English translation provided for convenience. In case of any discrepancy, the Italian version prevails.
This notice describes how the personal data of the users of the Flow service (the «Service») are processed, in accordance with Regulation (EU) 2016/679 («GDPR») and the applicable Italian law. We handle data with the utmost care: we do not sell it, we do not pass it on to third parties for marketing, and we do not use the content of your files to train models or to profile you.
1. Data controller
The data controller is GRK Interactive S.r.l., registered office at via Bergognone 27, 20144 Milan (MI), Italy. Tax code and VAT number 05814140967, registered in the Milan Companies Register under no. 05814140967, REA MI-1850299, share capital EUR 10,000.00 fully paid up. For any matter relating to data protection you can write to privacy@grk.agency.
2. Categories of data processed
We process the following categories of data, depending on how you use the Service:
- Account data: name, email address, the space you belong to, role and credentials. The password is not stored in clear: the Service keeps a hash protected with Argon2.
- Billing data: company name, address, VAT number, SDI recipient code or certified email (PEC). Payment card data is handled directly by Stripe and is neither transmitted to nor stored on our systems.
- Usage and security data: access logs and logs of administrative activity (who did what and when), IP addresses, technical information about the device and the browser, needed to provide and protect the Service.
- Error reports from the desktop apps: when the Flow app for Windows or Mac closes unexpectedly, it sends us a technical report with the app and operating system versions, the time and the last lines of the activity log, with file and folder names and email addresses hidden; never the content of files. They are used only to fix errors and can be turned off in the app Settings.
- File contents: the files you upload, their metadata (names, folders, versions) and the text extracted for search. For these contents see section 4.
- Communications: the messages you send us through the contact or support forms, together with the name and email address you write from and, if you choose to give them, company name and VAT number.
3. Purposes and legal bases
We process data for the following purposes, each with its own legal basis:
- Providing the Service (account creation, synchronisation, sharing, support): performance of the contract to which you are a party (Art. 6.1.b GDPR).
- Invoicing and tax and accounting obligations: legal obligation (Art. 6.1.c GDPR).
- Security, abuse prevention and continuity of the Service: legitimate interest of the controller (Art. 6.1.f GDPR).
- Commercial communications and newsletters, where provided: only with your prior consent, which you can withdraw at any time (Art. 6.1.a GDPR).
4. File contents: our role
For the contents of the files you upload we act as data processor: the controller of that data is you (or your company). We process those contents only to provide the Service (storing them, synchronising them, generating previews and the search index) and according to your instructions. We do not access them except when technically necessary for operation or security, or when required by law. Text extraction and the OCR that power search run on our systems, not on third-party services. The KAi assistant also answers with a model that runs on GPU servers we rent from our infrastructure providers (section 5): questions and documents are not sent to third-party artificial intelligence services.
KAi suggestions
KAi suggestions are an optional feature that each user turns on for themselves, from the Automations page. If you turn it on, from that moment Flow records some of the operations you perform on files (uploads, renames, moves, shares and sends in chat, with the names of the files, the folders and the recipients involved) for the sole purpose of recognising the ones you repeat and offering, in the chat, to automate them. It does not record the content of files, nor working hours, breaks or any other measure of your activity.
The record and the suggestions are visible only to you: neither the administrators nor your company can see them, and they are not used to assess your work or for any other purpose. They are processed on the Service servers listed in section 5, including when KAi works out a rule from the names of example files, and they are not sent to third-party artificial intelligence services. Each recorded operation is deleted after 90 days; turning the feature off immediately deletes the whole record. For this data, as for file contents, we act as data processor on behalf of your company.
5. Recipients and external processors
To provide the Service we rely on the following providers, which process data on our behalf as processors, bound by specific agreements (Art. 28 GDPR):
- OVHcloud SAS (France): Service servers: application, database, previews, search, document editor, sign-in and the KAi assistant;
- Cloudflare (through Cloudflare Portugal): storage of file contents, encrypted at rest by the provider and, for encrypted folders, by Flow before upload; DNS and anti-bot checks on the website forms (Turnstile, which processes the IP address and technical browser data according to Cloudflare's Turnstile Privacy Addendum);
- Microsoft Ireland Operations Ltd (Ireland): backup copies of the database, encrypted before upload, and the mail server for service emails;
- Nebius B.V. (Netherlands): GPU servers in Finland running the model of the KAi assistant: the questions, documents and images that KAi reads;
- Stripe Payments Europe Ltd (Ireland): payments and subscriptions by card, SEPA direct debit, bank transfer and the PayPal, Amazon Pay, Revolut Pay and Satispay wallets. For fraud prevention and its own legal obligations Stripe processes payment data as an independent controller; if you pay with one of the wallets, its operator also processes the payment data as an independent controller, according to its own privacy notice.
