Privacy Policy

Last updated 14 August 2026

1. Who is responsible

Flowzivo is operated by ITG Suisse Sagl, Corso Elvezia 25, 6900 Lugano, Switzerland. For any question about this policy or your data, write to hello@flowzivo.com.

2. What we collect

• Your account: email address and an encrypted form of your password. We never see or store your password in readable form — authentication is handled by our database provider.
• Your workspace: everything you enter in the app — your business details, clients, quotes, invoices, time entries, contracts, expenses and settings. This may include personal data about your own clients, which you enter and control.
• Your bank details, and what we do not do with them: if you enter an IBAN, BIC/SWIFT or a payment link, they are stored in your workspace for one reason only — they are printed on the invoices you issue, so that your clients can pay you directly. We never share them, we never pass them to a third party, and Flowzivo never uses them to initiate, request or receive a payment of any kind. They are visible only to you and to the people you send your own invoices to.
• Your subscription: if you subscribe, our payment provider assigns you a customer reference which we store, together with your plan status and renewal date. We never see or store your card number: the card is entered on the payment provider's own pages.
• Usage: one record per day on which your account was active, so we can see whether the product is being used. It contains no page addresses and none of your document contents.
• Where you came from: if you reach us by clicking an advertisement, the advertising platform adds an identifier to the link. If you then create an account, that identifier is saved with your account so we can tell which advertisement brought a real customer. Nothing is stored on your device for this, and if you do not create an account the identifier is simply forgotten when you close the page. It says nothing about you and is not used to build a profile or to follow you elsewhere.
• Technical minimum: our hosting and database providers log request metadata (including IP address) for security and abuse prevention.

The only data stored in your browser by default is your own workspace and your session. The advertising identifier described above is never written to your device: it is kept in the page while you are on it and, if you sign up, saved with your account on our server.

Measurement cookies — only if you agree

We use two Google measurement tags: Google Ads (AW-18386034848), to understand which advertisements bring people to Flowzivo, and Google Analytics 4 (G-5D50LCBV3Y), to see which pages are read and where visitors give up. Both are governed by the same consent:

• Nothing is loaded before you choose. On your first visit the tag is not downloaded and no advertising cookie is written. Google Consent Mode is set to denied for advertising and analytics storage until you accept.
• If you decline, your browser never contacts Google on our behalf, and your choice is remembered. Declining changes nothing about how Flowzivo works — no feature is withheld.
• If you accept, the tags are loaded and Google may set cookies on your device to attribute a conversion to an advertisement and to measure how the site is used. Analytics data is collected in aggregate and is not used to build an advertising profile of you on our behalf. Google acts as an independent controller for that data; see the Google privacy policy.
• Changing your mind: clear this site's data in your browser settings, or write to hello@flowzivo.com and we will explain how.

Neither tag runs inside your workspace: they are on the public site only, and they never see your clients, invoices or documents. The legal basis for these cookies is your consent (Art. 6(1)(a) GDPR and the corresponding Swiss provisions). Everything else on this page happens without cookies and without your consent being required, because it is either necessary to provide the service or based on our legitimate interest in keeping it secure.

3. Why we may process it (legal basis)

• Performance of a contract: to give you the account and the service you asked for.
• Legitimate interest: to keep the service secure and prevent abuse.
• Legal obligation: where we must keep records or respond to lawful requests, including retaining billing records for the periods Swiss and EU accounting rules require.

This covers the EU/EEA GDPR and the Swiss Federal Act on Data Protection (nFADP/nLPD).

4. Your clients' data

When you enter data about your own clients, you are the controller of that data and Flowzivo acts as your processor: we store and return it on your instruction, and we do not use it for any other purpose. You are responsible for having a lawful basis to process your clients' data, and for informing them as your own local rules require.

5. Who else is involved

• Supabase — authentication and database hosting, in the European Union.
• Stripe — payment processing and subscription billing. Stripe receives your email address and your payment details, which it processes as an independent controller under its own privacy policy.
• Netlify — serving the website itself.
• Resend — delivery of account emails only (confirmation, password reset).

These are the only third parties that can technically access data on our behalf. We do not sell, rent or share your data with anyone else.

6. How long we keep it

Your workspace stays until you erase it. Erasing it from Settings → Backup clears its contents immediately; deleting the account itself — your sign-in, your activity records and your billing reference — is done on request within 30 days. Billing records are kept for as long as Swiss and EU accounting rules require. Provider security logs expire on the providers' own schedules, typically within weeks.

7. Your rights

You can access, correct, export and delete your data. Export and erasure of your workspace contents are built into the app (Settings → Backup), so you do not need to ask us or wait; deletion of the account itself is done on request within 30 days. You can also write to hello@flowzivo.com for anything else, including a complaint; you have the right to complain to your local data protection authority or, in Switzerland, to the FDPIC.

8. Security

Traffic is encrypted in transit. Every workspace row is protected by database-level Row Level Security, so the database refuses to return another account's data even if the application asked it to. No system is perfect: keep your own backup export, which the app makes in one click.

9. Changes

If this policy changes in a way that affects you, we will say so on this page and, for material changes, by email to the address on your account.