Privacy Information of Flino GmbH
for the website flino.com and the application flino.io · As of: 5 November 2026
This English text is a convenience translation. Only the German version at flino.com/datenschutz is legally binding; in the event of any discrepancy, the German wording prevails.
This information explains which personal data we process when you visit our website, use our application or contact us. Part A covers general matters, Part B the website, Part C the application, Part D the data our customers process in Flino, for which we act as a processor, and Part E further matters.
Part A: General
1. Controller
Flino GmbH, Kolonnenstraße 8, 10827 Berlin, Germany
Local Court (Amtsgericht) Charlottenburg, HRB 286867 B
Represented by its managing director Emad Hendrik Ette
Phone: +49 30 826 831 87 · Email: [email protected]
We have not appointed a data protection officer because the legal requirements for doing so are not met. Please send data protection questions to [email protected].
2. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR), for example via the cookie settings in the page footer. You can lodge a complaint with a supervisory authority (Art. 77 GDPR); the authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin.
Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. You can object to processing for direct marketing purposes at any time without giving reasons; we will then no longer process your data for that purpose. An email to [email protected] is sufficient.
3. Legal bases
We state the legal basis for each processing operation. The possible bases are: consent (Art. 6(1)(a) GDPR, and additionally § 25(1) TDDDG for access to your device), contract and pre-contractual measures (Art. 6(1)(b) GDPR), legal obligation (Art. 6(1)(c) GDPR), legitimate interest (Art. 6(1)(f) GDPR) and storage on your device that is strictly necessary (§ 25(2) no. 2 TDDDG).
4. Recipients
We use service providers that process data on our behalf; we have agreements with them under Art. 28 GDPR. Where a provider processes data as an independent controller or we are joint controllers with it, we say so. On request we will name the specific recipients of your data.
5. Transfers to third countries
Some providers are based outside the EU or access data from there. We transfer data to third countries only under the conditions of Art. 44 et seq. GDPR: on the basis of an adequacy decision of the EU Commission (for the USA in the case of providers certified under the EU-U.S. Data Privacy Framework; for the United Kingdom) or the EU standard contractual clauses (Art. 46(2)(c) GDPR). For each provider we state which third country is involved.
6. Retention
We store personal data for as long as the respective purpose requires. We state the periods for each processing operation and in the overview in section 40. Retention obligations under commercial and tax law remain unaffected: we keep invoices and accounting records for eight years and commercial and business letters for six years (§ 147 AO, § 257 HGB).
Part B: Website flino.com
7. Providing the website
The website is delivered via Cloudflare. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. With every request, Cloudflare processes technically necessary data such as IP address, time, page requested, referrer, browser and operating system in order to deliver the page and protect it against attacks. We do not keep our own server logs; Cloudflare does not store request logs for us and only evaluates traffic in aggregate.
The legal basis is our legitimate interest in secure and stable delivery (Art. 6(1)(f) GDPR). Cloudflare is certified under the Data Privacy Framework; a transfer to the USA is possible.
If you choose a language, we store it in the cookie "flino_lang" for one year. This is technically necessary to display the page as requested (§ 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR).
8. Consent management (Cookiebot)
We manage your consents on the website and in the application with Cookiebot by Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. Cookiebot loads services that require consent only after you agree and stores your choice in the cookie "CookieConsent" for twelve months. As proof, Cookiebot processes a truncated IP address, date and time, browser information, the website address and your choice. The legal basis is our obligation to be able to demonstrate consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). Processing takes place in the EU. You can change your choice at any time via "Cookie settings". The overview at flino.com/cookies shows which cookies we use and for how long.
9. Audience measurement with PostHog
With your consent (category "Statistics") we measure the use of the website with PostHog. The provider is PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. The data is stored on servers in the EU (Frankfurt) and transmitted there via an address on our own domain (flino.com/ph). PostHog records pages visited, clicks, origin (referrer and campaign parameters), device, browser and approximate location and sets an identifier in a cookie and in local storage for this purpose. IP addresses are anonymised; session recordings are switched off. If you move from the website to the application, we pass on the identifier so that we can see which pages led to a registration. Without your consent, PostHog does not collect any usage data on the website.
The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). PostHog is certified under the Data Privacy Framework; access from the USA for support and maintenance is possible. PostHog stores event data for up to seven years.
10. Google Analytics 4
With your consent (category "Statistics") we use Google Analytics 4 by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google records page views, interactions, device, browser and approximate location and stores cookies for this purpose. IP addresses are truncated; Google Signals and personalised advertising are switched off on the website. Google stores the analytics data for no longer than 14 months. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Google is certified under the Data Privacy Framework; a transfer to Google LLC in the USA is possible.
11. Meta Pixel
With your consent (category "Marketing") we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, on the website and in the application. It reports page views and registrations to Meta so that we can measure the effect of ads and show visitors advertising on Facebook and Instagram. Meta can link this data to your account and use it for its own purposes. We are joint controllers with Meta for the collection and transmission (Art. 26 GDPR); the agreement is available at facebook.com/legal/controller_addendum. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Meta is certified under the Data Privacy Framework; a transfer to Meta Platforms, Inc. in the USA is possible. For the reporting of registrations to Meta, see section 22.
12. Campaign parameters and partner codes
If you arrive via a link with campaign parameters (utm_*, fbclid, gclid, msclkid), we store them in the browser for the duration of the session and append them to links to the application. This shows us which campaign led to a registration. We also record the campaign origin in PostHog if you have consented (section 9), for bookings via Cal.com (section 17) and in our CRM (sections 15 and 23).
If you arrive via a sales partner's link (?aff=…), we store the partner code in your browser's local storage for 60 days and append it to the links to registration and sign-in in the application. The application checks the code and also stores it there in local storage for up to 60 days. If you register with your email address, we link the code to your new account through a registration key. The key is valid for two hours and is deleted no later than three days after it was created. To prevent abuse, we count requests per IP address; we store the address only as a check value (hash), and the check value and the counter are usually deleted after a few hours, and after two days at the latest. If you sign in with Google or Microsoft, the application passes the code on at your first sign-in. At the first sign-in we assign the newly created account to the partner and delete the code from the application's storage. We do not assign a partner to an account that already exists. When an assigned account pays, we record that account's payments for the commission: the customer and invoice identifiers at our payment provider, the payment date, the amount paid, tax, the amount eligible for commission and the invoice line items, and for refunds and chargebacks also their amount and status. If the partner receives a fixed commission per customer, we only record the identifiers of the first paid invoice and of the payment transaction, and the payment date, and in the event of a refund or cancellation before the commission is due, that refund or cancellation with its reason and identifier. We pass a referral code (?ref=…) on to the registration link; in the application we store it in local storage for 30 days. We do not use third parties for this. The legal basis is our legitimate interest in attributing our marketing (Art. 6(1)(f) GDPR).
13. Support and contact form
Using the support form you can send us a message with up to three attachments. We process name, email address, company, optionally phone number, subject, message and attachments. The form sends the message via the email service Resend to our support mailbox; section 18 describes how it is then handled. The provider of Resend is Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA; sending takes place via servers in Ireland.
To protect against spam, Cloudflare Turnstile (provider as in section 7) checks whether the request comes from a human. Your IP address and technical characteristics of your browser are transmitted to Cloudflare for this purpose.
The legal basis is the initiation or performance of a contract (Art. 6(1)(b) GDPR), otherwise our legitimate interest in handling enquiries and in protection against abuse (Art. 6(1)(f) GDPR). Resend and Cloudflare are certified under the Data Privacy Framework; access from the USA is possible.
14. Applying as a sales partner
You can apply to become a partner at flino.com/affiliates. We process name, email address, phone number, company and the information you provide in your application. The application reaches us via Resend; Turnstile protects the form as described in section 13. The legal basis is the initiation of a contract (Art. 6(1)(b) GDPR). If no partnership comes about, we delete the data after six months.
15. Decision rate calculator
In the calculator at flino.com/rechner you can have your results sent to you by email. For this we process your email address, the figures you enter and, if provided, company and role, and send the results via Resend. The legal basis is your request (Art. 6(1)(b) GDPR).
We also create you as a contact in our CRM with this information and the campaign origin (section 23) in order to offer you a consultation if you are interested. The legal basis is our legitimate interest in maintaining business contacts (Art. 6(1)(f) GDPR). You can object to this at any time. You only receive the newsletter if you tick the separate box (section 16).
16. Newsletter
We use Brevo for our newsletter. The contracting party is Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany; processing takes place in the EU. You sign up using the double opt-in procedure: we only add you after you click the link in the confirmation email. We transmit your email address and the source of the sign-up, and for sign-ups from the calculator also company, role and your calculator figures so that we can choose suitable content. Brevo logs the time, IP address and confirmation of the sign-up and measures whether newsletters are opened and links clicked.
