We're glad you're here, and we take data protection seriously. This page explains what personal data we collect when you use our website and the FlowMate platform, why we collect it, and what rights you have.
Last updated: 29 October 2026
For how we protect data and for our Data Processing Agreement, see our Trust Center. This policy covers personal data we process as the controller, such as website, account, and marketing data. Data your automations handle belongs to you, and for it FlowMate acts as your processor under our Data Processing Agreement.
This page belongs to FlowMate GmbH, a company under German law headquartered in Cologne.
Responsible body within the meaning of the GDPR:
If you have questions about data protection concerning our website or platform, contact us any time by phone or email.
When you access our website, information of a general nature is automatically collected (server log files): browser type, operating system, and the domain name of your internet service provider. This information does not allow conclusions about your identity. It's technically necessary to deliver the site correctly and is evaluated anonymously and statistically to help us improve the site (Art. 6(1)(f) GDPR). Our hosting provider keeps this log data only as long as needed for delivery and security. Webflow uses content delivery networks, including Cloudflare, to deliver our website. These providers process your IP address for this purpose.
We use state-of-the-art encryption (HTTPS/SSL) to protect your data in transit.
Your account. When you register for FlowMate on our website (flowmate.io/signup), we collect account data such as name, work email, company name, and role. We use it to create and run your account, to send service emails such as the confirmation of your email address, and to provide support (Art. 6(1)(b) GDPR). FlowMate accounts are free and stay active until you delete them. Once you have an account, you use the platform at app.flowmate.ai, where you can view, change, or delete the data you provided at registration at any time from your account settings.
Customer relationship and support. Your registration data is also stored in our CRM (Pipedrive) so we can manage our relationship with you (Art. 6(1)(f) GDPR). To provide support and service messages, your account data is also transferred to Intercom, our customer communication tool (Art. 6(1)(b) GDPR).
Public professional information. To understand who uses FlowMate and to make our communication relevant, we may manually look up publicly available professional information about you, such as your job title, company, and professional background on your public LinkedIn profile, and store it in our CRM (Pipedrive). The legal basis is our legitimate interest in relevant, professional communication with our users (Art. 6(1)(f) GDPR). You can object at any time by emailing privacy@flowmate.io.
Product tips and incentives. If you tick the checkbox at signup, we also send you product tips and incentives by email, based on your consent (Art. 6(1)(a) GDPR). We send these emails through Pipedrive. You can withdraw your consent at any time via the unsubscribe link in every email or by emailing privacy@flowmate.io.
Data your automations handle. The data your flows handle, the content of activity logs, and the credentials of the apps you connect belong to you. For this data FlowMate acts as your processor under our Data Processing Agreement, which governs it. So you know what to expect: flow data is processed in transit and is not stored afterward, credentials are stored encrypted until you disconnect an app or delete your account, activity logs are kept for 30 days and then deleted automatically, and if a flow includes an AI step, the data of that step is sent to the AI provider, which keeps it for a limited period under its own rules (see section 5).
Depending on whether a flow is set to Automated, Assisted, or Supervised, some of this processing happens without a human reviewing each individual action; Supervised flows require your explicit approval before execution. We do not use your data to train third-party AI models beyond what's required to run the specific automation you've configured. Stricter rules apply to Google user data, see section 5a.
Paid plans are billed through Stripe (Art. 6(1)(b) GDPR). We do not store full card details ourselves. Stripe processes payment data under its own privacy policy: https://stripe.com/privacy
Claude, ChatGPT, and Gemini are the AI platforms FlowMate operates inside. When you use FlowMate through one of these platforms, the relevant provider (Anthropic, OpenAI, or Google) processes the prompts, context, and outputs involved in that session, under its own privacy terms. FlowMate's automation logic runs on top of this and receives only the data needed to execute the flow you've configured.
