Privacy Policy

Effective date: 21 June 2025

1. Controller (Art. 4 No. 7 GDPR)

Flow-IO

Owner: Dipl.-Ing. (FH) Albin Poth

E-mail: support@flow-io.eu

Website: https://www.flow-io.eu

2. General Information on Data Processing

We process personal data exclusively in accordance with applicable laws, including the **General Data Protection Regulation (GDPR)**, the **German Federal Data Protection Act (BDSG-neu)**, and the **German Telemedia Act (TMG)**.

Personal data are only collected and processed where:

* it is technically necessary,

* contractually required, or

* provided voluntarily (e.g. via registration or contact forms).

3. Local Data Processing in the “Flow-IO Manager” Application

The **Flow-IO Manager** application stores all entered data and usage records (such as **company details, invoices, and other user-generated information**) **exclusively on the user’s local computer**. No automatic or continuous transfer of this data to our servers takes place.

To ensure license compliance and prevent abuse (e.g. unauthorized copies), a **temporary connection** to our license server is established when the application starts. During this process, technical identifiers (e.g. MAC address, UUID, hostname, or device fingerprint) are transmitted and checked **solely for the purpose of license validation**. These values are locally not permanently stored.

Users maintain full control over all locally stored data and can change, back up, or delete it at any time.

The application may also use local cookies and session data to enhance user experience:

* A session cookie may be stored when logging into optional modules or features.

* If the “Remember Me” option is enabled, session persistence can last up to two weeks.

* Interface or theme preferences (e.g. dark mode) may be stored for up to one year.

* These local cookies are not shared with any third parties and are stored solely on the user’s device.

Local processing follows the principles of data minimization and privacy by design (Art. 25 GDPR).

4. Processing of Personal Data on Our Servers

When using our website, license portal, or optional cloud features (e.g. the digital cash-book), the following categories of data may be processed:

* User and licence data: e-mail address, username, subscription/licence key

* Authentication data: passwords (stored exclusively as **secure hashes**)

* Usage data: timestamps, software version, frequency of use, activated licences, device identifiers

* System identifiers: MAC address, UUID, hostname – only if needed for licence validation or misuse prevention

* IP addresses: for security-related operations (e.g. login attempts, changes to account settings)

* Payment data: PayPal transaction ID, subscription ID (we do not store bank or credit card data)

* Optional module content (e.g. cash-book): entered data is stored encrypted on our servers; passwords are hashed and cannot be viewed

Purposes of processing:

* Contract fulfillment and license enforcement

* Provision of optional features

* Misuse detection and IT security

* Technical support and error analysis

* Product development and improvement

Legal bases:

* Art. 6 (1) (b) GDPR – necessary for the performance of a contract

* Art. 6 (1) (f) GDPR – legitimate interests (e.g. preventing abuse, service security)

5. Cookies

We use cookies only where necessary. These include:

| Purpose                           | Duration                      | Notes                                |

| --------------------------------- | ----------------------------- | ------------------------------------ |

| **Comment form entries**          | 1 year                        | Name, e-mail, and website (opt-in)   |

| **Session cookies**               | Until logout or browser close | Required for login and functionality |

| **“Remember Me” login**           | 2 weeks                       | Optional extension of login session  |

| **Display preferences (e.g. UI)** | Up to 1 year                  | Stored locally, never shared         |

| **Consent cookie**                | 12 months                     | Stores cookie banner decision        |

6. Embedded Third-Party Content

This site may use **embedded content** (e.g. YouTube videos, Google Maps).

To protect your privacy, embedded content is only loaded after your **active consent** via a **two-click solution**.

Once activated, these providers may collect personal data under their own responsibility, including:

* IP address

* Cookies and trackers

* Your interactions with the embedded content (if logged into the third-party provider)

7. Hosting and Data Processing on Our Behalf

Our infrastructure is hosted by DomainDiscount24 / Key-Systems GmbH, based in Germany.

A data processing agreement according to Art. 28 GDPR is in place.

All data transfers are encrypted using SSL/TLS protocols.

8. Comment Functionality

If you submit a comment, we store:

* the information you entered (name, e-mail, message),

* your IP address, and

* your browser’s user agent string (for spam protection).

If you use **Gravatar**, an anonymised hash of your e-mail address may be sent to Gravatar (see: [https://automattic.com/privacy](https://automattic.com/privacy)).

Once your comment is approved, your profile image may appear publicly next to your comment.

9. Data Retention Periods

| Data Type                             | Retention Period                        |

| ------------------------------------- | --------------------------------------- |

| Contractual and billing data          | 10 years (legal obligations)            |

| Licence and usage data                | 12 months after termination             |

| Optional module data (e.g. cash-book) | Until user deletion or account closure  |

| Comments                              | Until user deletion request             |

| Server logs                           | Max. 7 days (based on hosting provider) |

| IP addresses (security-related)       | Up to 90 days                           |

10. Your Rights Under the GDPR

You have the right to:

* Access your personal data (Art. 15 GDPR)

* Rectify incorrect or incomplete data (Art. 16 GDPR)

* Delete your data ("right to be forgotten", Art. 17 GDPR)

* Restrict processing (Art. 18 GDPR)

* Data portability (Art. 20 GDPR)

* Object** to processing based on legitimate interest (Art. 21 GDPR)

To exercise any of these rights, please contact us at: support@flow-io.eu

We will respond within the legally required timeframe.

11. Changes to This Privacy Policy

We may update this privacy policy to reflect legal, technical, or organizational changes.

The latest version is always available at:

🔗 https://flow-io.eu/en/datenschutzerklarung.html

Last updated: 21 June 2025