Privacy Policy

At FigFlows AB, we take your privacy seriously. This privacy policy describes how we collect, use, store, and share your personal information when you use our website and services. We are committed to protecting your personal data and complying with applicable data protection laws, including the General Data Protection Regulation (GDPR).

We may collect the following types of personal information: • Contact information (name, email address, phone number) • Company information and job title • Technical information (IP address, browser type, device information) • Usage data (how you interact with our website and services) • Communication data (messages you send to us)

We process your personal data for the following purposes: • To provide and improve our services • To communicate with you about our services • To contact you by phone or email for sales and follow-up on your inquiries • To respond to your inquiries and support requests • To send marketing communications (with your consent) • To comply with legal obligations • To protect our legitimate business interests

We do not use tracking cookies without your consent. Consent is the legal basis for analytics. • Necessary (always on, no tracking): the website stores in your browser (localStorage) your consent choice (figflows-analytics-consent), your language choice, your ongoing chat (figflows_chat_state) and your AI plan answers (figflows_ai_plan_answers_v1). This is not sent to us. • Analytics (only if you choose "Allow all" or switch on Analytics): Google Analytics 4 with anonymised IP address, to understand how the website is used. Google then sets the cookies _ga and _ga_<id>, stored for up to 2 years. We do not use marketing or advertising cookies. If you choose "Reject all", Google Analytics is never loaded. You can change or withdraw your choice at any time via "Cookie settings" at the bottom of every page — if you withdraw, analytics cookies are deleted and the page reloads. Microsoft Clarity is used only with your Analytics consent. Microsoft then receives technical usage data for clicks, scrolling and session recordings. Page content and form fields are masked; our measurement events do not include form answers. Clarity does not load on admin, editing or cancellation pages. Cookies _clck (up to 1 year) and _clsk (up to 1 day) are used. Recordings are normally retained for 30 days; click data and labeled/favorited sessions for up to 9 months. Withdrawal stops further measurement through a reload and clears Clarity cookies on our domain; previously collected data is not automatically deleted.

We store your personal data securely using industry-standard security measures. Your data is stored on secure servers and is protected against unauthorized access, alteration, disclosure, or destruction. We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy or as required by law.

When you use our AI chatbot, we collect the following personal data: • Chat messages (your questions and responses) • Message timestamps • Language preference • IP address and browser information (for security purposes) • Session ID (unique conversation identifier) **Local Storage**: Your messages are temporarily stored in your browser's localStorage to preserve the conversation if you close the chat window. This data is automatically deleted when you end the conversation. **Purpose**: We use this information to provide AI-powered responses to your questions and improve our service. **Data Sharing**: Your chat data is sent to OpenAI to generate responses. OpenAI acts as a data processor under GDPR Art. 28 and does not use your data to train its models. **Storage**: Chat data is stored in our database for 30 days and is then deleted automatically. **Your Rights**: You have the right to request deletion of your chat data at any time by contacting us at contact@figflows.com. Provide your Session ID (shown in the chat window) for faster processing. We will delete all data linked to your chat within 30 days.

We do not sell, trade, or rent your personal information to third parties. We may share your data with: • Service providers who assist us in operating our business • Legal authorities when required by law • Business partners with your explicit consent All third parties are required to maintain the confidentiality of your information.

Under GDPR and other applicable laws, you have the right to: • Access your personal data • Correct inaccurate information • Delete your personal data • Restrict processing of your data • Data portability • Object to processing • Withdraw consent To exercise these rights, please contact us using the information provided below.