Privacy policy

We have done our best to write this Policy in simple, clear terms. We encourage you to read it carefully, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

- Purpose of processing: provide access to and use of Flowchase services (website, textbook and mobile apps).

- Legal grounds: processing based on user consent, contract performance and the legitimate interest of the company or third parties.

- Recipients: Flowchase third-party service providers which help provide the Service. Please see the section “Which are Flowchase's Third-Party Service Providers?” of this Privacy Policy for more information.

- User rights: access, rectification, erasure, restriction, objection and data portability (see the section “Flowchase Privacy Principles” of this Privacy Policy). For exercising any of the rights mentioned, please contact Flowchase’s Data Protection Officer (DPO).

- Data Protection Officer (DPO): for inquiries regarding this Privacy Policy please contact Flowchase’s DPO at dpo@flowchase.app or at the physical address listed at the end of this Policy.

- Additional information: to be found in Flowchase’s Terms of Service and this Privacy Policy.

Personal information is any information you provide to us that personally identifies you, like your name or email address, or any other information which we could reasonably link to your identity. We will only collect, use, and share your personal information in accordance with this Privacy Policy. This Policy applies whether you use Flowchase through flowchase.app (the “Flowchase Website”), the Flowchase class management and progress report website for teachers (the “Teacher Admin”), our mobile applications (the “Flowchase Apps”), or any of our other products or services that link to this Privacy Policy (collectively, the “Service”). In addition, this Privacy Policy also covers Flowchase's treatment of any personal information about our users that our partners or other services might share with us.

This Policy does not apply to websites or services or practices of companies that Flowchase does not own or control, such as third-party services you might access through links or other features (e.g., social media buttons; third-party integrations) on the Service. These other services have their own privacy policies, and we encourage you to review them before providing them with personal information. In this Privacy Policy you will find the section “Which are Flowchase's Third-Party Service Providers?” with a list of our service providers and a link to their privacy policies, as well as an overview to how, why and under which conditions they might process your personal information.

Whether you are new here (welcome!), or have been using Flowchase for a long time (welcome back!), please do take the time to get to know our privacy practices. We believe them to be fairly clear and friendly, but if you have any questions or feedback, we are here to help. To learn more about how we protect your privacy, reach out to our Data Protection Officer (DPO) via the contacts listed in this document.

BY USING THE SERVICE, YOU ACKNOWLEDGE THAT YOU ACCEPT AND AGREE TO THIS PRIVACY POLICY.

In compliance with the EU General Data Protection Regulation (GDPR), this Privacy Policy incorporates the Flowchase Standard Contractual Clauses ("FSCC"), when the GDPR applies to your use of the Flowchase Services and personal data is transferred to third countries which do not ensure an adequate level of data protection. Further information in this regard can be found in the Europe section of this Privacy Policy.

What is Flowchase?‍

‍Flowchase Privacy Principles
- What are Flowchase's principles when processing personal information?
- Why does Flowchase collect personal information from its users?
- What are my rights when using Flowchase?
- Which are my responsibilities when Using Flowchase?
- What are Flowchase’s commitments to providing transparency and choice?
- Notice
- Choice
- Change of Purpose
- Contract Performance
- Legitimate Interests
- How will Flowchase notify me of changes to this policy?

Protecting Our Students
- What information does Flowchase collect from students, and how is it used?
- What students’ information is visible to others?
- How long does Flowchase keep students’ information?
- Parental Choices

Information Collected
- What information does Flowchase collect?
- Information You Provide to Us
- Information Collected Automatically
- How does Flowchase use the information it collects?
- How long does Flowchase keep information about me?
- Will Flowchase share any information it collects?
- Which are Flowchase's Third-Party Service Providers?
- Accountability for Onward Transfer

Security Practices
- How does Flowchase protect and secure my information?
- How would Flowchase deal with a security breach?
Managing My Information
- How can I access and manage my personal information?
- How can I delete my account?
- Student Data Control by the School or Educational Institution
- Co-teaching

Consumer Complaints
- How can I lodge any complaints?
- EEA Residents
- Liability

Europe
- Appointed EU Representative

Other Countries
- Transfers of Personal Information to Europe
- Processing in Other Regions

‍

What is Flowchase?

Flowchase is an easy-to-use mobile app and its companion textbook that help English as a foreign language teachers engage their students and personalise the way pronunciation and spoken skills are taught. Flowchase can be used by students entirely autonomously as prescribed by their teacher, school, educational institution, or organisation, or it can be integrated into their curriculum.

Outside the classroom, students use Flowchase to learn about pronunciation concepts, train their ear to listen for specific sounds or sound patterns through listening activities, and practice speaking English by repeating selected words and sentences. One account can be used to sign in on multiple devices, in which case the students’ progress will be synced.

In the classroom, teachers use Flowchase to put what students have learned into practice through the use of group activities from the Flowchase Textbook. Flowchase collects students' scores on listening and speaking activities and their quiz responses, which teachers can view in progress reports that we upload on our website, accessible from the Teacher Admin area.

