Features Templates Local AI Use cases Security Pricing Blog Become a partner Book a demo
Login Get started free
DEEN

Privacy Policy

Last updated: August 4, 2026

Introduction

RelationFlow Ltd. ("we" or "us") operates the RelationFlow platform and processes personal data in doing so. The legal bases for this arise in particular from the General Data Protection Regulation (GDPR), the German Telecommunications Digital Services Data Protection Act (TDDDG), and the German Federal Data Protection Act (BDSG).

This privacy policy informs you, in accordance with Art. 12 to Art. 14 GDPR, about which data we collect, for which purposes we use it, and on which legal basis the processing takes place. It covers in particular:

In addition, this privacy policy contains information about recipients of your data (Section 3), transfers to third countries (Section 4), the storage period (Section 5), your rights (Sections 6 and 7), the provision of data (Section 8), and automated decision-making (Section 9).

1. Controller

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

RelationFlow Ltd.
Anthypolochagou Georgiou M. Savva 26
Office 1-2
8201 Paphos, Cyprus (CY)

Email: support@relationflow.io
Represented by: Leonard Schmedding (Director)

2. Data Processing in Detail

2.1 Technical Provision of the Website

When you visit our website, technical information transmitted by your browser to our server is collected automatically. This access data is required for the technical provision of the website and includes in particular:

This data is stored in server log files and is used exclusively for the technical provision and security of the website. It is not combined with other data sources or analyzed for marketing purposes.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the technical provision and security of the website).

Storage period: The server logs are stored for a maximum of 7 days and then automatically deleted.

Hosting provider: Our website is hosted by Cloudflare, Inc. Our app is hosted by Vercel Inc.

2.2 Cookies and Tracking Technologies

Our website and platform use cookies and similar technologies. Cookies are small text files that are stored on your device.

a) Technically Necessary Cookies

These cookies are required for the operation of the website and platform. They enable basic functions such as login and session management. Without these cookies, the platform cannot function properly.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest) as well as Section 25(2) no. 2 TDDDG.

b) Analytics Cookies

With your consent, we use analytics tools to understand and improve the use of our website and platform.

Legal basis: Art. 6(1)(a) GDPR (consent).

c) Marketing Cookies

With your consent, we use marketing tools to show you relevant advertising and measure the effectiveness of our campaigns.

Legal basis: Art. 6(1)(a) GDPR (consent).

d) Managing Your Settings

When you first visit our website, a cookie banner asks you which cookies you wish to allow. You can change your settings or withdraw your consent at any time via the "Cookie Settings" link in the footer of the website.

2.3 Contact Form

We offer a contact form on our website through which you can get in touch with us. When you use the contact form, the following data is collected:

In addition, your IP address as well as the date and time are recorded when the form is submitted.

We use this data exclusively to process and respond to your inquiry and for any follow-up questions. It is not passed on to third parties unless this is necessary to process your inquiry.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures), insofar as your inquiry is aimed at concluding a contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

Storage period: The data is deleted as soon as it is no longer required to process your inquiry, unless statutory retention obligations prevent this.

2.4 Newsletter

We offer the option of subscribing to a newsletter through which we inform you about news, product updates, and relevant content.

a) Sign-up

We use the double opt-in procedure for newsletter sign-up. This means: after signing up, you will receive an email with a confirmation link. Your sign-up is only completed once you click this link. Without confirmation, your data will be deleted automatically.

When you sign up, we store:

b) Newsletter to Existing Customers

If you have purchased a product or booked a service from us, we may use your email address to inform you about similar offers, provided you have not objected to this.

Legal basis: Section 7(3) UWG (German Act Against Unfair Competition) in conjunction with Art. 6(1)(f) GDPR (legitimate interest).

c) Content and Analysis

The newsletter may contain information about our products, services, and relevant industry topics. We reserve the right to measure the open and click rates of the newsletter in order to improve our content.

d) Unsubscribing

You can unsubscribe from the newsletter at any time. You will find an unsubscribe link at the end of every newsletter. Alternatively, you can send us an email at support@relationflow.io. After unsubscribing, your data will be deleted unless statutory retention obligations apply.

Legal basis (for sign-up): Art. 6(1)(a) GDPR (consent).

2.5 Social Media

We maintain company pages on various social networks to provide information about our products and services and to get in touch with you. We link to these profiles on our website.

a) Which Networks We Use

b) Data Processing When You Visit Our Company Pages

When you visit our company pages, personal data is processed by the respective platform operator. This may include: IP address, profile information, interactions with our content, and information about your usage behavior.

