Teamflow app
Privacy policy
How the publisher processes your data when you use the Teamflow app.
Last updated: 1 September 2026.
This policy applies to the Teamflow mobile app (iOS and Android) and the servers that run it. The marketing site contact form and test sign-up form are described in the legal notice. The terms of use govern access to the service.
Controller
F. Cárdenas, sole trader — contact form.
No data protection officer has been appointed. Requests about personal data are handled by the publisher.
Data we collect
Account and profile — email address; password (stored hashed only, never in clear text); display name; profile photo if you upload one; biography; social-network links you enter; interface language.
Team activity — organisations and teams (membership, manager role, invite code); email invitations; documents, folders, calendar events and lists you create or that are shared with you; team logos.
Technical traces — last activity date (approximate “online” status, not real time); device type (iOS or Android); IP address at sign-in, for security. A city or country indication may be inferred from that IP; it is visible only in the publisher’s admin console, not in members’ apps. Teamflow does not access the device’s GPS.
Camera and photo library — only if you choose to add a photo or logo; the file is then sent to our servers.
Purposes and legal bases
| Purpose | GDPR basis |
|---|---|
| Providing the service (account, teams, documents, calendar, lists) | Performance of the contract |
| Account security, abuse prevention, technical logs | Legitimate interest |
| Showing approximate presence to authorised members | Performance of the contract |
| Administration, support and moderation by the publisher | Legitimate interest |
| Legal obligations (retention, lawful requests) | Legal obligation |
| Answering marketing-site messages | Legitimate interest (see legal notice) |
You need not provide a photo, biography or social links; without email and password, an account cannot be created.
Recipients and in-app visibility
Data are hosted by the publisher and the API host (OVH SAS).
Members of your teams see certain information under product rules: upline, downline and peers (same-level teammates). They do not see cousins’ downline (deeper side branches), unless they manage that branch. A manager or ancestor may browse a subordinate’s documents and calendar, and grant access to other teams in their scope. A document or event so shared is not duplicated: authorised recipients access the same item.
The publisher and authorised admin-console staff may access accounts for support, security and enforcement (activation, deactivation, deletion).
A share you trigger from the phone (system share sheet, e.g. to a messenger) leaves Teamflow: those recipients are not our processors for that send.
Apple and Google process data linked to download and, where applicable, your store account, under their own policies.
Transfers outside the European Union
The API and business files are hosted in the Union (API host above). The marketing-site form goes through Web3Forms (United States) and hCaptcha; the site also loads Google Tag Manager. Those providers are described in the legal notice.
Retention
Account data are kept for as long as the account is active. Deletion from the app is a logical erasure (the account can no longer be used; the session is invalidated). Documents and events created by the account are also made inaccessible. Content created by other members remains. If you led a team, subordinates may be attached to the parent team under product rules.
Traces (security logs, any invoices, legal duties) may be kept longer, limited to what is necessary. Permanent deletion may be requested from the publisher, subject to retention duties.
Contact-form and test sign-up messages: 12 months after the last exchange, unless a longer duty applies.
Security
Passwords are never stored in clear text. API traffic uses HTTPS. No measure is infallible; report incidents via the contact form.
Your rights
You have rights of access, rectification, erasure, restriction, objection, portability, and the right to withdraw consent where processing is based on it. You may lodge a complaint with the CNIL or your local supervisory authority.
How to exercise them: in the app (profile, password, account deletion); contact form. Reply within one month, extendable under the GDPR.
Minors
The service is for adults. The publisher does not knowingly collect data from children under 18. If an account was created in breach of this rule, contact us for deletion.
Changes
This policy may be updated. The date at the top of the page prevails. For a material change, the publisher will endeavour to inform users (in the app or at the account email).