FlowMate's AI agent step. If you use FlowMate's AI agent step, the data of that step is sent to Anthropic's Claude API, which processes it on our behalf. Anthropic's commercial terms prohibit it from training its models on this data, and we have not opted in to any training program. Anthropic keeps API inputs and outputs for a limited period under its own retention rules. The AI providers we use for this step may change over time. You can also connect an AI provider of your own choice, such as the Claude API with your own key. In that case, the provider's own terms apply.
When you connect a Google account to FlowMate, we access only the Google data covered by the permissions (scopes) you grant, and only to run the automations you configure.
FlowMate's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.
Which Google data FlowMate can access depends on the Google services you connect and the permissions you grant. These include Google Calendar (your calendar list, events, and free/busy times), Google Sheets, Google Docs, and Google Slides (the spreadsheets, documents, and presentations you choose), Google Forms (forms and their responses), Google Contacts (your My Contacts list), Google Tasks (tasks and task lists), and basic account details (your email address and account ID) to show which Google account a connection belongs to. Access to Google Drive is limited to files created or opened through FlowMate.
When you connect a Google account, we store the access credentials (OAuth tokens), encrypted, together with the account details named above, so the connection keeps working. We do not store the Google data your automations handle, apart from activity logs as described below.
In particular:
We use Google user data only to provide the user-facing automation features you have set up.
FlowMate does not use Google user data, whether raw, aggregated or derived, to develop, improve or train generalized AI or ML models.
FlowMate's default AI agent step runs on Anthropic's Claude API under our own commercial account. Anthropic's commercial terms prohibit it from training its models on this data, and we have not opted in to any training program or submitted customer content as feedback. Anthropic keeps API inputs and outputs for a limited period under its own retention rules.
If you connect an AI provider of your own choice, or use FlowMate tools to fetch Google data into an AI platform you use (see section 5), that data is passed to the provider you chose, at your direction. FlowMate does not control how that provider uses data, so please check its terms. FlowMate does not send Google user data to an AI provider unless an automation you set up or run does so.
We do not sell Google user data, and we do not use it for advertising.
We transfer Google user data to others only to provide the features you requested (for example, to the AI platform you use FlowMate with, at your direction, and to the infrastructure providers that host FlowMate, see section 9), for security purposes, or where the law requires it.
Access to activity logs, which can contain Google user data, is limited to a small number of FlowMate team members. Our internal rule is that they do not read Google user data unless you ask us to look at specific data (for example in a support request), it is necessary for security purposes, or the law requires it.
Data a flow handles is not stored after the flow runs. Activity logs can contain Google user data that a flow processed, and are deleted automatically after 30 days. If an AI step is involved, the provider keeps the data for a limited period under its own rules.
When you disconnect a Google account in FlowMate or delete your FlowMate account, we delete the stored access tokens and the account details stored with the connection. To also withdraw the permission at Google, you can remove FlowMate in your Google Account permissions at any time.
Questions: privacy@flowmate.io
Service emails. We use Brevo (formerly Sendinblue SAS, 17 rue de Salneuve, 75017 Paris, France) to send service emails, for example to confirm your email address or to notify you about your account. These emails are necessary to provide the service (Art. 6(1)(b) GDPR). Product tips and incentives are covered in section 3.
Newsletter. You can receive our newsletter by entering your email address in the newsletter form on our website. This is separate from creating a FlowMate account. When you submit the form, the data you enter is transmitted to us, together with your IP address and the date and time of submission. Brevo manages the mailing list and sends the newsletter. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time via the unsubscribe link in every newsletter or at privacy@flowmate.io. We use double opt-in: we log the form submission, the confirmation email, and your confirmation, to make sure the address belongs to you.
If you contact us or book a demo, the information you provide is stored to process your request and any follow-up (Art. 6(1)(b) and (f) GDPR). We use Calendly to schedule demo bookings, and your request is also stored in our CRM (Pipedrive). This data is not passed to other third parties without your consent.
We use essential cookies to run the website and the platform, such as login and session cookies. These do not require consent.
Our consent tool, Cookiebot (Usercentrics A/S, Denmark), asks for your choice when you first visit and stores it. You can change or withdraw your choice at any time via the cookie settings on our website.
