Privacy policy

1. Data controller

The controller of the personal data collected on this website is Techgeneration, Lda.. Privacy contact: hello@flowtooption.com.

2. Data we collect

Contact/demo form: name, email, product of interest and message.

Account creation and subscription: company name, email, tax ID (NIF), country, chosen product and plan, number of users/seats, and selected payment method.

3. Purpose and legal basis

Contact form: explicit consent, given at submission time, to respond to the request.

Account creation: performance of the subscription contract (necessary to provision access to the product and process payment) and compliance with legal (tax) obligations — the tax ID is required to issue an invoice.

4. Sharing data with third parties

Subscribed product: when an account is created, the company name, contact name and email are shared with the chosen product (SignFlow, RoomsFlow, AccountFlow, PassFlow or VenueFlow) to create the corresponding access — each product becomes responsible for the data processed on its own platform.

Payments: depending on the method chosen, payment data is handled directly by Viva Payments (card) or Revolut (Revolut Pay). flowtooption never accesses or stores card numbers.

Invoicing: Moloni processes the data needed to issue invoices and Multibanco payment references (name, tax ID, email, amounts).

Transactional email: access emails, payment references and password recovery are sent via Resend.

Database hosting: Supabase.

Website hosting and delivery: Vercel. It processes every request to the site and retains technical access logs (which may include your email address while you are signed in).

We do not sell data to third parties; sharing is limited to what is necessary to deliver the contracted service.

5. Retention

Enquiries and contact requests: kept for up to 24 months, after which they are deleted automatically.

Customer account data: kept for the duration of the contractual relationship and deleted on request (see section 7).

Fiscal documents (invoices) and payment records: kept for the period legally required under commercial and tax law, even after an erasure request — in that case the record is anonymised and no longer linked to the data subject.

Technical and audit logs: up to 24 months. Password recovery links: 1 hour.

6. International transfers

Some of the processors listed in section 4 are established outside the European Economic Area, namely Vercel (website hosting) and Resend (email delivery), both in the United States.

These transfers rely on the Standard Contractual Clauses approved by the European Commission, entered into with each of these processors.

You may request further information about the safeguards applied by writing to hello@flowtooption.com.

7. Your rights

You may at any time exercise your rights of access, rectification, erasure, restriction and objection, and withdraw consent, by writing to hello@flowtooption.com. You also have the right to lodge a complaint with the Portuguese supervisory authority (CNPD).

8. Security

Access to data is protected by password authentication and by individual, revocable, time-limited sessions restricted to authorised flowtooption operators. Communications with the website are encrypted (HTTPS).