The platforms provide us with anonymized statistics about the use of our company pages (e.g. reach, interactions). We have no access to the underlying personal data.

c) Joint Controllership

For certain processing operations (in particular the creation of page statistics), we are jointly responsible with the platform operators within the meaning of Art. 26 GDPR. The platform operators have provided corresponding agreements for this purpose:

You can assert your data subject rights both against us and against the respective platform operators.

d) Privacy Information of the Platforms

Further information on data processing by the platform operators can be found in their privacy policies:

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in communicating with prospects and customers and in analyzing and optimizing our online presence).

2.6 Contract Processing and Customer Relationships

As part of the registration, ordering, and use of our services, we process personal data of our customers.

a) Which Data We Collect

During registration and ordering, we collect:

b) Purposes of Processing

We process this data for:

c) Payment Processing

Payment processing is handled by our payment service provider Stripe (Stripe Payments Europe Ltd.). Your payment data is collected and processed directly by Stripe. We have no access to complete credit card data. Further information can be found in Stripe's privacy policy:stripe.com/de/privacy

Legal basis: Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures).

Storage period: We store your data for the duration of the contractual relationship and beyond that in accordance with statutory retention obligations (up to 10 years under commercial and tax law).

2.7 Use of the Platform

When you use our RelationFlow platform, personal data is processed.

a) Which Data Arises During Use

When you use the platform, we process:

b) Transfer to AI Providers

To process your requests, your inputs (prompts) are transmitted to the respective AI providers:

Processing takes place exclusively on European servers. According to the terms of use of the cloud providers, your data is not used for training AI models.

c) Storage Period

After the end of the contract, your data will be deleted within 30 days.

d) Distinction by Customer Type

Private customers (single user): If you use the platform as a private individual, we are the controller responsible for processing your data.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

Business customers (Enterprise): If you use the platform as an employee of a company that has provided you with access, that company is the controller responsible for processing your data. In that case, we act as a processor within the meaning of Art. 28 GDPR.

In this case, please contact your employer with questions about data processing and to exercise your data subject rights.

2.8 Pay-as-you-go (PAYG)

If the owner of a paid account area (Starter, Pro, Max, or Enterprise) activates the pay-as-you-go model and tops up a pre-paid balance, we process the following data in addition to the data of general contract processing (Section 2.6):

a) Which Data We Process

b) Purposes of Processing

c) Recipients

Top-up payments are processed via our payment service provider Stripe (Stripe Payments Europe Ltd.). Only the data necessary for the payment transaction is transmitted to Stripe. We have no access to complete payment data.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) as well as Art. 6(1)(c) GDPR (compliance with tax and commercial law obligations).

Storage period: PAYG ledger entries are stored for the duration of the contractual relationship and beyond that for the fulfillment of commercial and tax law retention obligations (up to 10 years). The current balance is maintained until it is fully consumed or until the contract is terminated.

2.9 Voicely Bundle and Cross-Account Linking

Selected plan tiers and launch offers of the RelationFlow platform include the Voicely bundle described in Section 8.11 of the Terms and Conditions. The RelationFlow and Voicely platforms are both operated by the same controller, RelationFlow Ltd. No transfer of your data to an external third party takes place for bundle activation.

a) Which Data We Process

b) Purposes of Processing

c) Responsibility Within RelationFlow Ltd.

Since RelationFlow and Voicely are both operated under the responsibility of RelationFlow Ltd., the cross-account linking does not constitute a transfer to a third party but processing within the same controller. The privacy notices applicable to both platforms are to be read consistently in this respect.

d) Data Flow to Stripe

All stamp redemptions and any automatically extended Voicely plans (Section 8.11(d) of the Terms and Conditions) are processed via the payment service provider Stripe (Stripe Payments Europe Ltd.). Stripe processes the data necessary for payment processing in accordance with its own privacy policy.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) as well as Art. 6(1)(f) GDPR (legitimate interest in proper cross-platform provisioning and in avoiding double billing).

Storage period: Stamp records are retained for the duration of the contractual relationship with RelationFlow and deleted after the expiry of any commercial and tax law retention obligations. The Voicely subscription ID associated with a bundle activation is stored for as long as it is required for the contract processing of both platforms.

2.10 Legal Obligations

We process your personal data insofar as this is necessary to fulfill legal obligations. This includes in particular retention obligations under commercial and tax law (e.g. for invoices and contract documents).

