Privacy policy
Last updated 5 October 2026
What personal data FlowAttend collects, why, how long we keep it, and what rights you have.
1. Who we are
FlowAttend is an online service for digital training attendance sheets, run by [FlowAttend legal entity], [registered address], [registration number] (“FlowAttend”, “we”).
For any question about your data, write to support@flowattend.com. We answer within one month.
2. Our two roles
- For people who use FlowAttend (account holders, team members, website visitors, people who write to us), FlowAttend decides why and how their data is used: we are the controller (sections 3 and 5–11).
- For participants and trainers who sign an attendance sheet, the company or organisation that runs the training decides: it is the controller, and FlowAttend processes the data on its behalf as a processor, under our data processing agreement (section 4).
3. Data we collect as controller, and why
| What | Data | Why | Legal basis (GDPR art. 6) |
|---|---|---|---|
| Your account | Name, email, password (handled by our authentication provider) or Google sign-in, plan | To create and run your account | Contract (1)(b) |
| Your settings | Saved trainer signature, company name, address, website and logo, PDF naming, session form settings | To put them on your attendance sheets | Contract (1)(b) |
| Your sessions | Training name, date, times, location, trainer name and details | To provide the service | Contract (1)(b) |
| Your team | Email addresses you invite, members’ roles | To give your team access | Contract (1)(b) |
| Contact form and emails to us | Name, email, message | To answer you | Legitimate interest (1)(f): replying to requests |
| Feedback in the app | Your message and account email | To improve FlowAttend | Legitimate interest (1)(f) |
| Security | IP address, linked to sign-in, signing and export attempts, kept 1 day; short-lived server logs at our hosting provider | To prevent abuse and keep the service secure | Legitimate interest (1)(f) |
| Billing, when paid plans start | Billing details, invoices | To invoice and keep accounting records | Contract (1)(b), legal obligation (1)(c) |
We don’t sell your data, use it for advertising, or build profiles.
4. If you signed an attendance sheet
When you sign an attendance sheet with FlowAttend, we process your data for the company or organisation that runs the training. It decides what the data is used for, and you should contact it first to exercise your rights. On trainings prepared for INFPC co-funding in Luxembourg, it shows you its own data protection notice before you sign.
What we store for it:
- Participants: first and last name, signature and, if asked, whether you are employed outside Luxembourg. To stop the same phone signing twice, your browser keeps a random identifier; it contains no personal information.
- External trainers: name, signature, date of signing and, for external trainings, your organisation’s country and, in Luxembourg, its name.
- On Luxembourg co-funding trainings: that you accepted the data protection notice.
Your name and signature are deleted automatically 7 days, 3 months or 18 months after the training, depending on the organiser’s plan, or earlier if the organiser deletes the session. If you write to us about a sheet, we forward your request to the organiser.
5. Who receives the data
Only the service providers we need to run FlowAttend, under contract and on our instructions:
| Provider | What they do | Where the data is |
|---|---|---|
| Supabase, Inc. | Database, file storage, sign-in | European Union |
| Railway Corporation | Hosting of the application | European Union (Amsterdam) |
| Resend, Inc. | Sending emails (sheets by email, team invitations, replies to contact messages) | European Union (Ireland) |
| Google LLC (Gmail) | Our support mailbox: messages sent to support@flowattend.com and through the contact form | May be outside the EEA (section 6) |
If you sign in with Google, Google shares your name and email with us, under Google’s own privacy policy. Inside a team, members see the sessions and sheets of their team. We disclose data to authorities only when the law requires it.
6. Transfers outside the European Economic Area
Your data is stored, and our emails are sent, in the European Union. Messages you send to our support address are kept in Gmail, whose servers may be outside the EEA. Our providers are US companies and may access data from outside the EEA for support or maintenance. These transfers are covered by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission’s Standard Contractual Clauses. You can ask us for a copy of the safeguards used.
7. How long we keep data
| Data | Kept |
|---|---|
| Account, settings and sessions | While your account is open; deleted within 30 days after you ask us to close it |
| Participants’ names and signatures | 7 days (Free), 3 months (Pro) or 18 months (Team) after the training |
| Contact messages and feedback | 2 years after our last exchange |
| IP addresses for abuse prevention | 1 day |
| Invoices, when paid plans start | 10 years, as Luxembourg accounting law requires |
8. Security
All connections use HTTPS. Each account sees only its own sessions and sheets, and signing pages show nothing about other participants. Saved signatures are kept in private storage, and attempts to abuse sign-in or signing are rate-limited. If a breach puts your data at risk, we inform you, and the organiser of the training where relevant, as the GDPR requires.
9. Cookies and local storage
FlowAttend uses no advertising or analytics cookies, so we don’t ask for cookie consent. We only use what the service needs to work:
| Name | What it does | How long |
|---|---|---|
| Sign-in cookies (set by our authentication provider) | Keep you signed in | Until you sign out or the session expires |
Signing identifier (em_fp, stored in your browser) | Stops the same phone signing an attendance sheet twice | Until you clear your browser data |
10. Your rights
You can ask to access your data, correct it, erase it, restrict or object to its use, and receive it in a portable format, within the limits set by the GDPR. Where we rely on legitimate interest, you can object at any time.
Write to support@flowattend.com. We may ask you to confirm your identity, and we answer within one month. If you signed an attendance sheet, contact the organiser of the training first; we will forward your request if you write to us.
You can also lodge a complaint with the Luxembourg data protection authority, the CNPD, 1 Avenue du Rock’n’Roll, L-4361 Esch-sur-Alzette, cnpd.public.lu, or with the authority of the EU country where you live or work.
11. Changes to this policy
We update this policy when FlowAttend or the law changes; the date at the top shows the latest version. If a change matters for how we use your data, we tell account holders by email at least 30 days before it applies.