Privacy Policy – Flowtifyy

This Privacy Policy applies to the Flowtifyy platform (app.flowtifyy.com), operated by KOMUNIQUE by Philipp Roth, Blumenrainstrasse 29, 9050 Appenzell, Switzerland. It informs you about the processing of personal data in accordance with the General Data Protection Regulation (GDPR) and the Swiss Data Protection Act (DSG/FADP).

1. Controller

KOMUNIQUE by Philipp Roth
Blumenrainstrasse 29, 9050 Appenzell, Switzerland
Email: support@flowtifyy.com

2. What data we collect

2.1 Registration and account data

Upon registration: name, email address, password (encrypted), shop name and shop URL.

2.2 Shop and transaction data

During use: product data, order data, customer data of your end customers (name, email, delivery address), and payment information (depending on the payment method, via Stripe, Payrexx or PayPal).

2.3 Usage data

Technical data such as IP address, browser type, access times and pages visited are recorded in server logs. On our marketing website (flowtifyy.com) we also use Google Tag Manager and Google Analytics 4 (Google LLC, USA) to statistically analyse user behaviour. Data collected includes page views, session duration, bounce rate, approximate location (country/city), and device information.

2.4 Cookies

We use technically necessary cookies (session cookie fi_session, language preference fi_lang). On our marketing website we additionally use Google Analytics 4 cookies (_ga, _ga_*, stored for up to 2 years) loaded via Google Tag Manager. These cookies are only set with your explicit consent (cookie consent banner).

2.5 Cookie Declaration

The following overview lists all cookies used on our marketing website, including purpose, provider and storage duration:

3. Legal basis for processing

Processing is based on the GDPR and, additionally, the Swiss Data Protection Act (DSG/FADP):

Contract performance (Art. 6(1)(b) GDPR / Art. 31(2)(a) DSG): Registration, account management, service delivery
Legitimate interests (Art. 6(1)(f) GDPR / Art. 31(1) DSG): Operational security, fraud prevention, product improvement
Legal obligation (Art. 6(1)(c) GDPR / Art. 31(2)(c) DSG): Retention obligations
Consent (Art. 6(1)(a) GDPR / Art. 31(1) DSG): Where explicitly obtained

4. Hosting and data location

The Flowtifyy platform and database are hosted on Google Cloud Platform in the region europe-west6 (Zurich, Switzerland). Your data does not leave Switzerland for hosting purposes. The infrastructure is operated in compliance with the GDPR and the Swiss DSG (FADP). A data processing agreement (DPA) is in place with Google LLC pursuant to Art. 28 GDPR and Art. 9 DSG. The full list of sub-processors is available at /legal/providers.

5. Third parties and processors

We have data processing agreements (DPAs) pursuant to Art. 28 GDPR and Art. 9 DSG in place with all processors. The complete list of sub-processors (including hosting infrastructure) is available at /legal/providers. The key payment and communication providers are listed below:

Provider	Purpose	Data transfer
Stripe Payments Europe, Ltd. (Ireland)	Payment processing and subscription management	Ireland / EEA (DPA)
Payrexx AG (Switzerland)	TWINT, credit cards and further payment methods	Switzerland / EU
PayPal (Luxembourg S.à r.l.)	International payment processing	EU / USA (SCC)
Resend Inc. (USA)	Transactional emails (order confirmations)	USA (SCC, DPA)
Google LLC (USA)	Google Tag Manager & Google Analytics 4 (web analytics for marketing website flowtifyy.com)	USA (SCC, DPA)

Google Tag Manager & Google Analytics 4

We use Google Tag Manager (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) as a tag management system. Google Tag Manager itself does not collect personal data, but loads other tags including Google Analytics 4.

Google Analytics 4 analyses user behaviour on our marketing website (flowtifyy.com). Data collected (page views, device information, approximate location, session duration) is transferred to Google servers in the USA. We have enabled IP anonymisation and the "No data sharing with Google" setting. Data is retained for a maximum of 14 months.

Legal basis: Consent pursuant to Art. 6(1)(a) GDPR. You may withdraw your consent at any time (cookie settings) or disable Google Analytics using the Google Analytics Opt-out Browser Add-on.

Google Privacy Policy: policies.google.com/privacy

6. Retention periods

Account data: For the duration of the contractual relationship plus statutory retention periods (generally 10 years)
Order data: 10 years (commercial law retention obligation)
Server logs: 30 days
Cookies: Session cookies until browser is closed; preference cookies max. 1 year

7. Your rights

You have the following rights regarding your personal data (under GDPR and Swiss DSG/FADP):

Access (Art. 15 GDPR / Art. 25 DSG): Copy of your stored data
Rectification (Art. 16 GDPR / Art. 32 DSG): Correction of inaccurate data
Erasure (Art. 17 GDPR / Art. 32 DSG): Deletion where no retention obligations apply
Restriction (Art. 18 GDPR): Restriction of processing
Data portability (Art. 20 GDPR / Art. 28 DSG): Export of your data
Objection (Art. 21 GDPR): Objection to legitimate interests
Complaint: To the competent supervisory authority (Switzerland: FDPIC/EDÖB)

To exercise your rights: support@flowtifyy.com

8. Data processing by Flowtifyy customers

Where you as a Flowtifyy customer process personal data of your end customers via the platform, you are the data controller under the GDPR and Swiss DSG. Flowtifyy acts as a processor. A data processing agreement (DPA) pursuant to Art. 28 GDPR and Art. 9 DSG can be requested at support@flowtifyy.com.

9. Security

TLS/HTTPS encryption of all connections
Bcrypt password hashing
JWT-based authentication with httpOnly cookies
Regular security updates
Access restrictions on sensitive data

10. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy. The current version is always available at app.flowtifyy.com/datenschutz. Registered users will be informed by email of any material changes.