Privacy Policy
Last updated 15 July 2026
This policy explains what personal data Flowtion collects, why, and what rights you have over it. Flowtion is a time-tracking and Pomodoro tool that works inside your Notion workspace, so some of the data we handle is the content of your Notion tasks -- we treat that carefully and describe exactly how below.
Flowtion is operated by Alin Origin (business ID 3502720-3), registered at 00100 Helsinki, Finland. For anything in this policy, contact us at support@flowtion.so.
We are the data controller for the personal data described here -- meaning we decide why and how it is processed.
- Account data
- Your email address, used to sign you in (via a one-time code or Google sign-in) and to contact you about the service.
- Notion workspace data
- When you connect Notion, we access the databases and tasks you choose -- their titles, statuses, dates, and time you log against them -- so we can display and update them. We only access what you grant.
- Timer & session data
- The focus sessions and time entries you create, so your history and analytics work across devices.
- Subscription data
- If you buy a paid plan, your subscription status and plan. Payment card details are handled entirely by Stripe -- we never see or store them.
- Usage data
- Anonymous, aggregated page-view counts on our marketing site (only if you consent). See Cookies and tracking.
- Email communications
- We use your email address to send you both essential service messages and optional product updates. See Emails we send you.
- To provide the service -- syncing, displaying and updating your Notion tasks and timers. Legal basis: performance of our contract with you.
- To bill you -- managing paid subscriptions through Stripe. Legal basis: performance of our contract with you.
- To keep the service secure and working -- authentication, preventing abuse, fixing errors. Legal basis: our legitimate interest in a reliable, secure service.
- To measure site usage -- anonymous analytics on our marketing site. Legal basis: your consent, which you can withdraw at any time.
- To keep you informed -- essential service emails (sign-in codes, security and account notices, billing, and changes to these terms), plus optional product updates. Legal basis: performance of our contract for the essential messages, and our legitimate interest in telling existing users about product changes for the optional updates, which you can opt out of at any time. See Emails we send you.
Flowtion connects to Notion using Notion’s official authorisation. You choose which workspace and databases to connect, and we only read and write the tasks in those databases. We do not read anything you have not connected.
When you disconnect a workspace or delete your account, we remove the associated Notion access and the cached copies of that data we hold. See How long we keep data.
Paid plans are processed by Stripe. When you check out, you are taken to Stripe’s own secure page; your card details go directly to Stripe and never touch our servers. We receive only your subscription status and the information needed to manage your plan.
Stripe acts as an independent controller for the payment data it collects. See Stripe’s Privacy Policy.
When you sign up, we add your email address to our mailing system so we can contact you about Flowtion. We send two kinds of email, and they are treated differently:
Essential service emails
These are part of providing the service, so you cannot opt out of them while you have an account. They include your sign-in codes, security and account notices, billing and receipts, and important changes to these terms or this policy. Legal basis: performance of our contract with you, and our legal obligations.
Product updates
From time to time we may email you about new features, improvements and tips for getting the most out of Flowtion. Legal basis: our legitimate interest in keeping existing users informed about the product they use. You can opt out at any time using the unsubscribe link in the footer of every product-update email. Opting out stops these updates but does not stop the essential service emails above.
We use a small number of trusted providers to run the service. Each only processes data as needed to provide their service to us:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication and hosting of your account and task data | European Union (North EU — Stockholm) |
| Vercel | Hosting of our website and web app, plus optional anonymous analytics | United States / EU |
| Stripe | Payment processing for paid subscriptions | United States / EU |
| Notion | The workspace your tasks live in, connected at your request | United States |
| Sentry | Error and crash monitoring so we can find and fix problems | European Union |
| PostHog | Product analytics in the web app — only runs with your consent | European Union |
| Google Analytics | Visitor analytics on our marketing website — only runs with your consent | United States / EU |
| Loops | Sending your sign-in codes, essential service emails, and product-update emails you can opt out of | United States |
We keep your account and task data for as long as your account is active. If you delete your account, we delete your personal data within 7 days — we remove it from our live systems immediately, and any residual copies in our hosting provider’s encrypted daily backups roll off within 7 days, except where we must keep certain records (for example, invoices) to meet legal obligations.
To delete your account: in the web app, open the account menu at the bottom of the sidebar and go to “Account & Data”, then under “Danger Zone” click “Delete account” — this is permanent and also cancels any active subscription.
Under the GDPR you have the right to access your data, correct it, delete it, restrict or object to its processing, and receive a copy in a portable format. To exercise any of these, email us at support@flowtion.so. We respond within one month.
You also have the right to lodge a complaint with a supervisory authority -- for us, the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), Finland.
Some of our providers (Vercel, Stripe, Notion, and Loops) are based in the United States. Where your data is transferred outside the European Economic Area, that transfer is covered by the European Commission’s Standard Contractual Clauses or an equivalent approved safeguard.
We protect your data with encryption in transit, strict access controls, and reputable infrastructure providers. No system is perfectly secure, but we take reasonable steps to keep your data safe and will notify you and the relevant authority of a breach where the law requires.
Flowtion is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.
We may update this policy as the service evolves. When we make a material change, we will update the date at the top and, where appropriate, notify you. Continuing to use Flowtion after a change means you accept the updated policy.
Questions about this policy or your data? Email support@flowtion.so and we will help.