Students can create their own account, but can only tie that account to a class or a group after they receive a unique code from their teacher, school, educational institution or organisation. As further explained below in the "Which are Flowchase's Commitments to providing Transparency and Choice" section of this Privacy Policy, if the school, educational institution, organisation, or teacher elects to utilise Flowchase with students under a specific age, the school, educational institution or organisation will be responsible for obtaining any necessary parental consent under the applicable laws. No teachers or school/educational institution/organisation members will be provided with a unique code for their students unless they consciously agree to this Policy, by reading and accepting the Privacy Policy notice given prior to signing up and by verifying their email address or phone number upon sign-up.

Flowchase Privacy Principles

What are Flowchase's principles when processing personal information?

In collecting and processing your personal information, we will comply with the data protection laws and regulations in force at the time. This requires that the personal information we hold about you must be:

Used lawfully, fairly and in a transparent way.
Collected only for valid purposes that we have clearly explained to you and not used in a way that is incompatible with those purposes.
Relevant to the purposes we have told you about and limited only to those purposes.
Accurate and kept up-to-date.
Stored only as long as necessary for the purposes we have told you about.
Stored securely with adequate protection and access controls.

Why does Flowchase collect personal information from its users?

Flowchase collects personal information from users in order to provide the Service. Concretely, the personal information of students and teachers is collected and used for the following purposes:

To create the necessary accounts to use the Service.
To provide teachers with reports on student progress.
To help teachers connect with other teachers from the same school, educational institution, or organisation.
To send email updates to teachers, if applicable.
To assess the quality of the Service.
To improve the Service.
To secure and safeguard personal information.
To access premium features, if applicable.
To comply with all applicable laws on the protection of personal information.

What are my rights when using Flowchase?

Your rights relating to your personal information include:

to be informed about how Flowchase uses your personal information;
to request access to personal information held by Flowchase, and to have any incorrect, inaccurate or incomplete personal information rectified;
where appropriate, to restrict processing concerning you or to object to processing;
to have personal information erased where there is no compelling reason for its continued processing; and
where applicable, to portability of personal data, that is to say, to receive your personal information in a structured and commonly used format.

Which are my responsibilities when Using Flowchase?

We require that your personal information is accurate. Please let us know if the personal information you provided us for creating your account has changed. If we do not have the correct information, we cannot take responsibility for information-related errors.

Additionally, if we determine that you are in violation of this Policy, you will be subject to disciplinary action that could eventually lead to the banning of your account.

What are Flowchase’s commitments to providing transparency and choice?

We try to be transparent about what information we collect, so that you can make meaningful choices about how it is used. For example, you can:

Access and manage your account information.
Remove information from Flowchase.
Take information out of Flowchase.

Notice

When providing you with information on the processing of your personal information, such as its collection, transfer to other countries, types or identity of third parties to which we disclose that information and the purposes for which we do so, we will make sure that such information is provided in clear and understandable language. Also, initial notice on our practices and policies will be provided when you are first asked to provide personal information to us, or as soon as practicable thereafter, and in any event before we use the information for a purpose other than that for which it was originally collected.

Choice

We will offer you the opportunity to choose (by either opting-out or opting-in) if your personal information is (a) to be disclosed to a third party different from those listed in this Privacy Policy, or (b) to be used for a purpose materially different from the purpose for which it was originally collected or subsequently authorised by you.

Change of Purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason which is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

‍

Contract Performance

When, as a teacher or school/educational institution/organisation representative, or when acting on behalf of a company or other organisation, you create a Flowchase account, you provide your first and last name and one or more contact methods such as an email address or phone number (“Contact Information”). We require those data elements for you to enter into the Terms of Service agreement with us, and we process those elements on the basis of performing that contract.

Consent

If you are a student, teacher or school/educational institution/organisation representative, or use the Service on behalf of a company or other organisation, note that Flowchase provides its Service upon explicit consent given by you when signing up. Prior to signing up, we will direct you to our Terms of Use and this Privacy Policy. When signing up, you will be declaring to have read such policies and to consent to them. Remember, nonetheless, that you will be able to withdraw your consent at any time by deleting your account in accordance with this Policy's Managing My Information section.

EDUCATIONAL INSTITUTIONS UTILISING THE SERVICE ARE RESPONSIBLE FOR MONITORING THE RIGHTS AND INTERESTS OF THEIR STUDENTS AND MUST THEREFORE TAKE SPECIAL CARE WHEN REVIEWING THIS PRIVACY POLICY. EDUCATIONAL INSTITUTIONS SHALL BE RESPONSIBLE FOR OBTAINING, WHERE APPLICABLE, PERTINENT CONSENT FROM PARENTS, LEGAL GUARDIANS OR ELIGIBLE STUDENTS (THOSE WHO ARE 18 YEARS OF AGE OR ATTEND A POSTSECONDARY INSTITUTION) PRIOR TO UTILISING THE SERVICE. FLOWCHASE SHALL NOT BE RESPONSIBLE FOR ANY NEGLIGENCE OF THE EDUCATIONAL INSTITUTION IN THE REVIEWING OF THIS PRIVACY POLICY OR THE OBTAINMENT, WHERE APPLICABLE, OF THE NECESSARY PARENTAL CONSENT.