The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe via the link in every issue. After you unsubscribe, we keep your email address on a block list so that you receive no further newsletters (Art. 6(1)(f) GDPR).
17. Booking appointments
You book demo appointments via Cal.com. The provider is Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA. The booking window on flino.com/termin loads content directly from Cal.com; in doing so Cal.com receives your IP address and browser data. When you book, Cal.com processes name, email address, appointment and the information you enter in the booking form and creates the calendar invitation. If you have consented to statistics, we pass on the PostHog identifier from section 9. After the booking, Cal.com transmits the booking data to us; we create you as a contact and sales opportunity in our CRM (section 23) and record the booking in PostHog.
The legal basis is the initiation of a contract at your request (Art. 6(1)(b) GDPR). Cal.com is certified under the Data Privacy Framework; the data is processed in the USA.
18. Contact by email and support system
If you email us, we process your information in order to deal with your request. Our emails run via Google Workspace by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We handle emails to [email protected] in our own support system. It stores requests with Supabase (section 21) on servers in Ireland and has reply drafts created by Google Vertex AI in EU data centres; the provider is Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland. Every reply is checked and approved by an employee before it is sent.
The legal basis is the initiation or performance of a contract (Art. 6(1)(b) GDPR), otherwise our legitimate interest in handling enquiries efficiently (Art. 6(1)(f) GDPR). Google and Supabase may access data from third countries for support and maintenance; the Data Privacy Framework or standard contractual clauses apply. We keep requests for as long as follow-up questions are to be expected and then delete them, unless there is a retention obligation for business letters.
19. Support hotline
You can reach our support hotline at +49 30 826 831 87. Calls are answered by an AI-based phone assistant of fonio GmbH, Neustiftgasse 73-75/3/7, 1070 Vienna, Austria. At the start of the call you are told that you are speaking to an AI assistant and that the call is recorded. We process your phone number, time and duration of the call, your language, the transcript created from it and the information you give during the call. fonio processes the data in data centres in the EU and does not use it for training. Recordings are deleted after 30 days, transcripts after 90 days and connection data after six months.
The legal basis is the initiation or performance of a contract (Art. 6(1)(b) GDPR), otherwise our legitimate interest in a reachable hotline (Art. 6(1)(f) GDPR). If you do not want to speak to an AI assistant or be recorded, end the call and write to us at [email protected].
Part C: Application flino.io
This part concerns your data as a user of the application. Your company is the controller for the data of your business contacts that you process in Flino; see Part D.
20. Registration and user account
For an account we process first and last name, email address and password (stored only as a hash). If you sign in via Google or Microsoft, we receive name and email address from there. Before first use we ask new customers for their phone number so that we can reach them with questions about the setup; for invited team members it is optional. We collect the company name at the latest when a paid plan is booked; you can optionally provide your role and a profile picture. At registration we store which version of the terms and of this privacy information you confirmed, together with time, language and browser identifier. We send confirmation, sign-in and password emails via Resend (section 13).
The legal basis is the user agreement (Art. 6(1)(b) GDPR); we keep the proof of consent because we are legally required to (Art. 6(1)(c) GDPR). If you invite team members, we process their name and email address to send the invitation.
To keep you signed in, the application stores a session key in your browser's local storage; this is technically necessary (§ 25(2) no. 2 TDDDG). You can request deletion of your account by email to [email protected].
21. Technical infrastructure
The application runs on these services, which act as processors for us:
| Service | Purpose | Data location | Third country |
|---|---|---|---|
| Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513 | Database, file storage, authentication, server functions; logs of requests to the application with IP address for operation and security, no longer than 28 days | Frankfurt am Main; support system in Ireland | Access from Singapore and the USA for support and maintenance possible; standard contractual clauses |
| Cloudflare, Inc. (section 7) | Delivery of the interface, protection against attacks | Global network | USA, Data Privacy Framework |
| Google Cloud EMEA Limited (section 18) | AI processing (section 33), interface for AI assistants (section 28), notification of new Gmail messages | Frankfurt, Belgium, EU data centres | Access by Google LLC possible; Data Privacy Framework |
The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR) and our legitimate interest in secure operation (Art. 6(1)(f) GDPR).
22. Usage analysis and marketing in the application
In the application, too, we ask for your consent via Cookiebot (section 8). Without consent, the following services do not load.
PostHog (category "Statistics"): We record which features you use, as well as technical errors. For this we create a user profile with user ID, name, email address, company, role and plan. Texts and inputs on screen are not recorded, session recordings are switched off. Provider, location and retention as in section 9.
