Flowcart

GDPR overview

The privacy policy opens by claiming alignment with the European General Data Protection Regulation. It names lawful bases, being contractual necessity, legitimate interests and withdrawable consent, along with rights of access, rectification, restriction and erasure, exercised through connect@sukhiba.com. The terms add a full processor framework: documented instructions, personnel confidentiality, sub-processor obligations, assistance with data-subject requests, breach notification to the client within 48 hours, audits once a year and deletion or return at the end of the contract. The gap is institutional. No EU entity, no Article 27 representative and no data protection officer is named anywhere, and Exhibit B carries market schedules for Kenya, South Africa, India and the United States but none for the European Union, so cross-border transfers point to a schedule that European clients do not have.

Who owns the data?

Under the terms, the client keeps ownership of its own content. Section 13.1 casts the client as Controller and Flowcart, named the Software Provider, as Processor for the personal data held in Client Content, and section 12.1 treats that content as the client's confidential information. Flowcart receives only a limited licence to copy, store and transmit it as far as running the service requires, and section 16.2 extends the same status to anything typed into, or produced by, the AI features. Flowcart retains all rights to its own software, documentation and deliverables. On exit, section 13.10 lets the client choose between deletion and return.

Reuse rights

The client instructs and Flowcart executes: section 13.2 restricts processing to the client's documented instructions, and section 13.5 authorises sub-processors, naming Meta, cloud hosting providers and messaging infrastructure providers as categories bound by materially equivalent obligations. Section 16.5 lets Flowcart pass AI inputs to third-party AI providers, but only as far as delivering the AI features requires. Two carve-outs work the other way: section 14.11 permits anonymous statistical compilation to improve the offering, provided nothing identifies the client or its data, and section 14.9 allows the client's name and logo in Flowcart's marketing unless the client objects in writing. Reuse of end-customer data stays the client's responsibility, including the lawful basis and the consent obtained before any message is sent.

Data retention & training

Hosting summary

Flowcart publishes no hosting location. Neither a country nor a region appears anywhere on the site, and the terms refer to cloud hosting providers only as a category of sub-processor, without naming one. Section 13.6 states that where the service transfers personal data outside the client's jurisdiction, the transfer uses whichever mechanism the client's market schedule specifies, and that information about destinations and safeguards is supplied on request rather than published. Since Exhibit B carries market schedules for Kenya, South Africa, India and the United States but none for the European Union, a European client has no named transfer mechanism to point to. Section 13.4 commits to appropriate technical and organisational measures, reviewed as risks change, and the footer claims SOC 2 Type II certification, although no trust page or report is linked. The web front end sits behind Cloudflare, which describes content delivery rather than where customer data is stored. A buyer with data-residency requirements should treat this as an open question and settle it in the commercial terms schedule.