one month and may need to confirm your identity. You also have the right to complain to a data protection authority, in particular in the EU country where you live or work, or where an infringement took place.
California residents have the right to know what personal information we collect, use and disclose, to request deletion and correction, and to opt out of the sale or sharing of personal information. We do not sell or share personal information for cross-context behavioural advertising without consent, and we will not treat you differently for using your rights. Use the contact above to make a request; an authorised agent may make it for you.
If your request concerns a conversation with an agent run by one of our customers, we will help that customer answer it.
10. Children
The Service is for businesses and is not directed to children. Customer accounts require a minimum age of 18. We do not knowingly collect data from children under 16; if you believe we have, contact us and we will delete it.
11. Changes
We may update this policy. Material changes are announced by email or in the customer area before they apply. The date at the top shows the latest version.
12. Contact
[company legal name not set], [registered address not set]. Email for privacy questions and requests: [contact email for legal and privacy requests not set].