Privacy Statement

Effective date: August 31, 2026 | Last updated: November 1, 2026

This Privacy Statement explains what personal data UP-TO-DATE Flow ("Flow", "we", "our", "us") — a product of UP-TO-DATE AI Webdesign, based in Belgium — collects, why we collect it, how we protect it, and the rights you have over it. It applies to uptodateflow.com, the Flow mobile apps, and the Flow browser extension.

The short version: Flow works for you on your data. We read your mailbox because you asked us to triage it. We never sell your data, never show you ads, and never let AI providers train on your content.

---

#1. Who Is Responsible for Your Data

The data controller is:

UP-TO-DATE AI Webdesign Belgium Email: support@uptodateflow.com

For any privacy question or request, email us — a human reads it.

---

#2. What Data We Collect

Account data

• Your name, email address, and profile picture, received when you sign in with Google, Microsoft, or an UP-TO-DATE account
• Your workspace (company) membership, managed at accounts.uptodateconnect.com
• Settings and preferences you choose inside Flow

Email data — the heart of the product

When you connect a mailbox, Flow accesses and stores:

This applies to every mailbox you connect: your Gmail account and/or your Microsoft 365 / Outlook account, including shared mailboxes (like info@ or invoicing@) that your organization has granted you access to.

Calendar & tasks

• Google Calendar events (title, time, attendees, meeting links) for scheduling and meeting preparation
• Tasks — created by you, extracted from your email by AI, or synced with Google Tasks

Derived data Flow creates for you

• Contacts & companies — an address book built from who you email
• AI memory profile — what Flow has learned about your writing style, work patterns, and preferences, stored in our memory service (memories.uptodateconnect.com) and fully visible and editable by you in the app
• Daily journals, briefings, and AI suggestions

Voice input

• Dictation (the microphone in Flow Chat): your recording is transcribed by OpenAI Whisper and then discarded — we keep the text, not the audio.
• Talk to Flow (a spoken conversation): your voice goes straight from your device to OpenAI's realtime voice service over an encrypted connection, and Flow's voice comes back the same way. The audio never passes through or is stored on Flow's servers. While you talk, Flow sends OpenAI what your question needs from your mail, calendar, tasks and memory, as described in section 4.

Read receipts

If you enable read receipts on mail you send through Flow, a tracking pixel tells you when your message was opened. This concerns mail you send; recipients' mail clients may block it.

Technical data

Sign-in sessions, security logs, and per-account AI usage metering (token counts — never the content) so we can operate and bill the service. We use only strictly necessary cookies — no advertising or cross-site tracking cookies, ever.

---

#3. How We Use Your Data

We use your data exclusively to provide Flow's features to you:

• Classifying, prioritizing, and summarizing your email every ~30 minutes
• Writing reply drafts in your own style, for your review
• Extracting tasks and suggesting next steps
• Preparing your calendar, briefings, journals, and reminders
• Answering your questions in Flow Chat, grounded in your own mail, calendar, and tasks
• Operating, securing, and improving the service

We do not sell your personal data. We do not use it for advertising. We do not train AI models on it.

---

#4. AI Processing — what is sent, and to whom

Flow's intelligence comes from large language models operated by two companies. When a feature runs, the content it needs is transmitted to them over encrypted connections, processed, and returned:

We ask first. The Flow app explains this and asks your permission before any of your data is sent to an AI company. You can withdraw it at any time in the app (Settings → Flow's AI). Flow then stops sending your data to them, including the automatic sorting of new mail.

The same protection as ours. We use both companies through their business API platforms, whose terms and data processing addenda require them to give your data the same or equal protection as this statement:

• They may use it only to answer Flow's request, and may not train their models on it
• They keep it only briefly for abuse and safety monitoring (no longer than 30 days), unless the law requires otherwise
• Transfers outside the EU are covered by the safeguards in section 8

And on our side:

• No AI provider gets standing access to your mailbox — each request contains only the content needed for that task
• AI outputs (drafts, summaries, suggestions) are proposals for your review, not actions taken behind your back

Searching the internet. When you ask the chat something outside your account, Flow can look it up on the internet. It then sends SerpApi only a few search words, the way you would type them into Google; your emails, files and the conversation itself are never sent along. SerpApi runs the search on Google and sends back the results.