European Educational Institutions and GDPR: According to article 8 of the GDPR, minors shall be entitled to give valid consent only if they are 16 years old (unless Member States have set a lower age limit which, nonetheless, cannot be under 13 years old). Under that age limit, processing of personal information related to minors shall be subject to parental consent. Schools/educational institutions are in control of their students’ personal information and are obliged to take all necessary measures for protecting said information. This means that schools/educational institutions will have to be especially cautious when contracting any service that may require disclosure of student personal information. In other words, schools/educational institutions are data controllers in terms of GDPR and thus determine the purposes and means of the processing of student personal data. As a consequence, schools/educational institutions will also be responsible for informing students and their parents accordingly about what data is collected, which are the purposes of collection, how data is used and to which third parties it is disclosed, including Flowchase.

Legitimate Interests

Generally, the remainder of the processing of personal information we perform is necessary for the purposes of our legitimate interests or those of third parties. For example, for legal compliance purposes or to maintain ongoing confidentiality, integrity, availability and resilience of Flowchase's systems, website, and overall services, we must keep logs of Technical Information; and, in order to respond to legal process, we are required to keep records of users who have sent and received DMCA takedown notices.

The breach of certain rules in the use of the Service may lead to the suspension or indefinite ban of your account, depending on the severity of the offence. In the event of an indefinite account ban, Flowchase may keep part of your personal information, such as, but not limited to, IP address and Contact Information, to prevent you from accessing or using the Service.

‍

How will Flowchase notify me of changes to this policy?

We may occasionally update this Privacy Policy. You can see when the last update was by looking at the “Last Updated” date at the top of this page. We will not reduce your rights under this Privacy Policy without your explicit consent. If we make any significant changes, we will provide prominent notice by posting a notice on the Service and/or notifying you via the Contact Information you provided prior to and after changes taking effect, so you can review and make sure you're aware of them.

We encourage you to review this Privacy Policy from time to time, to stay informed about our collection, use, and disclosure of personal information through the Service. If you do not agree with any changes to the Privacy Policy, you may delete your account (although we will be sad to see you go!). By continuing to use the Service after the revised Privacy Policy has become effective, you acknowledge that you accept and agree to the current version of the Privacy Policy.

Protecting Our Students

What information does Flowchase collect from students, and how is it used?

Flowchase collects the minimal amount of information from students necessary to create accounts on our Service: we ask students to provide their name, a form of Contact Information, and a unique code they have been given by their teacher or institution to join a class or group. Beyond this information, students can submit responses or audios depending on the activities they are assigned or choose to complete. All this information will only be used for the purposes of the school/educational institution/organisation/teacher. In addition to the information entered by the student, we automatically collect some information from any use of our Service as set forth in the "Information Collected Automatically" section.

We use this information to provide the Service to the student, for security and safety purposes, or as required by law or to enforce our Terms. We will not require students to provide more personal information than is reasonably necessary in order to participate in the Service. If we discover that we have collected information from a student in a manner inconsistent with GDPR or any other applicable laws or regulations, we will take appropriate steps to delete the information. We do not disclose any personal information about students to third parties, except to service providers necessary to provide the Service, as required by law, or to protect the security of the Service or other users. Information collected from students (including personal information and information collected automatically) is never used or disclosed for third-party advertising, including any kind of first- or third-party behaviorally targeted advertising, and students’ personal information is never sold or rented to anyone, including marketers or advertisers.

‍

What students’ information is visible to others?

No student’s profile is made available or visible to the public, or to any other students, through Flowchase. Our applications have no social networking features and don’t allow students to chat with each other. Teachers may share their classes, including grades or scores, with other teachers they co-teach with in their school/educational institution, to help them collaborate. If the teacher chooses to display Flowchase in their classroom, by projecting via a beamer, a smartboard or interactive whiteboard, students physically present in that classroom may see other students’ names, responses or total scores.

EDUCATIONAL INSTITUTIONS, ORGANISATIONS AND TEACHERS SHALL MAKE A RESPONSIBLE USE OF THE SERVICE AND AVOID COMPROMISING STUDENTS' PERSONAL INFORMATION AT ALL TIMES WHEN DISPLAYING FLOWCHASE IN THE CLASSROOM. FLOWCHASE SHALL NOT BE HELD LIABLE FOR THE INAPPROPRIATE USE OF THE SERVICE BY THE EDUCATIONAL INSTITUTION, THE ORGANISATION OR THE TEACHER.

‍

How long does Flowchase keep students’ information?

We only keep a student’s personal information for as long as his or her student account is active, unless we are required by law to retain it, need it to ensure the security of our community or our Service, or to enforce our Terms:

Minimal information: As mentioned before, Flowchase collects the minimal amount of information from students necessary to create accounts on our Service: we ask students to provide their first name, last name, and Contact Information. Consistent with the requirements of GDPR, among other applicable laws, we only collect, use, share, and retain student personal information for purposes for which we were authorised by the educational institution, organisation, teacher or the student. Beyond this information, students can submit responses or audios depending on the activities they are working on. In addition to the information entered by the student, we automatically collect some information from any use of our Service as set forth in the "Information collected automatically" section

Deleting inactive accounts: If a student’s account is inactive for twelve (12) months or more (meaning the student has not used his or her account), Flowchase will automatically delete the student account, including all personal information provided by the student or collected by Flowchase from the student. The mentioned twelve (12) month term has been calculated in accordance with the estimated use of the Service, which usually coincides with an entire school/academic year, plus an additional period of time in case teachers want to renew the use of the Service.

