Privacy policy
This policy explains what this website collects, why, how long it is kept and what you can demand of us. It covers flowmentum.net only; work we do for clients is governed by the agreement with that client.
Who is responsible
Flowmentum ("Flowmentum", "we"). Contact for any privacy matter: privacy@flowmentum.net (general enquiries: info@flowmentum.net).
The site is hosted on a dedicated server operated by Contabo GmbH, Germany (EU). We are the data controller for everything described here.
What we collect, and why
| What | When | Why (legal basis) | Kept for |
|---|---|---|---|
| The messages you type in the chat, the language you are reading, and which page you opened it from | Only if you start a chat | To answer you and follow up (your consent, and our legitimate interest in responding to enquiries) | 180 days |
| A one-way, keyed hash of your IP address and your browser’s user-agent string | When you start a chat or send the contact form | Abuse prevention and rate limiting (legitimate interest). The hash is keyed, so it cannot be reversed into an IP address | 180 days |
| Name, the email or phone you give us, company (optional) and your message | Only if you send the contact form, or type contact details into the chat | To reply to your enquiry and take steps before a contract (Art. 6(1)(b)/(f) GDPR) | Until handled, then up to 24 months |
| Your phone number and a temporary one-time code | Only for existing clients signing in to the client area | To authenticate you (performance of our contract with you) | The number for as long as you are a client; the code for 5 minutes |
| Strictly necessary cookies | See the cookie policy | To keep you signed in, keep your chat attached to this browser, and remember your cookie choice | Up to 30 days (chat), 14 days (sign-in), 12 months (consent record) |
| Web-server logs: IP address, timestamp, requested path, status, user-agent | Every request, like any web server | Security, abuse investigation and debugging (legitimate interest) | 14 days |
We do not use advertising or analytics cookies, we run no third-party trackers, fingerprinting or session recording, and the site loads no fonts, scripts, images or frames from anyone else’s server. Nothing is sold or rented to anybody, ever.
The chat assistant and AI processing
The chat is answered by an AI assistant. To produce an answer, the text of your conversation is sent to Google’s Gemini API, which acts as our processor for that purpose; Google states that content submitted through the paid Gemini API is not used to train its models. A person at Flowmentum can read the conversation and may join it. Please do not type passwords, ID numbers, payment details or medical information into the chat — it is a sales desk, not a secure portal.
No decision that has a legal or similarly significant effect on you is made automatically. The assistant cannot enter into a contract, quote a binding price or commit us to anything.
Who else sees your data
- Google Ireland Limited / Google LLC — Gemini API, to generate chat answers.
- Meta Platforms Ireland Limited — if we notify ourselves of your enquiry by WhatsApp, or send you a one-time login code by WhatsApp. The content of that notification includes what you wrote.
- Contabo GmbH, Germany (EU) — hosting of the server the site runs on.
- A mobile network operator, if a login code has to fall back to SMS.
We do not use any other processor for this website, and we disclose data to authorities only where the law actually requires it.
International transfers
Our server is in the European Union. Israel has been recognised by the European Commission as providing an adequate level of protection, so transfers between the EU and Israel need no further mechanism. Transfers to Google and Meta rely on those companies’ Standard Contractual Clauses and supplementary measures.
Your rights
Wherever you are, you may ask us to show you the personal data we hold about you, correct it, delete it, or stop using it; you may withdraw consent at any time; and you may object to processing based on legitimate interest. Under the GDPR you additionally have the rights to restriction and to portability. Under the Israeli Privacy Protection Law you have the right to review your data and to demand its correction or deletion.
Write to privacy@flowmentum.net and we will answer within 30 days. There is no charge. We may ask you to confirm the contact detail you originally used, so that we do not disclose someone else’s conversation to you.
If you are unhappy with our answer, you can complain to the Israeli Privacy Protection Authority (the PPA) or, in the EU/EEA, to your local supervisory authority.
How we protect it
- HTTPS everywhere, with HSTS; the site is not reachable over plain HTTP.
- Session cookies are HttpOnly, Secure, SameSite and host-locked, so page scripts cannot read them and another site cannot replay them.
- One-time login codes are hashed before storage, expire in 5 minutes, and are attempt-limited.
- IP addresses are hashed with a secret key before they are stored, and never appear in the database in the clear.
- The database is on an encrypted-at-rest volume with restricted file permissions, and only the application user can read it.
- A strict Content-Security-Policy means the page cannot execute third-party code even if someone managed to inject a script tag.
Children
This is a business-to-business site and is not directed at children. We do not knowingly collect data about anyone under 16; if you believe we have, write to privacy@flowmentum.net and it will be deleted.
Changes
If we change what we collect, we change this page in the same release and update the date below. Material changes are announced on the home page.
Last updated: