Who we are
flowpartner.ai is the trading name of [legal company name], a company registered in England and Wales (company number [number]), registered office [address]. We are registered with the Information Commissioner’s Office (registration number [ICO number]).
This policy explains how we handle personal data when you use our website or work with us, and how we keep your systems and data safe when we build AI and automation for you. If you have any questions, email [privacy email].
What we collect
- When you contact us or book a call: your name, work email, company, phone number and anything you tell us about your business. Bookings are handled through Calendly.
- When you use the Admin Drain Calculator: your full name, work email, industry and the figures you enter (team size, average salary and admin hours).
- On calls and in emails: notes of what we discuss. We only record a call with your consent.
- When you visit the website: basic technical and usage data, such as pages visited and device type, through essential and, with your consent, analytics cookies.
How we use it, and our lawful basis
- To reply to you, send your Admin Drain Report and prepare your Time-Back Audit: to take steps at your request before entering a contract, and our legitimate interest in responding to enquiries.
- To deliver our services: to perform our contract with you.
- To send relevant updates about our services: our legitimate interest for business contacts, or your consent where required. Every email includes an easy way to unsubscribe, in line with PECR.
- To meet legal, tax and accounting obligations: legal obligation.
We never sell your personal data.
Who we share it with
We use a small number of trusted providers to run our business. They only process your data on our instructions:
- Scheduling (Calendly)
- Email, calendar and documents ([Google Workspace or Microsoft 365])
- Our CRM ([CRM name])
- Automation platforms (n8n or Make)
- AI tools (such as Anthropic Claude or OpenAI) on business or API plans that do not use your data to train their models
Some of these providers may process data outside the UK. Where they do, we rely on UK adequacy regulations or the International Data Transfer Agreement (or equivalent safeguards).
How long we keep it
- Enquiries and Admin Drain Reports: up to [24 months] after our last contact, unless we start working together.
- Client records and contracts: [6 years] after the end of our contract, to meet legal and tax requirements.
- Call recordings (where you consented): [90 days], unless you ask us to delete them sooner.
Your rights
Under UK GDPR you have the right to access, correct or delete your personal data, to restrict or object to how we use it, to data portability, and to withdraw consent at any time. To exercise any of these rights, email [privacy email]. We’ll respond within one month.
If you’re not happy with how we’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk. We’d appreciate the chance to put it right first.
Cookies
We use essential cookies to make the website work. We only use analytics or marketing cookies with your consent, and you can change your choice at any time from the cookie banner.
Security: your systems and your data
When we build AI and automation for you, we usually act as your data processor. We sign a data processing agreement before we touch any personal data, and we work to these principles:
- Your accounts, your data. Everything runs in accounts you own. Where you need a new tool, it’s set up in your name.
- Least privilege. We use named user accounts with only the access each system needs, protected by multi-factor authentication. You can revoke access at any time, and we remove our access at the end of each project unless you’re on a support plan.
- A person in the loop. Anything customer-facing is written by you or approved by a person before it’s sent.
- Sensitive data rules. We agree with you what goes into your Company Brain and AI tools, what stays out, and who can see what.
- Lawful contact. Before any campaign, we confirm the lawful basis for contact, apply suppression lists and include an opt-out on every email (UK GDPR and PECR).
- Recording consent. Where note takers or call recording are used, we help you set up the consent your customers and staff need.
Five questions before any AI agent touches a customer
Every AI agent and workflow we build is signed off against five questions:
- What can it see? Which systems, records and conversations. Least privilege by default.
- What can it do without asking? Read, propose or act, with per-tool permissions and run limits.
- Where does it run, and where does the data go? Region, providers and retention, documented.
- What does it log? Every action, attributable and reviewable.
- Who approves, and where is the off switch? A named person, and an off switch we’ve tested.
Where new AI processing is likely to be high risk, we’ll help you complete a data protection impact assessment (DPIA) before it goes live.
How we protect our own systems
- Multi-factor authentication on every business account
- A password manager for all credentials, which are never shared by email or chat
- Encrypted devices with automatic updates
- Access reviews at the end of every project
If something goes wrong
If we become aware of a personal data breach affecting your data, we’ll tell you without undue delay, with the details you need to meet your own obligations, including reporting to the ICO within 72 hours where required.