Notifications on phones. The iPhone and Android apps receive notifications (for example a new chat message) through the delivery services of Apple and Google, which receive the device identifier and the text of the notification: who is writing and the beginning of the message or the name of the attachment. Notifications can be turned off in the phone settings.
Calendar with Microsoft 365. If you connect the Flow calendar to Microsoft 365 / Outlook, events are exchanged with the Microsoft account you indicate: it is a service chosen and managed by you or your company, and for that data Microsoft acts as your provider, not ours.
To validate the VAT number, the number and country entered are checked through the European Commission's VIES service and, when VIES does not confirm it or does not answer, through the service of OpenAPI S.p.A. (openapi.com), which receives only the VAT number and country. We do not disclose data and do not pass it on to third parties for their own purposes. If we add a provider that processes customer data, we update this list before it starts processing it and notify customers as provided for in the data processing agreement.
6. Where the data is and transfers outside the EU
The Service data is stored and processed in the European Union: servers, file storage, backups and service mail are in European data centres of the providers listed in section 5. Cloudflare, Microsoft and Stripe belong to groups that also have offices outside the EU: for any access to the data from third countries (for example for the provider's technical support) the safeguards of Articles 44 et seq. GDPR apply, namely the European Commission's Standard Contractual Clauses and, for providers that have joined it, the EU-US Data Privacy Framework.
If your company chooses to use its own storage service for files, that provider and the location of the data are chosen by the company.
7. Retention period
We keep data for as long as needed for the purposes for which it was collected and for the duration of the contractual relationship. Billing data is kept for the period required by tax obligations. App error reports are kept while the problem is open and are deleted at the latest 90 days after it is closed. The KAi suggestions record (section 4) keeps each operation for 90 days and is deleted in full when you turn the feature off. The periods for removing active data and for residual copies to leave the backup cycle will be stated once the retention policy has been ratified and the related restore and deletion process verified. Legal obligations and the needs of legal defence remain unaffected.
8. Your rights
You can exercise at any time the rights under Articles 15–22 GDPR: access to your data, rectification, erasure, restriction of and objection to processing, portability, and withdrawal of consent where processing is based on it. To exercise them, write to privacy@grk.agency. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).
9. Deleting your account
You can ask at any time for your KAi/flow account to be deleted, even without using the app:
- from Flow, on the web or in the app: Profile › Ask to delete my account;
- or by writing to privacy@grk.agency or from the Contact page, from your account's email address.
Flow accounts belong to the company that created them: the request goes to your company's administrators, who remove the account. If you are the owner and there are other users in the company, you first hand the ownership over to another administrator; if you are the only user, the request comes to us and corresponds to closing the company on Flow.
Removal deletes the Flow account and the linked personal data: name, email address, profile picture, preferences and notifications, your personal space with the files it contains and your direct chat conversations. The files in shared spaces and the messages in group chats stay with the company, which is their controller, without your name. Billing data and technical logs also remain, for the periods stated in section 7. The KaiGrid sign-in account, which may also serve other applications, is deleted on request to privacy@grk.agency.
10. No automated decision-making
We do not carry out processing involving automated decisions, including profiling, that produce legal effects or similarly significantly affect you (Art. 22 GDPR). Text extraction and OCR are used only to search your documents and do not profile you.
11. Security
We adopt appropriate technical and organisational measures to protect data: connections to the service encrypted in transit with HTTPS, anti-malware checks on uploads within the declared limit, access control by space and by folder, a log of administrative activity and storage redundancy in the managed configuration. The applicable measures will be described definitively after the production environment has been verified. No system is 100% secure, however: please keep your credentials safe.
12. Data breaches
When we act as data processor, we inform the controller without undue delay after becoming aware of a personal data breach. When we act as controller, we assess the risk and, where required, notify the breach to the Italian Data Protection Authority within 72 hours and inform the data subjects in the cases provided for by Articles 33–34 GDPR.
13. Minors
The Service is aimed at companies and professionals and is not intended for minors. We do not knowingly collect data of persons below the age required by law for valid consent; should we become aware of such processing, we will remove the related data.
14. Cookies and local storage
The public website uses technical tools needed for it to work (language, theme, protection of forms from bots with Cloudflare Turnstile, payment with Stripe at checkout), and statistical tools only with your consent, which you can give, refuse or withdraw at any time from «Cookie preferences» at the bottom of every page. The signed-in application keeps in the browser the technical information needed for the session; a public share may keep its ticket for as long as the tab is open. The full list, with purposes and durations, is in the Cookie Policy.
Some dashboard tips contain a video hosted by Vimeo. The player loads only when you press «Watch the video», with the do-not-track request on; from that moment your browser connects to Vimeo's servers, which process the technical connection data according to their own privacy notice.
15. Changes to this notice
We may update this notice to reflect changes in the Service or in the law. The version in force is always published on this page, with the date of the last update at the top. We will let you know of any substantial changes.