Privacy Notice
Last updated: 21 May 2026
Who we are
DataFlow Advisory Ltd ("we", "us") operates the DataFlow Advisory platform at app.dataflowadvisory.com. We act as data processor on behalf of our customer organisations (tenants) and as data controller for platform-level data such as admin accounts and billing.
Contact: privacy@dataflowadvisory.com
What data we collect
| Category | Examples | Purpose |
|---|---|---|
| Account data | Name, email address | Authentication, communication |
| Interview responses | Answers to discovery questions, key facts extracted by AI | Generating system blueprints and recommendations |
| Voice data | Audio submitted for transcription | Converted to text in-memory; audio is not stored |
| Usage data | Pages visited, features used, API call logs | Service improvement, cost accounting, debugging |
| Cookies | Session cookie, CSRF token | Authentication, security |
Legal basis for processing
We process personal data under the following UK GDPR Article 6(1) bases:
- Contract performance (Art 6(1)(b)) — to deliver the service you or your organisation signed up for.
- Legitimate interest (Art 6(1)(f)) — for service improvement, cost tracking, fraud prevention, and debugging. We conduct balancing tests to ensure our interests do not override your rights.
- Legal obligation (Art 6(1)(c)) — to maintain audit logs as required by UK accountability rules.
- Consent (Art 6(1)(a)) — where your likeness is used in marketing content. You may withdraw consent at any time.
AI processing
Your interview responses are sent to third-party AI providers (currently via OpenRouter) to generate follow-up questions, summaries, and system blueprints. We do not use your data to train AI models. AI providers process data under our data processing agreements and do not retain input or output data beyond the API request lifecycle.
How long we keep your data
- Interview data: 24 months from completion
- User accounts: duration of contract + 12 months
- Login codes: 15 minutes
- API call logs: 36 months
- Audit logs: 36 months
- Server logs: 30 days
- Voice recordings: not stored (transcribed in real-time, then discarded)
Full retention schedule: docs/data-retention-policy.md (available on request).
Your rights
Under UK GDPR you have the right to:
- Access your personal data (Art 15)
- Rectify inaccurate data (Art 16)
- Erase your data (Art 17)
- Restrict processing (Art 18)
- Data portability — receive your data in machine-readable format (Art 20)
- Object to processing based on legitimate interest (Art 21)
To exercise any right, email privacy@dataflowadvisory.com or use the in-app support widget. We respond within 30 calendar days.
If you are unsatisfied with our response, you may complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
Data sharing
We share personal data only with:
- AI providers (OpenRouter / Anthropic) — to generate interview content
- Voice providers (OpenAI Whisper, ElevenLabs) — for speech-to-text and text-to-speech
- Infrastructure (Railway, Cloudflare) — to host and protect the service
- Google — when you connect Calendar or Gmail integrations (your explicit action)
All sub-processors operate under data processing agreements. We do not sell personal data.
International transfers
Some sub-processors are based in the United States. Transfers are protected by Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework where applicable.
Cookies
We use only strictly necessary cookies:
- Session cookie — keeps you logged in (expires after 30 days of inactivity)
- CSRF token — protects form submissions (per-request)
We do not use analytics, advertising, or tracking cookies.
Changes to this notice
We may update this notice when our data practices change. The "Last updated" date at the top reflects the most recent revision. Material changes will be communicated via the in-app notification banner.