Legal

Data processing agreement & subprocessors

This summary describes the terms on which we process personal data on your behalf under UK GDPR / EU GDPR Article 28. A full DPA is available on request and is offered as standard to business customers before onboarding.

Roles

When you use Executive Flow to process personal data of your own contacts or employees, you act as the controller and we act as your processor. For account and service-operation data, we act as controller (see the Privacy notice).

Processing details

Subject matter — providing the Executive Flow service.
Duration — the term of the agreement plus any retention required by law.
Nature and purpose — storing, organising, retrieving and (where you enable AI) generating drafts from the personal data you provide.
Categories of data subjects — your contacts, colleagues, and other people whose information you place in the product.
Categories of personal data — names, contact details, meeting content, correspondence and any other information you input.
Special category data — the service is not intended for special category data; do not enter it.

Our commitments (Art. 28(3))

Process only on documented instructions from you.
Bind personnel to confidentiality.
Implement appropriate technical and organisational measures.
Use subprocessors only under a written contract offering equivalent protection.
Assist you with data subject requests and with security, DPIA and breach obligations.
Return or delete personal data at the end of the service.
Make available information necessary to demonstrate compliance.

International transfers

Where a subprocessor is located outside the UK/EEA, transfers are covered by the UK International Data Transfer Addendum or EU Standard Contractual Clauses (2021/914), plus a transfer risk assessment.

Subprocessors

Subprocessor	Purpose	Data categories	Region	Safeguards
Lovable AI Gateway	Routes AI prompts to model providers on our behalf	AI prompts and completions (may contain content you enter)	United States	SCCs / UK IDTA where applicable; no training on customer data
Anthropic (Claude Sonnet 5)	The AI model behind every AI feature — model identifier anthropic/claude-sonnet-5, reached only through the Lovable AI Gateway	AI prompts and completions	United States / EU	SCCs / UK IDTA; no training on customer data
Firecrawl (web search)	Live web search for the restaurant concierge, so suggestions come from published sources rather than the model's memory	Constructed search queries (city, cuisine, party size) — no contact or diary data	United States / EU	SCCs / UK IDTA
CRM providers you connect (Salesforce, HubSpot, Pipedrive, Zoho CRM, Attio, Zapier)	Only if you connect one: pulls contact records into VIP Contacts using credentials you supply. Nothing is written back to the CRM.	Contact names, companies, roles, and the API credentials you provide	United States / EU	SCCs / UK IDTA; your own contract with the provider; credentials encrypted at rest on our server
Google (Gmail & Google Calendar API)	Only if you connect it: sends emails you approve and reads/creates events in your own calendar	Approved emails, calendar events, account email address	United States / EU	SCCs / UK IDTA; Google API Services User Data Policy
Microsoft (Outlook / Microsoft Graph)	Only if you connect it: sends emails you approve and reads/creates events in your own calendar	Approved emails, calendar events, account email address	United States / EU / UK	SCCs / UK IDTA; Microsoft Products and Services DPA
Supabase (via Lovable Cloud)	Authentication and (if enabled) database, storage and edge functions	Account identifiers, session tokens, any data you sync	EU / United States	SCCs / UK IDTA; encryption in transit and at rest
Cloudflare	CDN, edge runtime, DDoS protection	IP address, request metadata	Global	SCCs / UK IDTA
Google Fonts	Delivers web fonts	IP address (transient)	Global	SCCs / UK IDTA

Voice dictation is not a subprocessor of ours: it uses your browser's own speech recognition (handled by Google's speech service in Chrome, by Apple in Safari). We do not receive or store your voice. A plain-English walkthrough of every AI feature, what it sends and what you stay in control of is on the AI & security page.

Breach notification

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, and provide the information you need to meet your own notification obligations under UK/EU GDPR Art. 33–34.

Contact

For a signed DPA or subprocessor questions, contact hello@executiveflow.app(controller: Executive Flow, United Kingdom).