Google Analytics 4 (category "Statistics"): Provider, data collected and retention as in section 10, with a separate property for the application.
Meta Pixel (category "Marketing"): as in section 11. If you have consented to marketing, we also report the completion of your registration directly from our server to Meta (Conversions API). In doing so we transmit your email address and user ID only as a checksum (hash), as well as IP address, browser identifier, the Meta cookies "_fbp" and "_fbc" and the page address.
LinkedIn Insight Tag (category "Marketing"): It measures whether a registration goes back to an ad on LinkedIn and enables advertising to similar audiences. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn can link the data to your LinkedIn account. We are joint controllers with LinkedIn for the collection and transmission of the data (Art. 26 GDPR); LinkedIn takes on informing data subjects about its own processing and handling data subject requests. LinkedIn is certified under the Data Privacy Framework; a transfer to the USA is possible.
The legal basis for these services is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). The overview at flino.com/cookies shows the cookies used and their lifetimes.
Server-side usage events: Independently of the banner, we log on our servers when key steps happen in the product, for example registration confirmed, offer created, follow-up email sent, reply received, as well as technical errors and AI response times. These events carry your user and company ID but no content of offers or emails, and are stored in PostHog in the EU. We use them to monitor operations, find errors, check billing and improve the product. Your device is not accessed in the process. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).
23. Customer relationship, CRM and personal outreach
After your registration is confirmed, we create you as a contact in our CRM system with name, email address and phone number. We also manage contacts from bookings, the calculator and the partner programme there. Our CRM provider is based in the United Kingdom and may also process data in the USA; an adequacy decision applies to the United Kingdom and standard contractual clauses apply to the USA. The legal basis during the business relationship and its initiation is the user agreement (Art. 6(1)(b) GDPR), afterwards our legitimate interest in contacting you again (Art. 6(1)(f) GDPR). We store the data for as long as the business relationship exists, then for as long as we have a legitimate interest in contacting you again, and beyond that until statutory retention periods expire.
Personal outreach: We would like to support you personally when you get started, by email from the founder. For this purpose we transfer your email address and your user ID to a sales automation provider. It sends these emails on our behalf from the founder's mailbox and flags you in our CRM system for follow-up. The provider is based in the USA; the transfer is based on standard contractual clauses. We do not add information from other sources to your data in the process.
The legal basis for outreach is our legitimate interest in looking after new customers (Art. 6(1)(f) GDPR). You can object at any time, by email to [email protected] or via the unsubscribe link in our emails; we will then stop the outreach. We delete the information relating to outreach together with your account or after your objection.
24. Onboarding emails
After registration we send you emails over a few weeks that help you get started: welcome, tips on features you have not used yet, a reminder after inactivity, an offer of a demo, notes after successes and, in the free plan, a note about the paid plans. Which emails you receive depends on which steps you have already taken in the product. The sending service is Resend (section 13). The legal basis is the user agreement (Art. 6(1)(b) GDPR), and for the notes about our plans our legitimate interest (Art. 6(1)(f) GDPR). Every email contains an unsubscribe link; you can object to these emails at any time.
25. Payment
We bill paid plans via Stripe. The provider is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You enter payment and billing details directly with Stripe; we do not receive card or account details. We store your Stripe customer ID, plan, term, payment status and, for company accounts, the billing email. Stripe processes payment data as an independent controller for fraud prevention and to meet its own legal obligations. The legal basis is the contract (Art. 6(1)(b) GDPR) and obligations under commercial and tax law (Art. 6(1)(c) GDPR). Stripe is certified under the Data Privacy Framework; a transfer to Stripe, Inc. in the USA is possible.
26. Purchase via Microsoft Marketplace
If you buy Flino via Microsoft Marketplace, we receive from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, the ID of your Microsoft tenant, the email addresses of purchaser and beneficiary, plan and term. We use them to set up and bill the subscription (Art. 6(1)(b) GDPR) and keep them for the duration of the subscription and thereafter until statutory retention periods expire. Microsoft handles ordering and payment. Microsoft is certified under the Data Privacy Framework.
