Privacy Policy

This policy explains what personal data FlowAuto collects, why, how we protect it, and the rights you have over it. It covers both people who sign up for FlowAuto and the contacts our customers store inside the product.

1. Who we are

FlowAuto is a customer-relationship-management (CRM) application for small businesses, operated by FirnTech (“FirnTech”, “we”, “us”). For the purposes of data-protection law, we are the data controller of the account data you give us directly, and a data processor acting on our customers’ instructions for the contact and business data they load into their workspace (see section 9).

Legal entity: [registered company name], registered at [registered address] (company/registration no. [number]). Data-protection contact: privacy@firntech.org.

2. The data we collect

Information you give us

• Account & identity: your email address, name, and phone number (collected at sign-up and onboarding), and the name of your workspace.
• Workspace content you create: contacts (names, emails, phone numbers, companies, tags, custom fields), deals, tasks, appointments, notes, activity logs, marketing campaigns, and automation/workflow configurations.
• Support & communications: messages you send our in-app assistant or email to us.

Information collected automatically

• Technical & security data: IP address, browser/device information, and request logs, used to keep the service running, secure it, and prevent abuse.
• Essential cookies & local storage: to keep you signed in and remember your preferences — see our Cookie Notice.

Payment information

Payments are processed by Stripe. Your full card details are entered on Stripe’s systems and are never stored on, or transmitted through, FlowAuto’s servers. We retain only a Stripe customer/subscription identifier and your plan status.

3. How we use your data

• To provide, operate, and maintain the CRM and your account.
• To authenticate you and keep the service secure (including abuse and fraud prevention).
• To power AI features you choose to use (see section 4).
• To process payments and manage subscriptions.
• To respond to your support requests and send essential service notices.
• To comply with legal obligations.

Our legal bases (where the GDPR applies) are: performance of our contract with you, our legitimate interests in running and securing the service, your consent (where asked), and compliance with legal obligations. Under Malaysia’s Personal Data Protection Act 2010 (PDPA), we process personal data for these purposes with your consent and as necessary to provide the service.

4. AI features

Some features — deal scoring, follow-up and campaign drafting, the workflow copilot, and the in-app support assistant — send relevant workspace content (for example a deal’s title, a contact’s name, and recent activity) to our AI sub-processor, Anthropic, to generate a result. These outputs are drafts and suggestions shown back to you; FlowAuto does not send emails or take external actions on your behalf. We do not use your data to train AI models, and our AI provider is engaged under terms that do not permit training on your inputs.

5. Who we share data with (sub-processors)

We do not sell your personal data. We share it only with the service providers that make FlowAuto work:

We may also disclose data where required by law, to enforce our terms, or to protect the rights and safety of FlowAuto, our customers, or others.

6. International transfers

Your data is stored primarily in Singapore. Some sub-processors (e.g. Anthropic, Stripe) process data in other countries, including the United States. Where such transfers occur, we rely on appropriate safeguards (such as the providers’ contractual data-protection commitments).

7. How long we keep it

We keep your account and workspace data for as long as your account is active. If you close your account, we delete or anonymise your personal data within [retention period, e.g. 30–90 days], except where we must retain certain records longer to meet legal, tax, or accounting obligations. You can export your data at any time (section 8).

8. Your rights

Depending on where you live, you may have the right to access, correct, update, delete, restrict, or object to our processing of your personal data, to withdraw consent, and to data portability. FlowAuto is built around data ownership: you can export your contacts (CSV) and your full workspace (JSON) from within the app at any time.

To exercise any right, email privacy@firntech.org. We will respond within the timeframe required by applicable law. You also have the right to lodge a complaint with your data-protection authority (in Malaysia, the Personal Data Protection Department / Jabatan Perlindungan Data Peribadi).

9. If you are a FlowAuto customer’s contact

When a business uses FlowAuto to manage its relationships, it loads its own contacts’ details into the product. For that data, the business is the data controller and FlowAuto is the processor acting on its instructions. If you are one of those contacts and want to access or delete your data, please contact the business you deal with directly; we will support them in responding.

10. Security

We protect data with encryption in transit (HTTPS), strict per-workspace access controls so one customer can never see another’s data, server-side secret management, security response headers, and rate limiting. No method of transmission or storage is completely secure, but we work to protect your data and review our practices regularly.

11. Children

FlowAuto is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under [16/18].

12. Changes to this policy

We may update this policy from time to time. We will change the “last updated” date above and, for material changes, notify you in-app or by email.

13. Contact us

Questions about this policy or your data? Email privacy@firntech.org.