After deletion of the account, Flowchase may retain backups of the mentioned information for a variable period of time, depending on the specific requirements of our infrastructure, but never for longer than six (6) months. Nevertheless, Flowchase shall not be responsible for the accidental loss or destruction of data on behalf of users. Flowchase will not be obliged to recover erased data stored in backups when erasure is attributable to users.

EDUCATIONAL INSTITUTIONS UTILISING THE SERVICE ARE RESPONSIBLE FOR COMPLYING WITH THE RETENTION OF STUDENT EDUCATION RECORDS FOR AS LONG AS LEGALLY APPLICABLE. STUDENT PROGRESS MAY BE SAVED FOR EITHER SHORTER OR LONGER PERIODS THAN THE ONES STATED ABOVE IF SO DECIDED BY THE EDUCATIONAL INSTITUTION.

FLOWCHASE SHALL NOT BE RESPONSIBLE FOR ERASURE OF STUDENT PROGRESS DUE TO ACCOUNT DELETION AFTER AN EXTENDED PERIOD OF INACTIVITY OR BECAUSE OF THE VOLUNTARY ELECTION TO DELETE TEACHER ACCOUNTS. SCHOOL/EDUCATIONAL INSTITUTION OFFICIALS MAY REQUEST DELETION OF STUDENT INFORMATION AND CONTENT AT ANY TIME BY CONTACTING OUR DATA PROTECTION OFFICER.

‍

Parental Choices

Any parents that want copies of their children’s personal information that we may have stored can contact their children’s school personnel to that end. At any time, the school can also refuse to permit us to collect further personal information from its students, and can request that we delete the personal information we have collected from them by contacting our Data Protection Officer. Please keep in mind that deleting records may require us to terminate the account in question. Also remember that before we can share the information with the school, or delete it per your request, we will, by reasonable means, proceed to verify the identity of the requester.

‍

Information Collected

What information does Flowchase collect?

We collect two types of information about you: (1) information that you voluntarily provide us by using the Flowchase Service (described below under “Information you provide to us”) and (2) information collected automatically as result of your use of the Service (described below under “Information collected automatically”). The types and amounts of information collected will vary depending on whether the user is a teacher or student (e.g. we collect minimal information from students) and how they use Flowchase (e.g. if teachers join their school/educational institution, we may need to collect school/educational institutions address information).

‍

Information You Provide to Us

There are currently two categories of users on our Service: teachers and students. We collect and store the following types of information from each type of user:

Account Sign-up and Profile Information: To create a Flowchase account as a teacher, you may be asked to provide some basic information such as your name, and institutional or organisational email address. If you create a Flowchase account as a student, you will be asked to enter your first name, last name, and (institutional or organisational) email. In some circumstances, we may ask for your phone number as the unique identifier for your account, especially in situations where an organisational email address is not available.
Subject Information: If you are a teacher, as part of the profile information you provide, you will be asked for some information about the subject(s) you teach. One subject can represent one or several classes or groups of students.
Class Information: If a teacher opts to share the classes they set up on Flowchase with other teachers in their school/educational institution, such as their head of department or teachers they co-teach with, then those people can also see that class’s information. Class Information includes a list of students that have signed up for that class.
Responses, Grades and Feedback: As a student, you will have to record audios, answer questions and select multiple choice options when using the Flowchase App and Textbook. You may also have to fill out a feedback questionnaire after your use of Flowchase. Your responses to exercises in the Flowchase App are usually kept private from your teacher, but your responses to exercises in the Textbook may be viewed by your teacher. Your grades and/or scores may be shared with the teachers responsible for your Class as part of the Class Information item above. Your responses to any feedback questionnaire will be fully anonymized and may be viewed by your teacher or head of department or organisation.
Contact Information: When you choose to provide us with your personal information through the Service in some other manner (e.g., when you request a demo at your school/educational institution, when you submit a copyright claim or report any media on our platform, when you send us an email asking a question, submit a support request, participate in a video testimonial about our Service, or choose to participate in any research efforts with Flowchase to improve the Service).

Our use of the information above is described below in the "How Does Flowchase Use the Information it Collects?” section. If you are using the Flowchase App, we may ask you for certain permissions.

‍

Information Collected Automatically

Like most web-based services, we (or our service providers) may automatically receive and log information on our server logs from your browser or your device when you use the Service. For example, this could include the frequency and duration of your visits to Flowchase. If you use Flowchase on different devices, we may link the information we collect from those different devices to help us provide a consistent Service across your different devices. If we combine any automatically-collected information with personal information, we will treat the combined information as personal information, and it will be protected as per this Privacy Policy.

