Privacy Policy
Last updated: 21 August 2026
1. Who we are
| Company name | Flowtask, S.L. |
| Tax ID (NIF) | B75726810 |
| Registered office | Avda. Reyes Católicos 31, planta 3, Edificio Ceres · 38005 Santa Cruz de Tenerife (Spain) |
| Privacy contact | info@flowtask.ai |
Flowtask is a cloud-based work management platform for professional use, contracted by organisations. It includes artificial intelligence features and allows messaging channels (email, WhatsApp, Telegram) to be connected so that an organisation can serve its own correspondents from within the platform.
2. Two different roles, and why they matter to you
Depending on the data in question, Flowtask acts in one of two capacities:
As controller. For data we process on our own initiative: visitors to our website, people who write to us or request information, those who administer or are billed for a customer account, job applicants, and the minimum technical data we need to operate the service securely.
As processor. For everything a customer organisation enters or generates within its workspace on the platform: data about its employees, its customers and contacts, its documents, its conversations and those of its external correspondents. There, the controller is the customer organisation, not Flowtask: the organisation decides what those data are used for and on what legal basis, and we process them following its instructions and the data processing agreement signed with it.
If you are an employee of an organisation that uses Flowtask, or a customer, supplier or correspondent of that organisation, and you wish to exercise your rights over your data, the route is that organisation. We cannot make decisions about your data on our own account. If you write to us, we will forward your request to whoever is responsible and let you know.
3. Data we process as controller
| Who | What datas | Purpose | Legal basis |
|---|---|---|---|
| Website visitor | IP address, browsing data and cookies | To make the website work and measure its use | Legitimate interest (operation) and consent (analytics and non-essential cookies) |
| Person who contacts us | Name, email, telephone, company, message content | To handle the request and follow up commercially | Pre-contractual measures at the data subject’s request; legitimate interest in B2B prospecting |
| Newsletter subscriber | Email and preferences | To send product information | Consent, revocable at any time |
| Contact person at the contracting customer | Name, position, email, telephone, billing details | To manage the contract, invoice and provide support | Performance of the contract and legal obligation (tax and accounting) |
| User raising a support request | User identifier, tenant and content of the query | To resolve the request | Performance of the contract with their organisation; legitimate interest |
| Job applicant | The data in their application | The data in their application | Pre-contractual measures; consent to retain it for future processes |
The platform does not collect card or bank account details. Billing data is limited to what is needed to issue the invoice.
4. Data we process as processor: the platform
When your organisation uses Flowtask, the platform stores and processes the content it chooses to put in. For transparency, these are the actual categories:
- Users of the organisation: first and last name, username, email, telephone and extension, profile picture, job title, contract type, identification number, organisational unit and permissions. Depending on the customer’s configuration, also hourly cost and time allocation — in practice, sensitive employment information, even though it is not a special category under Article 9 GDPR.
- The customer’s contacts and companies: name, email, telephone, WhatsApp number, Telegram identifier, identification number, address, position and department.
- Work content: activities, projects, tickets, forms, notes and comments. These are free-text fields: they may contain any category of data the organisation chooses to enter, including special categories. It is for the organisation to decide what it enters and on what legal basis.
- Documents and attachments uploaded by users.
- Voice recordings and their transcriptions, where the organisation uses the recording feature in the mobile application.
- Communications: emails, messages and conversations managed from the platform, including those of third parties who write to the organisation through a connected channel.
Full details — categories, purposes, security measures, sub-processors, retention periods and return of data — are set out in the data processing agreement that forms part of the contract with each customer. Any customer may request it.
5. Connected messaging channels (WhatsApp, Telegram, email)
This section describes the processing that takes place when a customer organisation connects a messaging channel to Flowtask, and is the section relevant to anyone who writes to us without being a user of the platform.
What happens. The customer organisation connects its own WhatsApp Business number, its Telegram bot or account, or its email mailbox. From then on, the messages it receives through those channels enter its Flowtask workspace, where its team reads, organises and answers them.
