Privacy Policy

1. Controller

The controller of your account data is esysflow.com. Data protection contact: [email protected].

For your clients' data that you process through the Platform (for example website visitors), you are the controller and we are the processor; see the Data Processing Agreement (DPA).

2. What data we process

• account data: name, email, password (stored only as a hash), security settings (2FA);
• usage data: audit log, IP address and device at login, for security purposes;
• billing data: via Stripe (we do not store card details);
• data of connected websites and accounts: addresses, aggregated statistics (Search Console, Analytics, social networks), the content of articles and posts;
• communications: transactional emails and alerts.

3. Purposes and legal bases

• providing the service (performance of a contract);
• security and abuse prevention (legitimate interest);
• billing and tax obligations (legal obligation);
• account communications and alerts (contract); newsletter only with your consent.

4. Where the data is stored

Data is hosted in the European Union. Some sub-processors (for example AI providers or Stripe) may process data outside the EU/EEA on the basis of standard contractual clauses (SCC) and supplementary safeguards; the list is published on the Sub-processors page.

5. Artificial intelligence

AI providers receive only the text needed for generation (keywords, public sources, the blog profile). We do not intentionally send personal data; where the provider offers the option, we do not allow the data to be used for model training.

6. How long we keep data

• account data: for as long as the account is active and up to 30 days after closure;
• audit log: 12 months;
• billing data: in accordance with statutory retention periods (usually 10 years);
• detailed statistics and uptime checks: deleted automatically after limited periods.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to lodge a complaint with a supervisory authority (in Romania the ANSPDCP, in Switzerland the FDPIC). Write to us at [email protected].

8. Security

We use encryption in transit (TLS) and for sensitive stored data (keys, tokens, server passwords), data isolation between customers, two-factor authentication, encrypted daily backups and an audit log.