The technologies and information we automatically collect include:

Cookies and Other Similar Technologies: We (or our service providers) may use various technologies to collect and store information when you visit our Service, including clear GIFs (also known as “web beacons”), “tags”, “scripts”, and “cookies”. We may also make use of persistent secure cookies: persistent cookies remain after you close your browser (although they can be removed) and may be used by your browser to identify you on subsequent visits to the Service. We may also use, collect and store information locally on your device using mechanisms such as browser web storage. Like many services, Flowchase uses these technologies to tailor the Service for you, and to help the Service work better for you - for example, by remembering your language preferences and persisting your sessions without causing a login every time you use the Service.
Device Information: We collect, through our third-party analytics services, device-specific information such as your operating system, hardware version, and device settings (such as your preferred language). This helps us measure how the Service is performing, improve Flowchase for you on your particular device, and send you push notifications if you’ve opted in to receive them.
Log Information: Like most online services, when you use our Service, we automatically collect and store certain information in our server logs. Examples include:

Details of how you used our service, such as your activity on the Service, and the frequency and duration of your visits to the Flowchase Website or Flowchase App.
IP Address.
Device event information such as crashes, system activity, hardware settings, browser type, browser language, the date and time of your request and referral URL.

This information helps us make decisions about what we should work on next - for example, by showing which features are most (or least!) popular. We may also rely on this information to protect our technical infrastructure.
Location Information: When you use our Service we may collect and process information about your geographic location. We use reverse geocoding to get a coarse estimate of your location (i.e., city-level), and rely on this information to protect our technical infrastructure as well as your account. For example, we rely on coarse estimates to ensure you are initiating a login from an area you are usually active on. We will not store or track your device location on an ongoing basis or without your permission, and we do not use your device’s sensors to track this information. We also do not store or track your precise geolocation. We do not share location data with third parties, other than our service providers as necessary to provide the Service.

‍

How does Flowchase use the information it collects?

First and foremost, you should know that Flowchase does not sell, share, or rent any of your, or your students' personal information to any third party for any purpose including for advertising or marketing purposes. Flowchase does not cooperate with data brokers. We use the information we collect from you to provide you with the best Flowchase experience. More specifically, this information is used to:

Provide and improve the Service, for example by developing new products, features or improving our artificial intelligence technology.
Respond to your requests for information or customer support.
Customise the Service for you, and improve your experience with it.
Send you information about new features and Flowchase products we believe you may be interested in.
Most crucially, to protect our community by making sure the Service remains safe and secure.

We use automatically collected information (described in the “Information Collected Automatically” section above) to provide and support our Service, and for the additional uses described in this section of our Privacy Policy.

How long does Flowchase keep information about me?

We store your personal information for as long as it is necessary to provide products and Services to you and others, including those described above. As a general rule, if your account is inactive for twelve (12) months or more (meaning you have not logged into your account during that time), Flowchase will automatically delete your account. Deletion will affect any on-going paid subscriptions, which will be immediately cancelled. See the section “How long does Flowchase keep students’ information?” for more information on how we handle inactive and deleted accounts.

Note we may retain and use de-identified data (i.e. data which has been stripped off of all information that can be used to identify a person) for purposes of research, improvement of our products and services, and/or the development of new products and services. We may also have to retain some information after your account is deleted, to comply with legal obligations, to protect the safety and security of our community or our Service, or to prevent abuse of our Terms. In case we keep copies or backups of personal information, such copies or backups may be kept for a maximum term of six (6) months after the deletion of your account. Remember that you can delete your account at any time by contacting us, especially by contacting our Data Protection Officer. In addition to the policy above that applies to all users, we only keep a student’s personal information while the student’s account is active, unless we are required by law to retain it or need it to ensure the security of our community or our Service, or to enforce our Terms.

‍

Will Flowchase share any information it collects?

First and foremost, you should know that Flowchase does not sell, share, or rent any of your, or your students' personal information to any third party for any purpose including for advertising or marketing purposes. Flowchase does not cooperate with data brokers. Furthermore, we do not share personal information with any third parties except in the limited circumstances described in this Privacy Policy:

Other Users You Share and Communicate with on Flowchase: No student profiles are made available to the general public through our Service. Furthermore, students cannot share their account information with anyone on Flowchase. If you are a teacher you may choose to share information or content through the Service with other Flowchase teachers or your head of department - for example, things like your account information or progress reports. Please keep in mind that information (including personal information or students' personal information) or content that you voluntarily disclose to others - including other Flowchase users you interact with through the Service can be viewed, copied, stored, and used by the people you share it with. We cannot control the actions of people with whom you choose to share information.

Teachers: For the purposes of reporting progress to your teacher(s) — if that feature was chosen by your organisation —, we may share your name and Contact Information with your teacher(s), alongside your grade and some information about your performance in our Service.

Service Providers (“Processors” under GDPR nomenclature): We do work with vendors, service providers, and other partners to help us provide the Service by performing tasks on our behalf — we can’t build everything ourselves, after all! We may need to share or provide information (including personal information) to them to help them perform these business functions, for example sending emails on our behalf, database management services, database hosting, providing customer support software, and security. Please see the section “Which are Flowchase's Third-Party Service Providers?” for a list of our Service Providers. Generally, these service providers do not have the right to use your personal information we share with them beyond what is necessary to assist us. Additionally, these service providers must adhere to confidentiality and security obligations in a way that is consistent with this Privacy Policy.

Testimonials: We post testimonials on our Service which may contain personal information such as the name, photo and/or a video of the individual in the testimonial. We obtain the individual’s consent in advance to ensure we have permission to post this content publicly. To request removal of your personal information from our testimonials, please contact our Data Protection Officer.