Legal basis: Art. 6(1)(c) GDPR (compliance with a legal obligation).

Storage period: Up to 10 years pursuant to Sections 238, 257 HGB (German Commercial Code) and Section 147 AO (German Fiscal Code).

2.11 Legal Enforcement

We process your personal data insofar as this is necessary for the establishment, exercise, or defense of legal claims. This also includes the defense against or prosecution of criminal offenses.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in enforcing and defending our rights).

Storage period: Until the expiry of the statutory limitation periods (generally 3 years, in exceptional cases up to 30 years).

2.12 In-App Support & Screenshots

Within the app, you can send a support request via "Help & Feedback". In doing so, we process your message as well as technical diagnostic data (browser, operating system, current page, app version, recent error messages, account ID, and role). This diagnostic data is cleaned of sensitive content on the client side before it is sent.

Screenshots:Optionally, you can attach screenshots. These are stored in private storage (Supabase Storage, bucket "support-attachments"), are accessible exclusively to our support team via time-limited, signed links (max. 3 files, max. 5 MB each, formats PNG/JPG/WebP), and are automatically deleted after 90 days. Please do not make passwords or personal data of third parties visible in screenshots.

Legal basis: Art. 6(1)(b) GDPR (processing of your support request) as well as Art. 6(1)(f) GDPR (legitimate interest in efficient technical troubleshooting).

Recipients: Supabase Inc. (storage of the screenshots, see Section 3) and Resend Inc. (sending the support email to our team with time-limited, signed links; the image data itself is not transmitted to Resend, see Section 3). Technical diagnostic data (without image content) may additionally be transmitted to Sentry (see Section 3).

Storage period: Screenshots are automatically deleted after 90 days. We retain the content of your request for as long as necessary to process it.

2.13 Appointment Booking (Calendly)

For booking personal appointments (e.g. for a demo or analysis call), we use Calendly, a service provided by Calendly LLC, 1315 Peachtree St NE, Atlanta, GA 30309, USA. The booking widget is only loaded once you actively reach the appointment-selection step in the sign-up process; no data is transmitted to Calendly when you merely visit our website.

When you book, Calendly processes the data you enter (name, email address, selected time slot, any additional details) as well as technical data (IP address, browser information). Calendly sets cookies that are required to provide the booking functionality.

Legal basis: Art. 6 (1)(b) GDPR (pre-contractual measures or appointment scheduling at your request) and Section 25 (2) No. 2 TDDDG for technically required cookies.

Third-country transfer: Calendly LLC is based in the USA and is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

Storage period: We store your booking data for as long as necessary to conduct the appointment. For more information, see Calendly's privacy policy.

2.14 Partner Program Application

You can apply for our partner program via a form on our website. In doing so, we collect the following data:

Purpose: We use this data to review your application and to initiate the partnership. We collect the company address and VAT ID as part of the application so that, in the event of a collaboration, we can prepare the commission billing; they are not evaluated for the mere review of your application.

Legal basis: Art. 6 (1)(b) GDPR (pre-contractual measures at your request).

Recipients: The data is stored in our database (Supabase Inc., see Section 3) and transmitted to our email service provider for the confirmation email (Resend Inc., see Section 3).

Storage period: If no partnership is concluded, we delete your application data as soon as it is no longer required for processing. Otherwise, the periods set out in Section 5 apply.

2.15 Live Training Registration

You can register for our weekly live training via our website. We collect your name, your email address, the start date you select, and your answers to two questions about topic focus and team size.

Purpose: We use this data to give you access to the live training and to tailor the content to the interests of the participants.

Legal basis: Art. 6 (1)(b) GDPR (pre-contractual measures at your request).

Recipients: The registration data is stored in our database (Supabase Inc., see Section 3).

Calendar entry: After registering, you can download the appointment as a calendar file (.ics). This file is generated on our own server, no data is transmitted to third parties in the process.

Delivery via Google Meet: The live training itself takes place via Google Meet, a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google only processes the data required for this (including IP address, device and browser information, the name you display, and audio and, where applicable, video data during participation) once you join the meeting. Participation is voluntary, you may leave your camera and microphone switched off.

Third-country transfer: Google Ireland Limited may transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

Storage period: We store your registration data for as long as it is required to run the live trainings. For more information on processing by Google, see Google's privacy policy.