Only with your consent, we load Google Tag Manager, which we use for analytics (Google Analytics) and advertising (Google Ads), and the LinkedIn Ads Insight Tag. We also load the Intercom chat widget, on our website and in the platform, only after you consent. The legal basis is your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG). Without your consent, these tools do not load.
Beyond the tools named above, we work with:
Webflow, Inc. (398 11th Street, 2nd Floor, San Francisco, CA 94103, USA) - website hosting
Cloudflare - content delivery for our website, through Webflow
Google Cloud - hosting of the FlowMate platform in Frankfurt, Germany
MongoDB Atlas - database hosting for the FlowMate platform, in Frankfurt, Germany
Anthropic Ireland, Limited - AI model provider for FlowMate's AI agent step, currently Claude (see section 5)
Brevo (see section 6) - service emails and newsletter
Pipedrive (Pipedrive OÜ, Mustamäe tee 3a, 10615 Tallinn, Estonia) - customer relationship management, used to track registrations, leads, demo requests, and sales conversations, and to send product tips and incentives to people who consented
Intercom R&D Unlimited Company (2nd Floor, Stephen Court, 18-21 St. Stephen's Green, Dublin 2, Ireland) - customer support chat and service messages
Calendly LLC (115 E Main St, Ste A1B, Buford, GA 30518, USA) - scheduling of demo bookings
Usercentrics A/S (Cookiebot) - cookie consent management
Google and LinkedIn - analytics and advertising measurement, only after your consent (see section 8)
We don't sell personal data, and only disclose it beyond the above where legally required or with your consent.
Some providers, including Webflow, Cloudflare, Calendly, Intercom, Google, LinkedIn, and the US-based AI platforms named in Section 5, process data outside the EEA. Where this happens, we rely on the EU Commission's Standard Contractual Clauses, an adequacy decision, or another valid GDPR Chapter V transfer mechanism. Contact us for details of the specific safeguards in place for a given provider.
Where we rely on your consent, the legal basis is Art. 6(1)(a) GDPR. Where processing is necessary to perform a contract with you, it's Art. 6(1)(b). Where we're under a legal obligation, it's Art. 6(1)(c). Where processing serves a legitimate interest of ours or a third party, it's Art. 6(1)(f).
We store personal data only as long as necessary for the purposes stated here, or as required by statutory retention periods. In particular:
Account data: kept until you delete your account. FlowMate accounts are free and have no expiry date.
Activity logs: deleted automatically after 30 days.
Backups: platform backups are kept for up to 7 days, so deleted data can remain in a backup for that period.
Website server logs: kept by our hosting provider only as long as needed for delivery and security.
Newsletter data: kept until you withdraw your consent.
Cookie consent choices: stored by Cookiebot for as long as needed to prove your consent.
Data in our CRM, support, and email tools: kept until you ask us to delete it. We delete it within one month of your request.
After the purpose lapses or a statutory retention period expires, data is routinely blocked or deleted.
We're active on LinkedIn: https://www.linkedin.com/company/flowmate. If you interact with us there, LinkedIn processes data under its own privacy policy: https://www.linkedin.com/legal/privacy-policy. Data collected on LinkedIn may be transferred outside the EEA under LinkedIn's own safeguards.
You have the right to:
Request access to the personal data we hold about you
Request correction of inaccurate data
Request deletion, unless a legal retention obligation applies (in which case we'll block rather than delete)
Object to or restrict certain processing
Receive the data you provided to us in a common, machine-readable format (data portability), where applicable
Withdraw consent at any time, without affecting processing carried out before withdrawal
Lodge a complaint with a supervisory authority
You can also view, change, or delete your account data yourself at any time from your account settings. To exercise any other right, email privacy@flowmate.io. We aim to respond within one month, extendable by a further month in complex cases, per GDPR's statutory timeline.
We may update this policy to reflect current legal requirements or changes to our services, for example when we launch new integrations or platforms. The updated version applies from your next visit.
© 2026 FlowMate GmbH, Cologne. All rights reserved.
