Effective Date: 21 May 2026
1. Data Controller
The data controller for this website is:
- Nicolas Chourrout, sole proprietor, trading as Flowful AI (commercial name)
- Waterloo, Belgium
- BCE / VAT: BE 1010.797.804
- Contact: contact@flowful.ai
For any question or request relating to your personal data under the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), please write to contact@flowful.ai.
2. Scope of This Policy
This policy describes how we process personal data collected through the public website flowful.ai. It does not cover:
- Data processed on behalf of our clients under a signed service agreement and Data Processing Agreement. That processing is governed by the DPA we sign with each client, where Flowful AI acts as a processor, not as a controller. The current DPA and Security Overview are available on request at contact@flowful.ai.
- The booking service at cal.flowful.ai, which has its own privacy policy.
3. What Personal Data We Process
3.1 Website Analytics
We use Umami, a privacy-focused, self-hosted analytics tool running on our own infrastructure in the European Union (Hetzner, Germany). Umami does not use cookies, does not collect personal data, and does not track visitors across websites. The data is aggregated and anonymous (pages viewed, referrer, country at country level, browser type).
3.2 Functional Cookies on This Website
We do not use advertising, third-party tracking, or fingerprinting cookies. The only cookie we set ourselves is:
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
user-lang-selection | Remembers your manual language choice (FR/EN) so you are not redirected on later visits | 1 year | Functional, strictly necessary |
Some pages embed third-party content that may receive your IP address purely to deliver that content:
- OpenFreeMap (EU-hosted) delivers map tiles on our agency pages.
- YouTube in privacy-enhanced mode (
youtube-nocookie.com) embeds videos on blog and project pages. No YouTube cookies are set unless you press play. - Google Search Console verification uses a static
<meta>tag with no data collection beyond the standard HTTP request when the page loads.
You can block or delete cookies at any time through your browser settings.
4. Purposes and Legal Basis
| Purpose | Legal basis (GDPR Article 6) |
|---|---|
| Maintaining anonymous, aggregated website analytics | Legitimate interest in operating and improving the website, Art. 6(1)(f) |
| Remembering your language preference | Legitimate interest in providing a consistent browsing experience, Art. 6(1)(f) |
We do not use website data for advertising, profiling, automated decision-making, or to train AI models.
5. Retention
Website analytics are aggregated and anonymous, retained as configured in our Umami instance. The language preference cookie expires after one year unless renewed by a subsequent visit.
6. Recipients
Your data is not sold, rented, or shared with third parties for their own purposes. Website hosting and analytics run on infrastructure provided by Hetzner Online GmbH (Germany, EU), bound by its own data processing terms.
7. International Transfers
Where embedded third-party content involves a transfer outside the European Economic Area (for example, when you watch an embedded YouTube video), such transfers rely on the Standard Contractual Clauses published by the European Commission (Implementing Decision (EU) 2021/914) and on supplementary measures applied by the relevant provider.
8. Your Rights
Under the GDPR, you have the right to:
- Access your personal data (Art. 15);
- Rectify inaccurate or incomplete data (Art. 16);
- Erase your data, where one of the grounds in Art. 17 applies;
- Restrict processing (Art. 18);
- Receive your data in a portable format (Art. 20);
- Object to processing based on legitimate interest (Art. 21), including direct marketing;
- Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, email contact@flowful.ai. We respond within one month, in line with Art. 12(3) GDPR.
You also have the right to lodge a complaint with the Belgian data protection authority:
Autorité de protection des données / Gegevensbeschermingsautoriteit (APD/GBA) Rue de la Presse 35, 1000 Bruxelles www.autoriteprotectiondonnees.be
9. Security
We apply technical and organisational measures appropriate to the risk, including TLS encryption in transit, hardened server access, encrypted backups, secret management in an Ansible Vault, and continuous dependency updates. A detailed Security Overview is available on request at contact@flowful.ai.
10. Minors
Our services target businesses and are not directed at minors. We do not knowingly collect personal data from anyone under the age of 16. If you believe a minor has provided us with personal data, please contact us at contact@flowful.ai so we can delete it.
11. Changes to This Policy
We may update this privacy policy from time to time. The “Effective Date” at the top of the page reflects the latest revision. Material changes will be highlighted on the website.
12. Contact
Flowful AI Nicolas Chourrout Waterloo, Belgium contact@flowful.ai