27. Referral and partner programme
If you register via a partner or referral link (section 12), we store the code with your account. Whoever referred you via the referral programme receives a credit after your first paid invoice and sees your email address, the status (registered, paying) and the date in their account, never your content. We credit a commission to a referring sales partner, depending on the partner agreement either once, if your company still has a paid plan 90 days after the first paid invoice, or on an ongoing basis as a share of your payments; the sales partner receives no data about you. For partners we store name, contact and payout details for the duration of the partnership and thereafter until statutory retention periods expire. The legal basis is the partner agreement or our legitimate interest in correct billing (Art. 6(1)(b) and (f) GDPR).
28. Interface for AI assistants
Users of the paid plans can connect AI assistants such as Claude, ChatGPT or Copilot to their Flino account. Sign-in runs via Auth0 by Okta, Inc., 100 First Street, San Francisco, CA 94105, USA, with a one-time code sent to your email address; Auth0 stores the data in the EU and sends the code via Resend. Alternatively, you can create a personal access key in Flino. The interface runs on Google Cloud in Belgium. Through it the assistant can read offers, company names, pipeline figures, due follow-ups, replies and contact names and, if you enable it for your organisation, pause, resume and reschedule sequences, change status, create notes and reply drafts and undo changes. The assistant does not send emails. Every access is logged; we keep the logs for the lifetime of your account.
The legal basis is the user agreement (Art. 6(1)(b) GDPR). What the assistant does with the data it reads is governed by the terms of its provider, which you choose yourself. Okta is certified under the Data Privacy Framework; access from the USA is possible.
29. Support chat and voice input
In the application an AI assistant answers your questions about using Flino. It receives your question and information about your account and your offers so that it can help specifically; the answer is generated by Google Vertex AI in the EU (section 33). We store the chat history for 30 days.
You can dictate notes, call logs and chat questions. The audio is transmitted directly from your browser to Deepgram and converted into text there; in the voice mode of the support chat, Deepgram also reads out the answer and receives the answer text for this. The provider is Deepgram, Inc., 548 Market St, Suite 25104, San Francisco, CA 94104, USA. We use only Deepgram's data centre in the EU and have switched off use for model improvement; audio and text are held at Deepgram only for the duration of processing. Deepgram stores usage data without content for 90 days; standard contractual clauses apply to administrative access from the USA. We do not store recordings, only the recognised text.
The legal basis is the user agreement (Art. 6(1)(b) GDPR).
30. Ratings of AI drafts
You can rate AI drafts (good, edited, bad) and give a short reason. We evaluate these ratings and technical metadata of AI calls across all customers in order to improve the quality of the AI features. We do not use the content of emails and offers for this. The legal basis is our legitimate interest in a better product (Art. 6(1)(f) GDPR). We delete ratings together with your account; we keep metadata without content for as long as it is needed for quality assurance and abuse checks.
Part D: Data our customers process in Flino
31. Our role
In Flino our customers manage their offers and their communication with their business contacts. The respective customer is the controller for this data; we process it as a processor on its instructions on the basis of an agreement under Art. 28 GDPR. If you have received an offer and have questions about your data, please contact the company that sent you the offer. We forward requests that reach us to that company. The following sections describe how Flino processes this data so that our customers can meet their information obligations.
32. Connecting the mailbox
If a user connects their Google or Microsoft 365 mailbox, Flino sends offer and follow-up emails from that mailbox and recognises replies from recipients. For this, Flino reads newly received messages (sender, recipients, subject, text) and assigns replies to offers. Flino also imports emails that the user labels or categorises as "Flino". With Google, a notification service reports new messages; with Microsoft, Flino checks the mailbox every five minutes. With calendar access, Flino checks free times and creates appointments on request; Flino reads Google Drive files only if the user selects them.
We store access tokens encrypted with AES-256. We keep email texts in full for 90 days and then shorten them to the first 5,000 characters. We delete attachments of sent emails 30 days after sending, unsent ones after 48 hours. The connection can be removed at any time in Flino or in the Google or Microsoft account.
Flino's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell this data, do not use it for advertising and do not use it to train AI models.
33. AI processing
Flino uses AI to read offer PDFs, write follow-up emails and reply drafts, classify replies and summarise notes. For this, offer content, names and companies of contacts, reply texts and notes are transmitted to Google Vertex AI (provider: Google Cloud EMEA Limited, section 18). Processing takes place exclusively in EU data centres; our own relay service in Frankfurt technically does not allow any region outside the EU. Google does not use the inputs for training. Google may hold inputs in memory for up to 24 hours to speed up repeated requests, and may store and review for a limited time inputs that automated systems flag as possible abuse. For AI calls we store only metadata such as model, duration and result, not the text.
