Flowproof is an online service that scans websites for visibility in AI search engines. In this privacy statement you can read which personal data we process for that purpose, why we do so, with whom we share it and what rights you have. We do not process more data than is necessary to make Flowproof work.
This is a translation. In case of any difference, the Dutch version prevails.
Who is responsible?
Peelmedia is the controller for the personal data processed through Flowproof.
- Peelmedia, attn. Jelle Brummans
- Email: jelle@peelmedia.nl
Do you have a question about privacy or do you want to exercise one of your rights? Then send an email to jelle@peelmedia.nl.
Which data we process
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email address and password (stored only as an encrypted hash) | Creating and securing your account and letting you log in | Performance of a contract |
| Language preference | Showing Flowproof, your reports and emails in your language | Performance of a contract |
| Websites you add and the scan results | Running the scan, showing your report and comparing scores | Performance of a contract |
| Subscription and Stripe customer ID | Managing your subscription and linking invoices | Performance of a contract and legal obligation (tax records) |
| Notification preferences and a log of sent emails (recipient, subject, time, status) | Sending scan reports and notifications and checking that they arrive | Performance of a contract and legitimate interest (reliable delivery) |
| Branding details (company name, logo, colour, contact details) and client names, only with Business | Creating client reports in your own branding | Performance of a contract |
| IP address | Preventing abuse, such as too many login attempts or scans. We keep this only briefly in working memory. | Legitimate interest (security) |
You enter your payment details, such as your credit card or bank details, with Stripe. They do not reach us.
Data from scanned websites
A scan retrieves public pages, just as a search engine does: the homepage, robots.txt, sitemap.xml and llms.txt. The scanner identifies itself as FlowproofScanner. We store the technical results, such as the page title, counts and settings found, and not a full copy of the website. Are you the owner of a website that has been scanned through Flowproof and do you have a question? Then please contact us.
If you use Flowproof for a client, you are yourself responsible for the arrangements with that client. A shared client report is only accessible to those who have the link. It is not included in search engines and you can revoke the link at any time.
Cookies
Flowproof uses functional cookies that are needed for the service to work. These do not require consent. We only place analytics cookies if you click "Accept all" in the cookie banner.
| Cookie | Purpose | Retention period |
|---|---|---|
fp_session | Keeping you logged in | 30 days, or until you log out |
fp_locale | Remembering your chosen language | 1 year |
fp_consent | Remembering your cookie choice | 1 year |
Analytics with your consent
We use Google Tag Manager to manage measurement tags such as Google Analytics. This shows us which pages are visited and where visitors get stuck. We use Google Consent Mode: until you give consent, those tags do not place analytics or advertising cookies. Google Tag Manager itself does not place cookies.
If you give consent, Google services may place cookies such as _ga. Their retention periods are set out in Google's cookie information. You can change your choice at any time through "Cookie settings" at the bottom of every page. We do not load measurement tags on client reports shared by Business users.
Legal basis: consent (Article 6(1)(a) GDPR), which you can withdraw at any time.
With whom we share data
We never sell your data. We only share it with parties we need in order to provide Flowproof. We conclude a data processing agreement with each of those parties.
- Stripe processes payments and subscriptions.
- Google (Google Tag Manager and, with consent, Google Analytics): measures how the website is used.
- Email service (Resend or a comparable SMTP service): sends scan reports, notifications and account emails.
- Hosting and database provider: runs Flowproof's servers and database.
If a processor is established outside the European Economic Area, we ensure appropriate safeguards. These are the standard contractual clauses of the European Commission, or certification under the EU-US Data Privacy Framework.
We only provide data to others if the law requires us to do so.
How long we keep data
- Account, websites, scans, branding and email log: for as long as your account exists. If you delete your account in the settings, this data is deleted immediately and permanently.
- Reset and confirmation links: 1 hour (password reset) or 7 days (email confirmation), after which they are invalid.
- Invoice and payment data: 7 years, because the statutory tax retention obligation requires this.
- IP addresses for security: no more than one hour, only in working memory.
Security
We take appropriate measures to protect your data:
- We store passwords as a bcrypt hash.
- We store reset and confirmation links only as a hash and they work once.
- Connections run over HTTPS.
- Attempts at abuse are limited.
- After a password reset, all other sessions are ended.
If we nevertheless discover a data breach that poses risks to you, we will report it as required by law.
Your rights
You have the right to access, correct or have your data deleted. You can object to processing based on legitimate interest, have the processing restricted and receive your data in a common format (data portability). You can arrange much of this yourself in your settings:
- change your name and password;
- turn off email notifications;
- delete your account with all its data.
For other requests, email jelle@peelmedia.nl. We respond within one month.
Do you disagree with how we handle your data? Then you can file a complaint with the Autoriteit Persoonsgegevens (Dutch Data Protection Authority). We would appreciate it if you contact us first.
Changes
We may amend this privacy statement if Flowproof changes or if the law requires it. The date at the top shows when the statement was last changed. We will let you know by email about important changes.