What is stored about the sender: the content of the message and its attachments, the public name or alias shown by the channel, the technical identifier of the conversation on that channel (telephone number, chat identifier, email address) and the date and time. If that identifier matches a contact the organisation already had on record, the message is linked to it.
PWhat it is used for: solely so that the recipient organisation can read, manage and answer that communication, and to retain the conversation history. It is not used for advertising, it is not disclosed to third parties for their own purposes, and it is not sold. It is not used to train artificial intelligence models.
Who the controller is: the organisation you wrote to. Flowtask is its processor. The channel operators (Meta for WhatsApp, Telegram, Microsoft or Google for email) also process those messages under their own terms; in the case of the WhatsApp Business Platform, Meta likewise acts as processor for the organisation.
Your rights: Please contact the organization you wrote to. If you’re not sure how, you can write to us, and we’ll tell you who to contact or forward your request.
Retention: As long as the organization keeps the conversation on its platform, in accordance with its own policy. Meta retains messages from the Cloud API on its systems for up to 30 days.
6. Artificial intelligence
Flowtask incorporates artificial intelligence features into specific use cases: a conversational assistant, agents that execute workflows configured by the customer, task breakdown suggestions, voice transcription, document reading, semantic search, inbox categorization, and agents that converse via external channels.
What is sent to the model provider. In response, these systems send the configured model provider the query content and the context needed to resolve it, including relevant excerpts from the organization’s knowledge base. No credentials, secrets, or data from other organizations are transmitted: each client environment is isolated.
Training. We do not train models using our customers’ data. We contract with model providers under terms that prohibit the use of API content to train their models; the specific providers and their locations are listed in Section 7. The client organization may configure a provider other than those we have evaluated in its workspace: in that case, the relationship with that provider and its data processing terms are the responsibility of the organization.
Where it runs. The embeddings for semantic search and part of the processing are run on our own infrastructure. The rest is run on the providers listed in section 7, in European regions.
The person decides. No output from our systems that affects an identified individual’s employment status, performance evaluation, or work assignment is implemented without human confirmation. We do not use biometric identification or categorization, emotion recognition of employees, social scoring of individuals, or automated decisions regarding hiring, retention, or compensation.
Transparency. When you interact with a Flowtask artificial intelligence system, you are notified of this, and every automated conversation provides a way to reach a person.
7. Who We Share Data With
We do not sell personal data or share it with third parties for their own purposes.
The providers listed below have access to data in their capacity as data processors or subprocessors, and solely for the purpose of providing the service. This is a closed list: if we add a new provider, we will notify our client organizations thirty days in advance, and they may object.
Infrastructure
| Provider | Purpose | Where the data is processed |
|---|---|---|
| Itop Management Consulting, S.L. (Spain) | Manages and operates the platform’s infrastructure | Spain |
| Microsoft Ireland Operations Ltd. — Azure | Servers, database, storage, and copies | Netherlands, with Ireland as the backup region |
Artificial Intelligence Models
Artificial intelligence features are enabled on an organizational basis. Models are deployed in two ways: open-source models on our own infrastructure—in which case the data never leaves the platform and no additional providers are involved—and third-party models that we access through our cloud providers, which are always configured in European regions.
| Provider | Purpose | Where the data is processed |
|---|---|---|
| Microsoft Ireland Operations Ltd. — Azure OpenAI | OpenAI models: conversation, image analysis, and text recognition | European Union (EU Data Zone) |
| Amazon Web Services EMEA SARL — Bedrock | Anthropic Models (Claude): Conversation and Analysis | Germany (Frankfurt) |
| Google Cloud EMEA Ltd. — Vertex AI | Gemini Models: Conversation and Image Analysis | European Union |
| Open-source models on our infrastructure | Conversation, audio transcription, and document reading | Netherlands — data never leaves the platform |
If a client organization decides to run the models on its own servers, the data does not leave its systems, and Flowtask does not intervene in that processing. And if an organization requests to use a provider other than the ones listed above, that provider is specified in its own contract, not here.