3. Recipients of Your Data

To provide our services, we work with external service providers who may have access to personal data to varying degrees.

a) Processors

These service providers process data exclusively according to our instructions:

Hosting & infrastructure:

Appointment booking & live trainings:

AI services:

Email:

Analytics & monitoring:

Cookie management:

b) Independent Controllers

These service providers decide independently on the processing of the data:

Payment:

Marketing (only with consent):

c) Other Recipients

In individual cases, we may also transmit data to the following recipients:

4. Data Transfers to Third Countries

We endeavor to process your data exclusively within the European Union (EU) or the European Economic Area (EEA). Our infrastructure, including databases and AI services, is operated on European servers.

Insofar as we use service providers based outside the EU/EEA (in particular in the USA), we ensure that an adequate level of data protection is guaranteed. This is achieved through:

5. Storage Period and Deletion

We process your personal data only for as long as is necessary for the respective processing purposes. The duration of storage is determined by the following criteria:

a) Performance of a Contract

Insofar as processing is carried out to perform a contract, we store your data for the duration of the contractual relationship, including its initiation and completion (Art. 6(1)(b) GDPR).

b) Legitimate Interests

Insofar as processing is carried out to safeguard legitimate interests, we store your data until the respective processing purpose has been achieved or until you object to the processing (Art. 6(1)(f) GDPR, Art. 21 GDPR).

c) Consent

Insofar as processing is based on your consent, we store your data until you withdraw your consent (Art. 6(1)(a) GDPR, Art. 7(3) GDPR).

d) Statutory Retention Obligations

Even after the original processing purpose has been achieved, further storage may be necessary to fulfill statutory retention obligations. This applies in particular to:

e) Legal Enforcement

For the establishment, exercise, or defense of legal claims, we may store data until the expiry of the statutory limitation periods. The regular limitation period is three years pursuant to Sections 195, 199 BGB (German Civil Code), in exceptional cases up to 30 years (Section 197 BGB).

f) Specific Storage Periods

For the specific storage periods of the individual processing activities, please refer to the respective sections of this privacy policy:

After the respective storage period has expired, your data will be deleted or anonymized, unless further retention obligations exist.

6. Your Rights

As a data subject, you have the following rights, which you can assert at any time using the contact details provided in Section 1:

a) Right of Access (Art. 15 GDPR)

You have the right to request confirmation as to whether we process personal data concerning you. If this is the case, you are entitled to information about this data as well as further information such as processing purposes, categories of data, recipients, and the planned storage period.

b) Right to Rectification (Art. 16 GDPR)

You have the right to request the immediate rectification of inaccurate data and the completion of incomplete data.

c) Right to Erasure (Art. 17 GDPR)

You have the right to request the erasure of your personal data if one of the statutory grounds applies, e.g. if the data is no longer necessary for the purposes for which it was collected or if you have withdrawn your consent.

d) Right to Restriction of Processing (Art. 18 GDPR)

You have the right to request the restriction of the processing of your data, e.g. if you contest the accuracy of the data or if the processing is unlawful but you do not want the data to be erased.

e) Right to Data Portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format. You can transmit this data to another controller or request that we do so, insofar as this is technically feasible.

f) Right to Withdraw Consent (Art. 7(3) GDPR)

If you have given us consent to data processing, you can withdraw it at any time with effect for the future. The lawfulness of the processing carried out up to the withdrawal remains unaffected.

g) Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates the GDPR.

7. Right to Object

a) Objection on Grounds Relating to Your Particular Situation (Art. 21(1) GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data insofar as it is based on Art. 6(1)(f) GDPR (legitimate interest). We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests.

b) Objection to Direct Marketing (Art. 21(2) GDPR)

Insofar as we process your data for direct marketing, you have the right to object at any time without giving reasons. We will then no longer use your data for advertising purposes.

c) Exercising the Right to Object

Please address your objection to:support@relationflow.io

8. Provision of Data

There is no statutory or contractual obligation to provide us with your personal data. However, if you choose not to provide certain data, this may mean that we are unable to provide our services in full or at all: in particular registration, use of the platform, or processing of your inquiries.

Voluntary information is marked accordingly in our forms.

9. Automated Decision-Making

We do not use automated decision-making, including profiling, within the meaning of Art. 22(1) and (4) GDPR that produces legal effects concerning you or similarly significantly affects you.

This privacy policy is dated August 4, 2026. Due to the further development of our website, products, and services or due to changed legal or regulatory requirements, it may become necessary to amend this privacy policy. You can find the current version on our website at any time.