Privacy policy

Last updated: 13 November 2026

This policy explains what personal data Inflowy processes, why, for how long, and what rights you have under Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.

It covers the website inflowy.app and the service my.inflowy.app ("Inflowy" or "the Service").

Data controller

GogoVest S.R.L. Via Salento, 61 – 00162 Rome (RM), Italy VAT number IT14688251009 Privacy contact: privacy@gogovest.com

Inflowy is a product of GogoVest S.R.L. Below, "we" and "us" mean GogoVest S.R.L.

When we are controller and when we are processor

Businesses use Inflowy to handle conversations with their own customers: email, WhatsApp, Teams, notes, cases and documents. So there are two roles to tell apart.

  • We are the controller of the data of website visitors, of people who create and use an account, of people who write to us, and of billing data. This policy covers that processing.
  • We are a processor (Art. 28 GDPR) of the data that customer businesses upload to or receive in Inflowy about their own customers and contacts: messages, attachments, phone numbers, email addresses, cases. For that data the controller is the customer business, which decides what is processed and for how long; we process it only to provide the Service and on its instructions. If you are an end customer of a business that uses Inflowy, please contact that business to exercise your rights; if you contact us, we will forward your request.

What data we process

  • Browsing data: IP address, date and time of the request, page requested, browser and operating system. Our servers log it to run and protect the website.
  • Account data: name, email, password (stored only as a hash), any passkeys, profile picture, organisation and role, language and notification preferences.
  • Sign-in through third parties: if you choose to sign in with Google or GitHub, we receive your name, email and profile picture from them.
  • Integration data: if you connect Gmail, WhatsApp, Microsoft Teams, ClickUp or GitHub, we store the authorisation tokens needed and the synchronised content, which is the customer business's data (see above).
  • Usage data and technical logs: actions taken in the Service (for example who completed a step of a case and when), errors and security logs.
  • Communications: what you send us by email or through the contact form.
  • Billing data: company name, VAT number, address, chosen plan and payment history. Card details are handled directly by Stripe: we never see or store them.

Why we process it and on what legal basis

  • Providing the Service: creating and managing your account, running the inbox, cases, workflows, notifications and integrations. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
  • Service emails: address confirmation, sign-in, team invitations, notifications you have turned on. Legal basis: performance of a contract.
  • Support and answering requests: legal basis: pre-contractual steps or performance of a contract.
  • Billing, tax and accounting obligations: legal basis: legal obligation (Art. 6(1)(c) GDPR).
  • Security, abuse prevention and troubleshooting: legal basis: legitimate interest (Art. 6(1)(f) GDPR) in protecting the Service and its users.
  • Improving the product, based on aggregated usage statistics: legal basis: legitimate interest. We do not profile users for advertising.
  • Marketing communications about Inflowy: only with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time through the link in every email or by writing to us.
  • Establishing or defending legal claims, where needed: legal basis: legitimate interest.

Account data is required to use the Service; all other data is optional.

Features based on artificial intelligence

Some optional Inflowy features, such as the suggested title for a case or rewriting a reply, send the relevant text to Anthropic's language model (Claude) to produce the result. We send only the text that feature needs, at the moment it is used. Under Anthropic's commercial terms, data sent through the API is not used to train its models. We do not make decisions based solely on automated processing that produce legal effects concerning you (Art. 22 GDPR).

Who we share data with

Data is processed by our authorised staff and by providers that help us run the Service, appointed as processors under a contract pursuant to Art. 28 GDPR:

  • Hosting and infrastructure: the servers that run the website, the application and the database.
  • Cloudflare (storage of files and attachments).
  • Resend (sending service emails) and Postmark (receiving inbound email).
  • Stripe (payments and subscriptions).
  • Anthropic (the artificial intelligence features described above).
  • Google, Microsoft, GitHub, ClickUp and WhatsApp (Meta), only if you choose to use the corresponding sign-in or integration; in that case the data is also processed under their own policies.

We may also disclose data to public authorities where required by law, and to advisers (such as accountants and lawyers) bound by confidentiality. We do not sell personal data or share it with third parties for their marketing.

Transfers outside the European Union

Some of the providers listed are based in, or process data in, the United States. In those cases the transfer relies on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, for certified providers, or on the standard contractual clauses approved by the Commission (Art. 46 GDPR), with any supplementary measures needed. You can ask us for a copy of these safeguards at privacy@gogovest.com.

How long we keep data

  • Account data: for as long as the account exists. After it is closed we delete or anonymise it within 30 days; backup copies are overwritten within a further 30 days.
  • Data the customer business uploads to Inflowy: according to its instructions and in any case no longer than the end of the contract, unless the law requires otherwise.
  • Technical and security logs: up to 12 months.
  • Billing data: 10 years, as required by Italian civil and tax law (Art. 2220 of the Civil Code).
  • Communications and support requests: for as long as needed to handle them and up to 24 months after the last contact.
  • Data processed on the basis of consent: until consent is withdrawn.

How we protect data

Connections are encrypted (HTTPS/TLS), passwords are stored only as hashes, access to data is limited to the people who need it, and each organisation's data is kept separate from the others. You can also sign in with a passkey. No system is 100% secure: if a personal data breach affecting you occurs, we will inform you in the cases and within the time limits set by Articles 33 and 34 GDPR.

Your rights

At any time you can ask us for:

  • access to your data and a copy of it (Art. 15);
  • rectification of inaccurate data (Art. 16);
  • erasure (Art. 17);
  • restriction of processing (Art. 18);
  • portability of the data you provided, in a structured, machine-readable format (Art. 20);
  • to object to processing based on legitimate interest (Art. 21);
  • to withdraw consent you have given, without affecting earlier processing.

To exercise your rights, write to privacy@gogovest.com. We reply within one month, which may be extended by two further months for complex requests, as provided by Art. 12 GDPR. We may ask for information to verify your identity.

You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it, or with the supervisory authority of the EU country where you live or work.

Children

Inflowy is a service for businesses and professionals and is not intended for anyone under 18. We do not knowingly collect children's data.

Cookies

For the cookies and similar technologies used by the website and the Service, see the Cookie policy.

Changes to this policy

We may update this policy when the Service or the law changes. The date at the top shows the latest version; if changes are significant, we will tell registered users by email or in the Service.