Analytics Services: We use analytics services, including mobile analytics software, to help us understand and improve how the Service is being used. These services may collect, store and use information in order to help us understand things like how often you use the Service, the events that occur within the application, usage, performance data, and from where the application was downloaded.

Aggregated Information and Non-Identifying Information: We may share aggregated, non-personally identifiable information publicly, including with users, partners, investors or the press in order to, for example, demonstrate how many people use Flowchase, how Flowchase is used, spot industry trends, or to provide marketing materials for Flowchase. Any aggregated information shared this way will not contain any personal information, and we will do everything we can to ensure it cannot be de-anonymized in any way.

Legal Requirements: We may disclose personal information if we have a good faith belief that doing so is necessary to comply with the law, such as complying with a subpoena or other legal process. We may need to disclose personal information where, in good faith, we think it is necessary to protect the rights, property, or safety of Flowchase, our employees, our community, or others, or to prevent violations of our Terms of Service or other agreements. This includes, without limitation, exchanging information with other companies and organisations for fraud protection or responding to government requests.

Sharing with Flowchase Companies: Over time, Flowchase may grow and reorganise. We may share your personal information with affiliates such as a parent company, subsidiaries, joint venture partners or other companies that we control or that are under common control by us. Should that happen, we will first provide you with a notice within thirty (30) days of a new affiliate gaining access to your information, either by directly emailing you with it or by updating this Policy and giving appropriate notice of it. You will then have the right to exercise an 'opt out' choice if your personal information is about to be used and/or disclosed in a way that you believe is not consistent with this Policy. After the notice period has passed, we will require those companies to agree to use your personal information in a way that is consistent with this Privacy Policy.

Change of Control: In the event that all or a portion of Flowchase or its assets are acquired by or merged with a third party, personal information that we have collected from users would be one of the assets transferred to or acquired by that third party. This Privacy Policy will continue to apply to your information, and any acquirer would only be able to handle your personal information as per this policy (unless you give consent to a new policy). We will provide you with notice of an acquisition within thirty (30) days following the completion of such a transaction, by posting on our homepage, and by email to your email address that you provided to us. If you do not consent to the use of your personal information by such a successor company, you may request its deletion from the company. In the unlikely event that Flowchase goes out of business, or files for bankruptcy, we will protect your personal information, and will not sell it to any third party.

With your Consent: Other than the cases above, we won’t disclose your personal information for any purpose unless you consent to it. Additionally, as discussed above, we will never sell or rent your personal information to advertisers or other third parties.

Which are Flowchase's Third-Party Service Providers?

It is important to us that we keep your information safe and secure. To best provide our services, and keep your information safe, we work with a few other companies (we can’t do it all ourselves!). These companies (“processors” under the GDPR, "third-party service providers", "collaborators" or "agents") will only have access to the information they need to provide the Flowchase service.

Below is a list of the service providers which, subject to their terms of service and privacy policies as linked below, may have access to personal data to process on our behalf in accordance with our instructions, Privacy Policy and any other requirements regarding confidentiality, security or integrity:

Google Cloud Platform for hosting Flowchase’s servers, videos, images, and audios, as well as storing the data of our users.

We use Google Cloud Platform’s regional offering so that we may deploy our infrastructure only within the European Union.
In the case of Technical Logs, Google Cloud Platform stores an audit log in their ‘Global’ region, which is beyond our ability to change. As such, we try to scrub any personal information that goes into any Technical Logs.

OVH for hosting Flowchase’s voice technology.

We use OVH’s regional offering so that we may deploy our voice technology only within the European Union.
As much as is within our control, we do not store any personal information on our OVH servers.

Google for productivity apps (“Google Workspace”), analytics on our website ("Google Analytics"), and for information related to your use of our mobile application (“Google Play Console”).
Apple for managing our mobile applications, and for information related to your use of our mobile application (“App Store Connect”).
NewRelic for monitoring our servers and applications.

As much as is within our control, we scrub any personal information so it is not stored or processed by NewRelic.

Sentry for monitoring our servers and applications.

As much as is within our control, we scrub any personal information so it is not stored or processed by Sentry.

Expo for building our Mobile App.

As stated by Expo, they do not willingly collect any personal information or device identifiers.

Sendinblue for sending transactional and promotional emails.
Cloudflare for critical technical services, protection of our infrastructure, and improvement of our Services.
Twist for our internal team communication.
Typeform for feedback questionnaires.
Webflow for hosting our website.
Hubspot for customer management.
Intercom for organising and handling support requests.
Lemlist for contacting teachers and departments.

This list may change over time, and we will work hard to keep it up-to-date. However, disclosure of your personal information to additional third parties or use of it for different purposes than those indicated in this Privacy Policy shall only be done after notifying you of all necessary information on any key elements affecting the processing of your personal data, either by directly emailing you with it or by updating this Policy and giving appropriate notice of it. You will then have the right to exercise an 'opt out' choice if your personal information is about to be used and/or disclosed in a way that you believe is not consistent with this Policy.

