Flowrite

GDPR overview

GDPR compliance is claimed explicitly: a GDPR Compliant badge appears on the security page and the homepage, and the privacy policy, effective 27 January 2025, lists the eight data subject rights. Maestro Labs has named an internal data protection officer, Sebastian Illing (sebastian@maestrolabs.com), and routes rights requests to support@maestrolabs.com, with support.uk@maestrolabs.com for UK users. Because the databases sit in the United States, which holds no Article 45 adequacy decision, transfers rely on standard contractual clauses under Article 46, described as enhanced in line with European Data Protection Board guidance. A data processing agreement is available on request. No Article 27 EU representative is named anywhere on the site. The policy adds that the company has received zero government requests for information since it was founded, and that Do Not Track signals are not honoured.

Who owns the data?

Maestro Labs Pte. Ltd., registered at 160 Robinson Road, #14-04 Singapore Business Federation Centre, Singapore, is the controller behind the service. It has appointed an internal data protection officer, Sebastian Illing, reachable at sebastian@maestrolabs.com. The privacy policy, effective 27 January 2025, makes the customer responsible for whatever they feed the tool: the vendor describes itself as a passive processor of User Content and expects users to hold the lawful basis for processing and to inform third parties whose data appears in their emails. The terms of service also allow Maestro Labs to display a customer company's name and logo in its own marketing materials.

Reuse rights

Collected data serves only to deliver and improve the products, analyse usage patterns and troubleshoot. Personal information is never sold and is shared only with providers that help deliver the service; it is never used for advertising or profiling. Email content and user instructions are passed to third-party AI models so the assistant can draft and summarise, and the policy concedes that anonymisation applies only in some cases. Fully anonymised usage data feeds improvements to internal systems and prompt logic, and the security page states that customer data is never used to train AI models. On the user's side, the terms reserve Maestro Labs' intellectual property over its own site and application material and forbid republishing, reselling, reproducing or redistributing it. They say nothing explicit about who owns the drafts the assistant generates, so that point is worth clarifying before building a published workflow on top of it.

Data retention & training

Hosting summary

Maestro Labs Pte. Ltd. is headquartered in Singapore, but the privacy policy is explicit that the databases are located in the United States and that information collected about users is processed there. Storage also runs on cloud database services located in the United States and the European Union, and the policy notes that the specific location depends on the service and infrastructure used rather than on where the user is. Because the United States has neither sought nor received an adequacy finding under Article 45 of the GDPR, transfers rely on binding standard contractual clauses under Article 46, which the company describes as enhanced in line with European Data Protection Board guidance. Data is encrypted in transit and at rest. A subprocessor list is published in the Trust Center at security.maestrolabs.com, and the company says subprocessor and transfer impact assessments are ongoing. Note that the Trust Center is rendered in JavaScript, so the list itself could not be read directly during this review.