Privacy Policy — Flowmea Journal

1. Who looks after your data (controller)

Lucie Tomášová (Flowmea), Business ID (IČO) 18003991, not a VAT payer. Write to me anytime at hi@flowmea.com.

2. What data I process, why, and on what legal basis

• Account (name, email) — so I can provide the Service. Basis: performance of a contract.
• Journal (your entries, mood, and — if you turn it on — cycle) — these are sensitive (health) data. I process them only on the basis of your explicit consent, which you give at registration and can withdraw at any time.
• Technical (timing of entries, your Telegram ID) — to run the Service and deliver messages.
• Newsletter and waitlist (name, email) — when you sign up, on the basis of your consent (confirmed by email). One-click unsubscribe.

3. How I protect it

Entries and replies are encrypted in the database (AES-256), and the database runs in the EU. Not even the provider can see them in readable form.

4. Who I share it with (processors)

• Anthropic (Claude, USA) — so Flo can reply to you.
• Voyage AI (USA) — so Flo can recall your earlier entries. We have training opt-out enabled with them.
• Groq — transcribing your voice messages to text (the voice message is deleted after transcription).
• Telegram — message delivery.
• Neon (EU) and Vercel — database and operations.
• Resend and Brevo — emails.

None of them uses your data for training or keeps it beyond what their service needs.

5. Transfers outside the EU

Some providers (Anthropic, Voyage) are based in the USA. Transfers take place under appropriate GDPR safeguards (the European Commission's Standard Contractual Clauses).

6. How long I keep data

For as long as you have an account. When you delete it, your content (entries, moods, memory, profile) is permanently erased within 14 days. All that remains is an unreadable technical fingerprint (hash) of your email and a date — so I can tell an account existed and prevent misuse. No journal content is kept. I process the newsletter until you unsubscribe.

7. Your rights

You have the right to access your data, to have it corrected or erased, to restrict processing, to data portability, to object, and to withdraw consent at any time (without affecting processing before withdrawal). To download your data or delete your account, write to me at hi@flowmea.com.

8. Automated decision-making

Flo replies to you using AI, but I make no automated decisions with legal or similarly significant effects — nor any profiling that would affect you in that way.

9. Cookies

I use only essential cookies for sign-in and operation. No tracking or advertising cookies.

10. Supervisory authority

You also have the right to lodge a complaint with the Czech data-protection authority, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz).

11. Changes to this policy

If I make substantial changes to this policy, I'll let you know (by email or in the Service).