Last updated: 27 July 2026 · Effective: 27 July 2026
This policy explains what Flowral collects, why, who else sees it, and what you can do about it. We've tried to describe the system as it actually is rather than in generalities.
The short version: we collect what's needed to run your workspace and bill you, we don't sell anything to anyone, we don't use your project content for advertising, and we don't train AI models on it.
The data controller is WIINK ApS (CVR 38029142), Ørestads Boulevard 57C, 3. 324, 2300 København S, Denmark. Contact: hello@wiink.io. We are not required to appoint a Data Protection Officer under Article 37 GDPR; data protection questions and requests go to gdpr@wiink.io.
The distinction matters for who you go to about what:
| Category | What exactly | Where it comes from |
|---|---|---|
| Account | Name, email address, profile picture, sign-in provider | You, or the provider you sign in with (Google, Microsoft, WIINK) |
| Credentials | If you use a password, a salted hash — never the password itself | You |
| Workspace | Workspace name and logo, membership and roles, invitations you send | You and your teammates |
| Project content | Flows, tasks, sub-tasks, dependencies, notes, tags, comments, completion state | You and your teammates |
| Attachments | Files you upload to tasks and comments | You |
| Activity | A log of changes — who did what, and when | Generated as you use the app |
| Sessions | A session identifier stored in your browser to keep you signed in | Generated at sign-in |
| Billing | Subscription status, seat count, renewal date, and identifiers issued by Stripe | Stripe |
| Technical | Server logs, including IP address and error diagnostics | Generated automatically |
We never see your card details. Payment pages are hosted by Stripe; card numbers go to Stripe directly and never touch our servers. We store only the customer and subscription identifiers Stripe gives us.
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the Service — running your workspace, storing your flows | Performance of a contract |
| Authentication and keeping accounts secure | Performance of a contract; legitimate interests (security) |
| Taking payment and issuing invoices | Performance of a contract; legal obligation (tax records) |
| Transactional email — invites, sharing notices, billing notices | Performance of a contract |
| Diagnosing faults and preventing abuse | Legitimate interests (a working, secure service) |
| Product updates and marketing email | Consent — and you can withdraw it at any time |
What we don't do: we don't sell personal data, we don't share it with advertisers, we don't use your project content to train machine-learning models, and we don't profile you for automated decisions with legal effects.
We use a small number of service providers ("sub-processors"). Each is bound by contract to protect your data and use it only on our instructions.
| Provider | What they do | Data involved |
|---|---|---|
| Stripe | Payments, invoicing, tax calculation | Name, email, billing address, card details (held by Stripe), tax ID |
| Amazon Web Services | File storage (S3, EU — Ireland) and transactional email (SES) | Attachments you upload; recipient address and content of transactional emails |
| Google · Microsoft · WIINK | Optional single sign-on, only if you choose that method | Your name, email and profile picture, released by them to us at sign-in |
| Google (Analytics) | Website and in-app analytics on flowral.app and platform.flowral.app — only if you accept analytics cookies | Pages and screens visited (with identifiers stripped), approximate location, referring site, truncated IP address, plan and role |
| Amazon Web Services | Application and database hosting (EU — Ireland) | All of the above at rest |
We may also disclose data where legally required — a valid court order, for example — or to establish or defend legal claims. If a business transfer ever occurred, we would tell you before your data became subject to a different policy.
Your data is stored in the EU (Ireland). Some providers may process data outside the EEA; where that happens we rely on the European Commission's Standard Contractual Clauses or an adequacy decision. Google Analytics, which runs only with your consent, involves a transfer to Google LLC in the United States under the EU–US Data Privacy Framework.
Downgrading from Pro to Free deletes nothing. A failed payment deletes nothing.
No system is perfectly secure. If a breach affects your personal data and is likely to put your rights at risk, we will notify the relevant supervisory authority within 72 hours and tell you without undue delay.
If you're in the EEA or UK, you have the right to access your data, correct it, delete it, restrict or object to processing, receive it in a portable format, and withdraw consent where consent is the basis.
Email gdpr@wiink.io and we'll respond within one month. If we're acting as a processor for a workspace you don't own, we'll forward your request to that workspace's owner and support them in answering it.
You also have the right to complain to your local data protection authority — in Denmark, that is Datatilsynet, the Danish Data Protection Agency.
Flowral is deliberately light here. We use no advertising cookies, we run no ad networks, and we never sell or share your data with advertisers.
Strictly necessary — set without asking, because the product cannot work without them:
.flowral.app so that answering once covers both the website and the app, and so we don't ask again on every page. It exists to honour your answer, including a refusal, which is why it is set either way.Analytics — only if you say yes:
/org/:id/flow/:id, never the real ones. What we do record about a signed-in session is your plan (Free or Pro), your role, and a banded seat count.Nothing loads until you accept. No request is made to Google, and no analytics cookie is set, unless you click Accept on the banner. Declining costs you nothing — the site and the app behave identically. You can change your mind at any time from Cookie settings, in the footer of every page, and we ask again once a year regardless. The lawful basis is your consent (Article 6(1)(a) GDPR), which you may withdraw at any time.
A flow can be shared with someone outside the workspace. If you're a guest, we hold your name and email so access can be granted and the person who invited you can see who has access. Guests see only the flows shared with them. The workspace owner controls that sharing — including revoking it.
Flowral is a tool for work and is not directed at children. We don't knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we'll delete it.
We'll update this policy as the product changes. The "last updated" date at the top always reflects the current version, and for material changes we'll notify you by email or in the app before they take effect.
Privacy questions, or to exercise any right above: gdpr@wiink.io, or write to WIINK ApS, Ørestads Boulevard 57C, 3. 324, 2300 København S, Denmark.