Privacy policy

1. Controller

FLOW XP BV, Wit Kapelleke 26, 1652 Beersel, Belgium, BE 0669.982.661, is the controller of the processing described here. Contact: admin@flowxp.eu.

2. Data we process

Account.An email address, a password, a chosen colour and emblem, and one or more roles. Every account carries its own email address, including a minor's — that is what makes a blocked profile reachable. Passwords are stored hashed, never encrypted and never in clear text.

Date of birth. Collected once, and used for one purpose only: determining whether the user is below the digital consent age of sixteen. It is not used to derive a sport category, which comes from the team joined.

Use of the service. Morning check-in values, evening journal entries, answers given to the questionnaires offered by the application and the readings produced from them, routines, quests, team membership, calendar events.

The answers given to the questionnaires, and the readings produced from them, may reveal characteristics relating to personality, motivation or how a person experiences their sport. We treat them as the most sensitive data in the service, and the guarantees in Articles 5 and 6 exist for them.

Technical data. Session data, and the access log described in Article 8.

Payment. Subscription and billing data. The payment itself is processed externally: we never receive or store bank card details.

Early access request. Where you ask for early access from this website, we record your first and last name, your email address, the role you selected, your country, your sport, the language of the page — and, for the age condition below, the exact wording that was shown to you together with the moment you accepted it. Nothing else is collected on that form.

No image, ever. There is no profile picture and no image upload anywhere in the product — so nothing to moderate, no image of a minor stored, and no facial recognition possible. No initials either: two people can share the same ones.

3. Purposes and legal bases

• Providing the service — account, daily routine, questionnaires and their readings, routines, quests, calendar: performance of the contract. The assessment is the service itself, not an optional extra.
• Processing a minor's data below sixteen — the consent of the holder of parental authority, under Article 8 of the GDPR.
• Sharing an element with a coach — the explicit consent of the person, given for one team and withdrawable at any time.
• Billing and accounting — legal obligation.
• Answering an early access request — your consent, given by ticking the boxes on the form. The list is used for that purpose alone, and for no other. Access is reserved for people aged sixteen or over; an inaccurate declaration leads to the request being refused and the data deleted.
• Producing aggregated and anonymised statistics — our legitimate interest in understanding, measuring and improving the service. The results never allow a person to be identified and are no longer personal data.
• Security of the service and the access log — our legitimate interest in keeping accounts safe, and our legal obligation to be able to demonstrate who read what.

Consents are granular: one purpose at a time, each refusable separately, and refusing one never blocks the others.

4. Minors — the strict regime

The digital consent age applied is sixteen years. Below that age, a parent must consent before any use.

• The parent receives a request by email and answers. The code travels from the parent down to the child, never the other way: that direction is what proves the parent received the message.
• A refusal blocks the profile; it never deletes it. The child may send the request again, to the same address or to another, without limit — one per twenty-four hours.
• Three emails to the parent, not one more: the request, a single reminder, and the announcement of the refusal. After that we no longer write to them.
• Silence amounts to refusal after thirty days, with the same state and the same possibility of asking again.
• Any consent creates a parent account, even a dormant one: without an account there is no withdrawal, and withdrawing must be as easy as granting.
• The coach is told that there are minors in the team, but never receives a parent's address and never chases anyone.

On the sixteenth birthday, parental supervision ends by itself — the legal basis disappears, without anyone having to ask. Rather than cutting without a word, the application asks the player whether they agree that their parent continues to see. Silence means no. The legal basis changes person: it is now the player consenting for themselves. Refusing has no consequence, and an agreement is withdrawn as easily as it is given.

5. What a coach sees, and never sees

A coach sees a fact of use — the date of a last check-in, a count of days — and the elements a player has expressly chosen to share.

A coach never sees, under any setting:

• the content of a journal;
• an individual check-in value;
• a raw answer to a questionnaire;
• any detection, alert or signal about a person's state. The application never decides that someone is unwell, and never reports it to anyone.

A parent sees consents and account data. A parent never sees what their child writes.

6. The journal, and the language model

What a player writes is read by no human being — not a coach, not a parent, not a club, not us. The server sends it once to a language model to rewrite the summary paragraph, and that is the only exit of the text.

We write it this way rather than saying "nobody reads it", because the short form would be false, and a false promise on this point would cost the trust of everything else.

The request sent to the model contains only a purpose and a text. It carries no identifier — there is no name to remove, because none is sent. The provider retains nothing, the text enters no log, and it never comes back towards a coach, a parent or a club.

There is no conversation with an artificial intelligence anywhere in the product: no thread, no agent, no dialogue box. The person fills in fields, the server calls once, a text comes back and is placed in the screen.

That send appears in the access log, like any other read.

7. Recipients and processors

We rely on a small number of external services to operate FLOW XP, in the following categories:

• hosting of the application and of its data;
• processing of payments and management of subscriptions;
• the single language-model call described in Article 6.

Each of them acts solely on our instructions, under a written processing agreement, and never for a purpose of its own. The current list is provided on request.

Emails are sent from our own domain. We sell no data, rent no data, and share none for advertising purposes. There is no such thing in this product.

8. The access log

Every read of a person's data is recorded and consultable by that person: who read what, and when. Including us, and including the evening send to the language model.

The log has no separate retention period: it lives as long as the account and dies with it.

9. Transfers outside the European Union

The personal data of the application is hosted within the European Union.

Where a processor may, for a technical operation, process data outside the European Economic Area, that processing is covered by the safeguards provided for in Chapter V of the GDPR, in particular the European Commission's standard contractual clauses.

We therefore do not write that no data ever leaves the European Union. A guarantee that is displayed must be defensible.

10. Retention and erasure

No data of a living account erases itself. Withdrawing a consent stops the data being used; it does not destroy it, and a consent granted again recovers its history. A "stop everything" option returns the account to the blocked state without destroying anything.

The product knows only two erasures:

• deletion requested by the person — seven days of recovery, the account being invisible and inactive during that period;
• purge of a blocked profile left one year without activity, announced thirty days in advance by email.

Accounting records are kept for the period required by Belgian law, independently of the above.

11. Your rights

You have the right of access, rectification, erasure, restriction and objection, the right to data portability, and the right to withdraw a consent at any time — withdrawal does not affect processing already carried out.

Export works at any time from the application, including on an account that is frozen, blocked or being deleted.

Requests go to admin@flowxp.eu. Where the person concerned is a minor below sixteen, the holder of parental authority may exercise these rights on their behalf.

You may lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, or with the supervisory authority of your country of residence.

12. Cookies and trackers

The website uses no analytics cookie, no advertising cookie and no third-party tracker. It loads no remote resource: no external typeface, no content-delivery-network script, no tracking pixel.

The application uses a session cookie that is strictly necessary to keep you signed in. Sessions are short, sliding and revocable, and are extinguished by a parental refusal, a freeze, a deletion request or a password change.

Emails contain no remote image and no tracking pixel: knowing who opens a consent email has no legitimate purpose.

13. Security

Passwords are stored hashed with a memory-hard function. One-time codes are stored as keyed fingerprints, never in clear text.

Every read of personal data is executed under the identity of the person making it, and is written to the access log in the same transaction. The browser never talks to the database directly.

14. Changes to this policy

This policy may change. Any substantial change is announced in advance, and the date at the top of this page is updated. Previous versions are made available on request.

15. Contact

Any question about this policy or about the processing of your data: admin@flowxp.eu.