Privacy Notice

Last updated: 21 May 2026

Who we are

DataFlow Advisory Ltd ("we", "us") operates the DataFlow Advisory platform at app.dataflowadvisory.com. We act as data processor on behalf of our customer organisations (tenants) and as data controller for platform-level data such as admin accounts and billing.

Contact: privacy@dataflowadvisory.com

What data we collect

Category	Examples	Purpose
Account data	Name, email address	Authentication, communication
Interview responses	Answers to discovery questions, key facts extracted by AI	Generating system blueprints and recommendations
Voice data	Audio submitted for transcription	Converted to text in-memory; audio is not stored
Usage data	Pages visited, features used, API call logs	Service improvement, cost accounting, debugging
Cookies	Session cookie, CSRF token	Authentication, security

Legal basis for processing

We process personal data under the following UK GDPR Article 6(1) bases:

Contract performance (Art 6(1)(b)) — to deliver the service you or your organisation signed up for.
Legitimate interest (Art 6(1)(f)) — for service improvement, cost tracking, fraud prevention, and debugging. We conduct balancing tests to ensure our interests do not override your rights.
Legal obligation (Art 6(1)(c)) — to maintain audit logs as required by UK accountability rules.
Consent (Art 6(1)(a)) — where your likeness is used in marketing content. You may withdraw consent at any time.

AI processing

Your interview responses are sent to third-party AI providers (currently via OpenRouter) to generate follow-up questions, summaries, and system blueprints. We do not use your data to train AI models. AI providers process data under our data processing agreements and do not retain input or output data beyond the API request lifecycle.

How long we keep your data

Interview data: 24 months from completion
User accounts: duration of contract + 12 months
Login codes: 15 minutes
API call logs: 36 months
Audit logs: 36 months
Server logs: 30 days
Voice recordings: not stored (transcribed in real-time, then discarded)

Full retention schedule: docs/data-retention-policy.md (available on request).

Your rights

Under UK GDPR you have the right to:

Access your personal data (Art 15)
Rectify inaccurate data (Art 16)
Erase your data (Art 17)
Restrict processing (Art 18)
Data portability — receive your data in machine-readable format (Art 20)
Object to processing based on legitimate interest (Art 21)

To exercise any right, email privacy@dataflowadvisory.com or use the in-app support widget. We respond within 30 calendar days.

If you are unsatisfied with our response, you may complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

Data sharing

We share personal data only with:

AI providers (OpenRouter / Anthropic) — to generate interview content
Voice providers (OpenAI Whisper, ElevenLabs) — for speech-to-text and text-to-speech
Infrastructure (Railway, Cloudflare) — to host and protect the service
Google — when you connect Calendar or Gmail integrations (your explicit action)

All sub-processors operate under data processing agreements. We do not sell personal data.

International transfers

Some sub-processors are based in the United States. Transfers are protected by Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework where applicable.

Cookies

We use only strictly necessary cookies:

Session cookie — keeps you logged in (expires after 30 days of inactivity)
CSRF token — protects form submissions (per-request)

We do not use analytics, advertising, or tracking cookies.

Changes to this notice

We may update this notice when our data practices change. The "Last updated" date at the top reflects the most recent revision. Material changes will be communicated via the in-app notification banner.