Privacy Policy – Flowtifyy

This Privacy Policy applies to the Flowtifyy platform (app.flowtifyy.com), operated by KOMUNIQUE by Philipp Roth, Blumenrainstrasse 29, 9050 Appenzell, Switzerland. It informs you about the processing of personal data in accordance with the General Data Protection Regulation (GDPR).

1. Controller

KOMUNIQUE by Philipp Roth
Blumenrainstrasse 29, 9050 Appenzell, Switzerland
Email: hello@flowtifyy.com

2. What data we collect

2.1 Registration and account data

Upon registration: name, email address, password (encrypted), shop name and shop URL.

2.2 Shop and transaction data

During use: product data, order data, customer data of your end customers (name, email, delivery address), and payment information (depending on the payment method, via Stripe, Payrexx or PayPal).

2.3 Usage data

Technical data such as IP address, browser type, access times and pages visited are recorded in server logs.

2.4 Cookies

We use technically necessary cookies only (session cookie fi_session, language preference fi_lang). No tracking or advertising cookies are used.

3. Legal basis for processing

Contract performance (Art. 6(1)(b) GDPR): Registration, account management, service delivery
Legitimate interests (Art. 6(1)(f) GDPR): Operational security, fraud prevention, product improvement
Legal obligation (Art. 6(1)(c) GDPR): Retention obligations
Consent (Art. 6(1)(a) GDPR): Where explicitly obtained

4. Hosting and data location

The Flowtifyy platform and database are hosted via Replit Inc. (San Francisco, USA). Replit's infrastructure is operated in compliance with the GDPR and uses Standard Contractual Clauses (SCC) pursuant to Art. 46 GDPR. A data processing agreement (DPA) is in place with KOMUNIQUE. Your data is therefore transferred to and processed in the USA on a lawful basis.

5. Third parties and processors

We have data processing agreements (DPAs) pursuant to Art. 28 GDPR in place with all processors listed below. All providers that transfer data to the USA have appropriate safeguards (SCC) in place:

Provider	Purpose	Data transfer
Replit Inc. (USA)	Application hosting and database hosting	USA (SCC, DPA)
Stripe Inc. (USA)	Payment processing and subscription management	USA (SCC, DPA)
Payrexx AG (Switzerland)	TWINT, credit cards and further payment methods	Switzerland / EU
PayPal (Luxembourg S.à r.l.)	International payment processing	EU / USA (SCC)
Resend Inc. (USA)	Transactional emails (order confirmations)	USA (SCC, DPA)

6. Retention periods

Account data: For the duration of the contractual relationship plus statutory retention periods (generally 10 years)
Order data: 10 years (commercial law retention obligation)
Server logs: 30 days
Cookies: Session cookies until browser is closed; preference cookies max. 1 year

7. Your rights

You have the following rights regarding your personal data:

Access (Art. 15 GDPR): Copy of your stored data
Rectification (Art. 16 GDPR): Correction of inaccurate data
Erasure (Art. 17 GDPR): Deletion where no retention obligations apply
Restriction (Art. 18 GDPR): Restriction of processing
Data portability (Art. 20 GDPR): Export of your data
Objection (Art. 21 GDPR): Objection to legitimate interests
Complaint: To the competent data protection supervisory authority

To exercise your rights: hello@flowtifyy.com

8. Data processing by Flowtifyy customers

Where you as a Flowtifyy customer process personal data of your end customers via the platform, you are the data controller under the GDPR. Flowtifyy acts as a processor. A data processing agreement (DPA) can be requested at hello@flowtifyy.com.

9. Security

TLS/HTTPS encryption of all connections
Bcrypt password hashing
JWT-based authentication with httpOnly cookies
Regular security updates
Access restrictions on sensitive data

10. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy. The current version is always available at app.flowtifyy.com/datenschutz. Registered users will be informed by email of any material changes.