Legal

Data processing agreement & subprocessors

This summary describes the terms on which we process personal data on your behalf under UK GDPR / EU GDPR Article 28. A full DPA is available on request and is offered as standard to business customers before onboarding.

Roles

When you use Executive Flow to process personal data of your own contacts or employees, you act as the controller and we act as your processor. For account and service-operation data, we act as controller (see the Privacy notice).

Processing details

Subject matter — providing the Executive Flow service.
Duration — the term of the agreement plus any retention required by law.
Nature and purpose — storing, organising, retrieving and (where you enable AI) generating drafts from the personal data you provide.
Categories of data subjects — your contacts, colleagues, and other people whose information you place in the product.
Categories of personal data — names, contact details, meeting content, correspondence and any other information you input.
Special category data — the service is not intended for special category data; do not enter it.

Our commitments (Art. 28(3))

Process only on documented instructions from you.
Bind personnel to confidentiality.
Implement appropriate technical and organisational measures.
Use subprocessors only under a written contract offering equivalent protection.
Assist you with data subject requests and with security, DPIA and breach obligations.
Return or delete personal data at the end of the service.
Make available information necessary to demonstrate compliance.

International transfers

Where a subprocessor is located outside the UK/EEA, transfers are covered by the UK International Data Transfer Addendum or EU Standard Contractual Clauses (2021/914), plus a transfer risk assessment.

Subprocessors

Subprocessor	Purpose	Data categories	Region	Safeguards
Lovable AI Gateway	Routes AI prompts to model providers on our behalf	AI prompts and completions (may contain content you enter)	United States	SCCs / UK IDTA where applicable; no training on customer data
Google (Gemini)	Generates AI completions via the Gemini model family	AI prompts and completions	United States / EU	SCCs / UK IDTA; no training on customer data
Supabase (via Lovable Cloud)	Authentication and (if enabled) database, storage and edge functions	Account identifiers, session tokens, any data you sync	EU / United States	SCCs / UK IDTA; encryption in transit and at rest
Cloudflare	CDN, edge runtime, DDoS protection	IP address, request metadata	Global	SCCs / UK IDTA
Google Fonts	Delivers web fonts	IP address (transient)	Global	SCCs / UK IDTA

Breach notification

We will notify you without undue delay after becoming aware of a personal data breach affecting your data, and provide the information you need to meet your own notification obligations under UK/EU GDPR Art. 33–34.

Contact

For a signed DPA or subprocessor questions, contact Amiehg@hotmail.com(controller: TBC, United Kingdom).