Accountability for Onward Transfer

We will transfer your personal information to third-party service providers only for limited and specific purposes. We will obtain contractual assurances from our collaborators that they will safeguard personal information in a manner consistent with this Policy and that they will provide the same level of protection as per best industry standards. We recognize our responsibility and potential liability for onward transfers to agents. Where we have knowledge that an agent is using or disclosing personal information in a manner contrary to this Policy and/or level of protection as required by applicable laws and regulations, we will take reasonable steps to prevent, remediate or stop such use or disclosure. If we transfer personal information to non-agent third parties, that is to say, any new collaborators that are not included in the previously mentioned list, we will (1) notify you with all necessary information on any key elements affecting the processing of your personal data, and (2) obtain contractual assurance from these parties that they will provide the same level of security as per best industry standards and in accordance with any applicable laws and regulations.

‍

Security Practices

How does Flowchase protect and secure my information?

Your Flowchase account is protected by a one-time password you can renew every time you log in on a new or existing device. You obtain this password on the contact method you used to sign up, and must enter it in the Flowchase App or Teacher Admin within a limited window of time to validate your account or confirm your identity to log in. You can help us protect your account from unauthorised access by ensuring no one else than you has access to your contact method.

The security of your personal information is important to us. We work hard to protect our community, and we maintain administrative, technical and physical safeguards designed to protect against unauthorised use, disclosure of or access to personal information, such as:

Security Protocols: We periodically review our information collection, storage and processing practices, including physical security measures, to protect against unauthorised access to systems.
Security Technology: We continually develop and implement features to keep your personal information safe — for example, when you enter any information anywhere on the Service, we encrypt the transmission of that information using Secure Socket Layer (SSL) technology by default.
Encryption: To the best of our ability, Flowchase employees operate devices that are encrypted at rest, and Flowchase infrastructure uses encryption everywhere possible.
Employee Access: We use best-effort practices to secure usernames, passwords and any other means of gaining access to users data. All employees sign confidentiality agreements as part of their employment contract at Flowchase.
Automated Analysis: Flowchase relies on SecurityScorecard to provide us with automated, periodic reviews of our infrastructure and security practices. We continuously review and implement their recommendations to keep our security score within their best possible values.

How would Flowchase deal with a security breach?

Although we make concerted good faith efforts to maintain the security of personal information, and we work hard to ensure the integrity and security of our systems as per best industry standards, no practices are 100% immune, and we can’t guarantee the security of information. Outages, attacks, human error, system failure, unauthorised use or other factors may compromise the security of user information at any time.

Initial Notice: Upon the discovery of a security breach that results in the unauthorised release, disclosure or acquisition of personal information, we will notify electronically, no later than 48 hours or 1 business day, of such discovery to all affected users, schools, educational institutions, and organisations so that you can take appropriate protective steps. This initial notice will include, to the extent known at the time of the notification, the date and time of the breach, its nature and extent, and the Service’s plan to investigate and remediate the breach. Schools, educational institutions, and organisations may also be provided with a list of students and employees whose data was released, disclosed or acquired.
Detailed Notification: Upon discovery of a breach, we will conduct a deep investigation in order to electronically provide, no later than 5 calendar days, all affected users, schools, educational institutions, and organisations with a more detailed notice of the breach, including but not limited to the date and time of the breach; nature and extent of the breach; and measures taken to ensure that such breach does not occur in the future. Schools, educational institutions, and organisations will also be provided with the name(s) of student(s) and employee(s) whose data was released, disclosed or acquired. We may also post a notice on our homepage (www.flowchase.app) and, depending on where you live, you may have a legal right to receive notice of a security breach in writing. When it is not possible to provide all of the aforementioned information at the same time, we will provide you with the remaining information without undue further delay.

Both notifications will be written in plain language, will be titled “Notice of Data Breach” and will present the information described above under the following heading: “What Happened,” “What Information Was Involved,” “What We Are Doing,” “What You Can Do” and “For More Information”. Additional information may be provided as a supplement to the notice.

‍

Managing My Information

How can I access and manage my personal information?

Upon request and in accordance with the applicable laws and regulations, we will grant you reasonable access to your personal information that is held by Flowchase. In addition, we will take reasonable steps to permit you to correct, amend, or delete your personal information that is demonstrated to be inaccurate, incomplete or processed in violation of this Privacy Policy. It is Flowchase's goal to provide you with easy access to any personal information we have collected about you. If that information is incorrect, we also want to make sure to give you easy ways to update it, or delete it, unless we have to keep that information for legal purposes.

Accessing Your Information: To request access to the personal information we have about you on file, any school, educational institution, or organisation personnel can contact our Data Protection Officer. In some cases, we will not be able to guarantee complete access due to legal restrictions; for example, you will not be allowed to access files that contain information about other users or information that is confidential to us. Furthermore, we may not be able to fulfil requests that are unreasonably repetitive, require disproportionate technical effort or would be extremely impractical.
Updating Your Information: You may update, correct, or delete some of your information on our Services, or contacting our team through the live chat on our website, or by contacting our Data Protection Officer (dpo@flowchase.app). You may also, at any time, update, correct, or delete certain personal information that you have provided to us. To that end, any school, educational institution, or organisation official can contact our Data Protection Officer.

Please note that while your changes may be reflected promptly in active content, users that have previously accessed the content may still have access to old copies cached on their device or may have copied and stored your content. In addition, we may retain a backup copy of the prior version for a limited period of time (maximum 6 months) or for legal purposes.