---

#5. Google User Data

Flow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• Google user data is used only to provide the user-facing features described in this statement, at your request
• We do not transfer Google user data to third parties except as necessary to provide those features (the AI processing described above), to comply with law, or as part of a merger/acquisition with prior notice
• We do not use Google user data for advertising
• We do not allow humans to read your data, except with your explicit permission (e.g. a support request), for security purposes, or to comply with law
• Google Workspace APIs are not used to develop, improve, or train generalized AI or machine-learning models

You can revoke Flow's access to your Google account at any time at myaccount.google.com/permissions.

---

#6. Microsoft 365 / Outlook Data

When you connect a Microsoft 365 or Outlook mailbox, Flow uses Microsoft Graph with delegated permissions you approve on Microsoft's consent screen (reading and sending mail, including shared mailboxes your admin has granted you Full Access to).

• Flow accesses shared mailboxes strictly under your own Microsoft permissions — it can never see a mailbox your organization hasn't given you access to
• Microsoft mail data is handled under exactly the same rules as Gmail data in this statement: feature-only use, no advertising, no selling, no model training
• You can revoke Flow's access at any time at myapps.microsoft.com (or your admin can, in Microsoft Entra), and Flow immediately loses access

---

#7. When Data Is Shared with Your Teammates

By default, everything in Flow is private to you — teammates in your workspace see nothing of your mail, contacts, or tasks. Sharing happens only through explicit choices:

• Task assignment — if you assign a task to a teammate, they see that task's title, details, and notes. They never see the email the task came from.
• Workspace context sharing (off by default) — an opt-in that lets teammates' AI see your contact names and email subjects for shared business relationships. Never bodies.
• Full email sharing (off by default, separate opt-in) — lets teammates' AI search and read your emails, always attributed to you.

Each of these can be switched off again at any time in Settings.

---

#8. Who Processes Data on Our Behalf

Transfers outside the EU are covered by the providers' EU data-transfer safeguards (Standard Contractual Clauses / EU–US Data Privacy Framework, as applicable).

---

#9. Security

• All connections use TLS encryption; data is encrypted at rest
• Mailbox access uses OAuth — Flow never sees or stores your Google or Microsoft password
• Access tokens are stored server-side and never exposed to your browser
• Our production database and file storage run in the EU (AWS Paris)

No system is perfectly secure. If a breach ever affects your personal data, we will notify you and the supervisory authority as GDPR requires.

---

#10. How Long We Keep Data, and How You Delete It

• Your data is kept while your account is active, so Flow can do its job
• Disconnecting a mailbox (Settings, or via your Google/Microsoft account) immediately stops syncing, and we delete the associated access tokens
• Deleting your account — Settings → Danger zone → Delete account — permanently erases your account and all associated data: emails, attachments, tasks, contacts, journals, memory profile, and tokens. This is a self-service button, not a support ticket, and it satisfies GDPR erasure
• Residual copies in encrypted backups roll off within 30 days

---

#11. Your Rights (GDPR)

You have the right to:

• Access the data we hold about you
• Rectify inaccurate data
• Erase your data (the delete-account button, or by request)
• Export your data in a portable format (email, calendar and tasks live in your Google/Microsoft account; Flow-created data on request)
• Restrict or object to processing
• Withdraw consent at any time, without affecting prior processing

To exercise any of these, email support@uptodateflow.com. You also have the right to lodge a complaint with the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be) or your local supervisory authority.

Our legal bases under GDPR: performance of a contract (providing Flow to you), consent (connecting mailboxes, optional sharing features), and legitimate interest (service security and operations).

---

#12. Children

Flow is not intended for anyone under 16, and we do not knowingly collect data from children.

---

#13. Changes to This Statement

If we make material changes, we will notify you in the app or by email before they take effect. The "Last updated" date at the top always reflects the current version.

---

#14. Contact

UP-TO-DATE AI Webdesign support@uptodateflow.com uptodateflow.com

See also our Terms of Service.