Messaging channels that every organization connects to
| Provider | Purpose |
|---|---|
| WhatsApp Ireland Ltd. | Messages from the organization’s WhatsApp Business number |
| Telegram Messenger, Inc. | Messages from the bot or the organization’s account |
| Microsoft Ireland Operations Ltd. — Graph | Reading and sending messages from the organization’s mailbox |
| Google Ireland Ltd. — Gmail | Reading and sending messages from the organization’s mailbox |
| The mail or messaging server that the organization configures | Sending and receiving via its own systems |
Support, Measurement, and Corporate Website
| Provider | Purpose | Where the data is processed |
|---|---|---|
| Functional Software, Inc. doing business as Sentry | Application Error Log | Stored in Germany; processing outside the EEA based on standard contractual clauses |
| OVH SAS | Web Hosting flowtask.ai | France |
| Google Ireland Ltd. | Web analytics, form protection, fonts, and maps | Outside the EEA, under the EU-U.S. Privacy Shield Framework |
| Complianz B.V. | Cookie Consent Management | Netherlands |
Contact forms on the website are not sent to any third-party CRM; they are managed within the Flowtask platform itself.
In addition, we may disclose data to the authorities when there is a legal obligation to do so.
8. International Transfers
The platform is hosted entirely within the European Economic Area: the servers are located in the Netherlands, with Ireland serving as a paired region for redundancy. However, some of our vendors process data outside the European Economic Area, primarily in the United States—notably providers of artificial intelligence models. When this occurs, the transfer is covered by one of the following safeguards: standard contractual clauses approved by the European Commission, or the provider’s certification under the EU-U.S. Privacy Shield Framework. The safeguard applicable to each provider is indicated in the list of subprocessors.
9. How long we keep data
As data controllers: business contact information, for as long as a business relationship or interest exists and until you object; customer information, for the duration of the contract and thereafter for the duration of the statutory limitation periods (six years for commercial and accounting matters); job applications, for the duration of the hiring process and, if you consent, for up to one additional year.
As data processors: The data on the platform is retained for as long as the contract with the organization remains in effect. Upon termination of the contract, and in accordance with the data processing addendum, the data is returned or deleted as instructed by the organization.
The platform uses soft deletion: when a user deletes an item, it is no longer accessible but remains in the database, allowing it to be recovered and ensuring traceability. Permanent deletion occurs at the end of the contract, when the organization’s storage space is deleted.
10. Safety
We implement appropriate technical and organizational measures: encryption in transit (TLS), authentication via an identity provider using OIDC and PKCE, data isolation by organization, permission-based access control, an audit log of changes, and encryption of credentials for external connections. We are implementing management systems compliant with ISO/IEC 27001, ISO/IEC 42001, and the National Security Scheme; until we obtain the certificates, this is an ongoing process and not a current certification.
11. Your Rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing, and data portability, as well as withdraw any consent you have provided and object to automated decision-making, by writing to info@flowtask.ai or to our business address. We will ask you to verify your identity.
If your request concerns data that we process on behalf of a client organization, we will forward it to that organization and notify you, since it is the organization that makes decisions regarding that data.
You have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid) if you believe your rights have not been respected.
12. Minors
Flowtask is a professional service contracted by organizations and is not intended for minors. We do not knowingly collect data from minors.
13. Cookies
The use of cookies and similar technologies on flowtask.ai is described in our cookie policy, which can be accessed from the bottom of the website, where you can adjust your preferences at any time.
14. Changes to This Policy
We may update this policy to reflect changes to the service or to regulations. We will post the current version at this same address, along with the date of the last update. If the change is substantial, we will notify customers through our usual channels.
This English text is a translation provided for convenience. The Spanish version, available at flowtask.ai, is the binding version; in the event of any discrepancy between the two, the Spanish version prevails.