Privacy policy

1. Introduction

Fast Flow Tech ("we", "us", "our") operates the fastflow.tech website and the Fast Flow Tech platform, including every product reachable through FlowPrime and through individual subscriptions (together, the "Service").

This policy explains what we collect, how we use it and how we protect it, both when you visit the site and when you use the Service. By using the Service you consent to what is described here.

2. What we collect

2.1 What you give us

• Account information: Name, email address, organization name and password when you create an account through ALKEYON, our identity platform.
• Billing information: Payment details are processed by Stripe. We do not store your full card number, CVV or bank details on our servers.
• Messages: What you write in the contact form, by email or through support channels.
• Application and idea chat: When you use the idea box on this site, the whole conversation (your messages and the assistant's replies) is sent to our AI gateway to produce the answer, and - only when you press "send application" - it is stored with the contact you provide as a ticket on our internal feedback board. The application form works the same way. If you do not send it, nothing about the conversation is stored beyond your browser session.
• Your content: Any data, file or content you create, upload or store in our products in the course of normal use.

2.2 What is collected automatically

• Usage data: Pages visited, features used, actions taken inside our products, timestamps and session duration.
• Device information: Browser, operating system, device type, screen resolution and language preference.
• Log data: IP address, referring URLs and access times.
• Performance metrics: Database usage, CPU and memory consumption and bandwidth attached to your account, for the purposes described in our Terms of Service.

3. How we use it

We use what we collect to:

• Provide, operate and maintain the Service
• Process transactions and manage your subscription
• Authenticate you and manage access across products
• Send transactional email (account confirmations, receipts, security alerts)
• Read and answer applications and contact messages
• Understand usage patterns and improve the products
• Monitor resource consumption (database size, CPU, memory, bandwidth) to keep the platform stable and prevent abuse
• Detect, prevent and address technical issues, fraud and security threats
• Send product updates and the newsletter - only with your consent, and you can unsubscribe at any time

4. Isolation and security

Every tenant on the platform gets isolated databases. Your data is separate from every other organization. We apply industry-standard measures:

• Encryption in transit (TLS/HTTPS) for all communication
• Encryption at rest for stored data
• JWT authentication through our OIDC-compliant identity platform (ALKEYON)
• Regular security review and monitoring
• Role-based access control inside each organization

No method of electronic storage or transmission is 100% secure. We cannot promise absolute security, but we commit to notifying affected users promptly in the event of a breach.

5. Third parties

These third-party services may process your data:

• Stripe: Payment processing. Subject to Stripe's privacy policy.
• Cloudflare: Content delivery, DDoS protection and DNS. Subject to Cloudflare's privacy policy.
• Model providers: The idea chat on this site is answered by a large language model reached through our own AI gateway. The text of the conversation is sent to the model provider to produce the reply. Do not put confidential information into the chat.

We do not sell, trade or rent your personal information. We may share anonymized, aggregated data that cannot identify you.

6. Cookies and tracking

We use essential cookies for authentication and session management. They are strictly necessary for the Service to work and cannot be disabled.

We use our own analytics platform (FF Analytics) to understand how the products are used. That data is processed on our own infrastructure and is not shared with advertising networks.

We do not use third-party tracking cookies, advertising pixels or behavioral profiling tools.

7. Retention

We keep account information and your content for as long as the account is active. When you delete the account or ask for deletion, we remove your personal data within 30 days, except where the law requires us to keep it.

Billing records and transaction history may be kept for up to 7 years for tax and accounting obligations.

Anonymised, aggregated usage data that cannot identify you may be kept indefinitely to improve the products.

8. Your rights

Depending on where you are, you may have the right to:

• Access: Ask for a copy of the personal data we hold about you.
• Correction: Ask us to correct inaccurate or incomplete data.
• Deletion: Ask for your personal data to be deleted, subject to legal retention requirements.
• Portability: Ask for your data in a structured, machine-readable format.
• Objection: Object to certain kinds of processing.
• Withdraw consent: Where processing rests on consent, withdraw it at any time.

To exercise any of these, write to support@fastflow.tech. We answer within 30 days.

9. International transfers

Our infrastructure is self-hosted in New Zealand, on our own servers, not on third-party cloud providers. If you use the Service from outside New Zealand, your information may be transferred to and processed in New Zealand. By using the Service you consent to that transfer.

New Zealand is recognized by the European Commission as providing an adequate level of data protection under the GDPR.

10. Children's privacy

The Service is not directed at people under 16. We do not knowingly collect personal information from children. If we learn that we have, we delete it promptly.

11. Applicable law

As a New Zealand company we comply with the New Zealand Privacy Act 2020 and its Information Privacy Principles. Where they apply, we also respect the rights granted by the EU General Data Protection Regulation (GDPR), by the California Consumer Privacy Act (CCPA/CPRA) and by the Brazilian Lei Geral de Proteção de Dados (LGPD).

We do not sell personal information. For California residents: under the CCPA you have the right to know what is collected, to ask for deletion and to opt out of any sale or sharing. Since we do not sell personal information, no opt-out mechanism is needed.

12. Changes to this policy

We may update this policy. We announce material changes by publishing the new text on this page and updating the "last updated" date. Continuing to use the Service after a change means accepting the revised policy.

13. Contact