Whether a draft is sent is decided by the user or by the sequence the user has set up.
34. Connecting other systems
Users can connect Flino to CRM, ERP and accounting systems and automation services. Flino then imports offers, offer PDFs and the related customer and contact data (name, email address, phone number) and writes status information (sent, won, lost) back with a note. The customer has engaged these systems itself.
35. Offer page
Recipients open an offer via a personal link on a Flino page. We set no cookies there and load no analytics or advertising services. For the sender we log which parts of the page were opened (for example offer opened, terms read, appointment link clicked), without IP address and without device identifier, and delete these logs after twelve months.
For every decision we store acceptance or rejection, time and checksums of offer and terms; for a rejection also reason and comment. If the sender has set up acceptance with name or signature, on acceptance we also store name, company, role, email address, browser identifier and, if applicable, the signature as an image, and create a record document from it. On acceptance the confirmation is sent to the recipient by email via Resend unless the sender has switched this off. We do not store the IP address.
Follow-up emails contain by default a link with which recipients can unsubscribe from further automatic emails about an offer. We do not track email opens.
36. Satisfaction survey
After a decision, the sender can send a short survey to the recipient; it is sent via the sender's mailbox. We store the rating (0 to 10) and comment, without IP address. On the survey page we ask for consent via Cookiebot (section 8); without consent, no analytics or advertising services load there.
37. Company accounts
In the Team plan, owners and administrators of a company account can view the offer-related data of their employees, including the content of offer-related emails. The respective company informs its employees about this. Flino staff see extracts of customer data only to the extent necessary for support and troubleshooting; access via our admin area is logged.
Part E: Further information
38. Company pages on social networks
We maintain pages on LinkedIn, Facebook, Instagram and YouTube. If you visit them, the operator processes your data under its own terms and provides us with aggregated statistics. We are joint controllers with the operator for these statistics (Art. 26 GDPR). The legal basis is our legitimate interest in a presence on social networks (Art. 6(1)(f) GDPR). You can exercise your rights against us or against the operator; we forward requests made to us. The operators may transfer data to the USA.
- LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland; privacy policy: linkedin.com/legal/privacy-policy; page analytics agreement: legal.linkedin.com/pages-joint-controller-addendum
- Facebook and Instagram: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; privacy policy: facebook.com/privacy/policy; page insights agreement: facebook.com/legal/terms/page_controller_addendum
- YouTube: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; privacy policy: policies.google.com/privacy
39. Security
We transmit data encrypted (TLS) and store it encrypted. Access tokens for mailboxes and connected systems are additionally encrypted with AES-256. Access to customer data is technically restricted to the respective account; administrative access to our cloud services is protected with two-factor authentication. An external provider carries out penetration tests several times a year; the application has been assessed under Google's CASA process.
40. Retention overview
| Data | Retention |
|---|---|
| Website server logs | no own storage; Cloudflare does not store request logs for us |
| Logs of requests to the application | no longer than 28 days |
| Language choice (cookie "flino_lang") | 1 year |
| Cookie consent | 12 months |
| Google Analytics | no longer than 14 months |
| PostHog events | up to 7 years |
| Partner code / referral code in the browser | 60 days / 30 days |
| Support requests | as long as follow-up questions are to be expected; business letters 6 years |
| Hotline | recordings 30 days, transcripts 90 days, connection data 6 months |
| Partner applications without partnership | 6 months |
| Partner data | duration of the partnership, then statutory retention periods |
| Newsletter | until unsubscribed, then email address on block list |
| Contacts in the CRM | duration of the business relationship, then as long as there is a legitimate interest in contacting again, beyond that until statutory periods expire |
| Information relating to personal outreach | until account deletion or objection |
| User account and content | until the account is deleted |
| Email texts in Flino | 90 days in full, then shortened to 5,000 characters until account deletion |
| Email attachments | 30 days after sending, unsent 48 hours |
| Offer page click logs | 12 months |
| Logs of the AI assistant interface | lifetime of the account |
| Support chat | 30 days |
| Voice recordings | not stored |
| Ratings of AI drafts | until account deletion |
| Metadata of AI calls | as long as needed for quality assurance and abuse checks |
| Data from Microsoft Marketplace | duration of the subscription, then statutory retention periods |
| Invoices and accounting records | 8 years |
| Proof of consent to terms and privacy information | up to 3 years after the contract ends |
41. Changes
We update this information when our processing changes. The version published here applies. Where this information is available in other languages, the German version prevails.