Limitations: Without prejudice to the aforementioned, please note that we may limit or deny access to personal information (a) where the burden or expense of providing access would be disproportionate to the risks to your privacy; (b) where the legitimate rights of persons other than you would be violated or if necessary to safeguard important countervailing public interests (e.g., national security) or in other limited circumstances (e.g., disclosure would breach a legal privilege), and (c) where applicable law or regulatory requirements allow or require us to refuse to provide some or all of the personal information that we hold about you. In addition, the personal information may have been destroyed, erased or made anonymous in accordance with our record retention obligations and practices. In the event that we cannot provide you with access to your personal information, we will endeavour to inform you of the reasons why, subject to any legal or regulatory restrictions.

How can I delete my account?

We hope you will love using Flowchase now and always. However, if for some reason you ever want to delete your account, any school, educational institution, or organisation official can do that at any time by contacting our Data Protection Officer, and we will proceed to delete the requested data within ten (10) business days. Parents, legal guardians, or eligible students may delete their accounts by contacting their educational institution.

If you are a student using our Mobile Application, you can delete your account from within the application; please note that this is a ‘soft’ delete of your account, and your data will be deleted by automated means within a reasonable period of time so that it may be recovered in case of user error.

When we delete your account, we delete any personal information that you provided in your profile (such as your name and contact information) and depending on the category of the user you are (i.e., teacher or student), also questions, responses and comments. Please note that information that you have shared with others, that others have shared about you, or content other users may have copied and stored, is not part of your account and may not be deleted when you delete your account.

Part of your personal information will remain in our possession as a copy or backup that is part of our disaster recovery storage system. However, such copies and backups will be kept for a maximum term of six (6) months and they will neither be accessible to the public, nor used by Flowchase in the normal course of business.

‍

Student Data Control by the School, Educational Institution or Organisation

Access to the Service by the students is subject to the obtaining of a specific code provided by the teacher, school, educational institution, or organisation. The school, educational institution, or organisation is, at the same time, responsible for its students' personal information and in control of student academic records. As a consequence, modification or deletion of student personal information that is part of or affects student academic records is subject to the school/educational institution/organisation's discretion.

‍

Co-teaching

In a co-teaching setting, all teachers are considered equally responsible and accountable for the class. Responsibility for the modification or deletion of student information, or grading of assignments among any other related features shall be exclusively of the teachers.

FLOWCHASE SHALL NOT BE RESPONSIBLE FOR THE DELETION OF THE CLASS OR PART OF ITS CONTENT, OR FOR THE ERASURE OR DELETION OF STUDENT PROGRESS OR STUDENT ACCOUNTS, BY ANY OF THE TEACHERS PARTICIPATING IN THE CO-TEACHING CLASS.

‍

Consumer Complaints

How can I lodge any complaints?

You may file a complaint concerning Flowchase's processing of your personal data by contacting our Data Protection Officer via dpo@flowchase.app, or by regular mail to the following address:

Flowchase SRL
Attention: Data Protection Officer
Chemin du Cyclotron, 6
1348 Louvain-la-Neuve
Belgium

We will take steps to remedy issues arising out of Flowchase's alleged failure to comply with the principles set out in this Privacy Policy. We will respond to your complaints within thirty (30) working days.

If your complaint cannot be resolved through our internal processes, we will direct you to the state or national data protection authority in the jurisdiction where you reside.

‍

EEA Residents

EEA residents and residents from the United Kingdom (UK) will have the right to lodge a complaint to the EU Data Protection Authorities or the Swiss Federal Data and Information Commissioner (FDPIC), Flowchase will comply with the advice of competent European Union authorities in such cases, and will provide appropriate recourse free of charge.

‍

Liability

In the event that Flowchase or the aforementioned authorities determine that Flowchase failed to comply with this policy, Flowchase will take appropriate steps to address any adverse effects arising directly from such failure and to promote future compliance.

‍

Europe

Appointed EU Representative

We have appointed Flowchase SRL, as our representative in the European Union (EU), pursuant to article 27 of the GDPR, and who you may address if you are located in the EU to raise any issues or queries you may have relating to our processing of your Personal Data and/or this Privacy Policy.

Our EU representative may be reached at the email dpo@flowchase.app or at the following physical address:

Attention: Data Protection Officer
Flowchase SRL
Chemin du Cyclotron, 6
1348 Louvain-la-Neuve
Belgium

Other Countries

Transfers of Personal Information to Europe

Flowchase is primarily hosted in the European Union when it comes to our database, audio recordings, and our API servers. Some of our Technical Logs may contain personally-identifiable information (PII) and may be stored in Google Cloud Platform’s ‘Global’ regional products. If you use the Service from any other regions with laws governing data collection, protection and use that may differ from Belgian or European law, please note that you may be transferring your personal information outside of those jurisdictions to Europe. By using the Service, you consent to this, and to the use and storage of personal information in accordance with this Privacy Policy.

‍

Processing in Other Regions

For users from other countries, Flowchase will make sure that all appropriate physical, technical and organisational safeguards are adopted in accordance with this Privacy Policy against accidental, unauthorised or unlawful destruction, loss alteration, disclosure, access, use or processing of users' personal information in Flowchase's possession. Flowchase will promptly notify the user in the event of any known unauthorised access to, or use of, the user's personal information as foreseen in the Security Measures section.