Privacy policy
Last updated 28 October 2026
What personal data FlowAttend collects, why, how long we keep it, and what rights you have.
1. Who we are
FlowAttend is an online service for digital training attendance sheets, run by Maxime Houpert EI (Creapp) (“FlowAttend”, “we”), whose details are in the legal notice. The sale of paid plans is governed by our terms of service.
For any question about your data, write to support@flowattend.com. We answer within one month.
2. Our two roles
- For people who use FlowAttend (account holders, team members, website visitors, people who write to us), FlowAttend decides why and how their data is used: we are the controller (sections 3 and 5–11).
- For participants and trainers who sign an attendance sheet, the company or organisation that runs the training decides: it is the controller, and FlowAttend processes the data on its behalf as a processor, under our data processing agreement (section 4).
3. Data we collect as controller, and why
| What | Data | Why | Legal basis (GDPR art. 6) |
|---|---|---|---|
| Your account | Name, email, password (handled by our authentication provider) or Google sign-in, plan | To create and run your account | Contract (1)(b) |
| Your settings | Saved trainer signature, company name, address, website and logo, PDF naming, session form settings | To put them on your attendance sheets | Contract (1)(b) |
| Your sessions | Training name, date, times, location, trainer name and details | To provide the service | Contract (1)(b) |
| Your team | Email addresses you invite, members’ roles | To give your team access | Contract (1)(b) |
| Contact form and emails to us | Name, email, message | To answer you | Legitimate interest (1)(f): replying to requests |
| Feedback in the app | Your message and account email | To improve FlowAttend | Legitimate interest (1)(f) |
| Security | IP address, linked to sign-in, signing and export attempts, kept 1 day; short-lived server logs at our hosting provider | To prevent abuse and keep the service secure | Legitimate interest (1)(f) |
| Your devices | For each browser your account is used on: a random identifier (stored only as a hash), its type such as “Chrome on Windows”, when it was added and last used | To keep your account personal: it can be used on 2 devices, and a new one needs a code sent by email | Contract (1)(b), legitimate interest (1)(f) |
| Billing (Pro and Team) | Name or company name, billing address, VAT number, email, plan, payment history and invoices. Card details are entered on Stripe’s page and never reach us. | To take payment, invoice, and keep accounting and tax records | Contract (1)(b), legal obligation (1)(c) |
We don’t sell your data, use it for advertising, or build profiles.
4. If you signed an attendance sheet
When you sign an attendance sheet with FlowAttend, we process your data for the company or organisation that runs the training. It decides what the data is used for, and you should contact it first to exercise your rights. On trainings prepared for INFPC co-funding in Luxembourg, it shows you its own data protection notice before you sign.
What we store for it:
- Participants: first and last name, signature and, if asked, whether you are employed outside Luxembourg. To stop the same phone signing twice, your browser keeps a random identifier; it contains no personal information.
- External trainers: name, signature, date of signing and, for external trainings, your organisation’s country and, in Luxembourg, its name.
- On Luxembourg co-funding trainings: that you accepted the data protection notice.
Your name and signature are deleted automatically 7 days, 3 months or 18 months after the training, depending on the organiser’s plan, or earlier if the organiser deletes the session. If you write to us about a sheet, we forward your request to the organiser.
5. Who receives the data
Only the service providers we need to run FlowAttend, under contract and on our instructions:
| Provider | What they do | Where the data is |
|---|---|---|
| Supabase, Inc. | Database, file storage, sign-in | European Union |
| Railway Corporation | Hosting of the application | European Union (Amsterdam) |
| Stripe Payments Europe, Ltd. | Payments, subscriptions and invoices (Pro and Team) | European Union (Ireland); Stripe may process data in the United States (section 6) |
| Resend, Inc. | Sending emails (sheets by email, team invitations, replies to contact messages) | European Union (Ireland) |
| Google LLC (Gmail) | Our support mailbox: messages sent to support@flowattend.com and through the contact form | May be outside the EEA (section 6) |
If you sign in with Google, Google shares your name and email with us, under Google’s own privacy policy. Inside a team, members see the sessions and sheets of their team. We disclose data to authorities only when the law requires it.
6. Transfers outside the European Economic Area
Your data is stored, and our emails are sent, in the European Union. Messages you send to our support address are kept in Gmail, whose servers may be outside the EEA. Our providers are US companies and may access data from outside the EEA for support or maintenance. These transfers are covered by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission’s Standard Contractual Clauses. You can ask us for a copy of the safeguards used.
7. How long we keep data
| Data | Kept |
|---|---|
| Account, settings and sessions | While your account is open; deleted within 30 days after you ask us to close it |
| Participants’ names and signatures | 7 days (Free), 3 months (Pro) or 18 months (Team) after the training |
| Contact messages and feedback | 2 years after our last exchange |
| IP addresses for abuse prevention | 1 day |
| Your devices | While your account is open; you can remove a device in Settings |
| Invoices and payment records | 10 years, as French accounting law requires (Code de commerce, art. L123-22) |
8. Security
All connections use HTTPS. Each account sees only its own sessions and sheets, and signing pages show nothing about other participants. Saved signatures are kept in private storage, and attempts to abuse sign-in or signing are rate-limited. If a breach puts your data at risk, we inform you, and the organiser of the training where relevant, as the GDPR requires.
9. Cookies and local storage
FlowAttend uses no advertising or analytics cookies, so we don’t ask for cookie consent. We only use what the service needs to work:
| Name | What it does | How long |
|---|---|---|
| Sign-in cookies (set by our authentication provider) | Keep you signed in | Until you sign out or the session expires |
Device identifier (fa_device) | Recognises this browser as one of your account’s devices, so you aren’t asked for a code each time | About 13 months, or until you clear your browser data |
Signing identifier (em_fp, stored in your browser) | Stops the same phone signing an attendance sheet twice | Until you clear your browser data |
10. Your rights
You can ask to access your data, correct it, erase it, restrict or object to its use, and receive it in a portable format, within the limits set by the GDPR. Where we rely on legitimate interest, you can object at any time.
Write to support@flowattend.com. We may ask you to confirm your identity, and we answer within one month. If you signed an attendance sheet, contact the organiser of the training first; we will forward your request if you write to us.
You can also lodge a complaint with the French data protection authority, the CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr, or with the authority of the EU country where you live or work (in Luxembourg, the CNPD, cnpd.public.lu).
11. Changes to this policy
We update this policy when FlowAttend or the law changes; the date at the top shows the latest version. If a change matters for how we use your data, we tell account holders by email at least 30 days before it applies.