flow
flow / Privacy policy

Privacy Policy

Last updated: August 2, 2026

1. General

This Privacy Policy (the "Policy") governs the collection, use, retention and disclosure of information in connection with the use of the flow system, including the website, applications and related interfaces (the "System"), operated by Flow Advanced Systems Ltd. (the "Company", "we", "us").

Use of the System constitutes full agreement to this Policy. If you do not agree to these terms, you must not use the System.

2. Types of Information Collected

  • Identification details: name, ID / company number, address, phone and email.
  • Business, financial and accounting information: documents, certificates, reports, invoices and any information required to provide the services.
  • System usage data: IP address, browser type, logs, actions performed in the System and timestamps.
  • Communications: including WhatsApp messages, email, SMS and files uploaded by or on behalf of the user.

3. Purposes of Use

  • Providing, operating, securing, monitoring and improving the System and services.
  • Communicating with the user, including support, reminders, approvals and document requests.
  • Fulfilling the Company's legal obligations and responding to lawful requests of authorized bodies.
  • Preventing misuse, fraud or unlawful activity, and protecting the rights of the Company and third parties.

4. Legal Basis for Processing

Processing is based on: (a) the user's consent; (b) necessity to provide the requested service; (c) the Company's legal obligations; and (d) the Company's legitimate interests in the orderly, secure and improved operation of its services.

5. Sharing with Third Parties

The Company will not sell personal information to third parties. Sharing is permitted only in the following cases:

  • Service providers acting on the Company's behalf (e.g. cloud hosting, infrastructure, messaging providers and AI providers) — contractually bound to maintain confidentiality and process data only per the Company's instructions.
  • Pursuant to a court order, a lawful authority request, or a legal obligation.
  • To protect the Company's rights, property, the security of the System or the safety of third parties.
  • In connection with a corporate transaction (merger, acquisition or asset transfer), subject to the principles of this Policy.

6. Storage and Retention

Data is stored on secure servers in Israel and/or in public cloud regions. Retention periods are determined by the needs of providing the service and by any applicable law. In any case, the Company is not responsible for the user's own record-retention obligations toward tax authorities or any other party.

7. Information Security

The Company employs reasonable, industry-standard security measures including in-transit encryption (TLS), access controls, backups and logging. However, no security system is impenetrable, and the Company does not warrant or guarantee against any breach, loss or leak of data. Use of the System is at the user's own risk.

8. User Rights

Under the Israeli Privacy Protection Law, 5741-1981, users may access the information the Company holds about them, request correction of inaccurate or incomplete information, and request its deletion — all subject to the Company's obligations and rights under applicable law. Requests should be sent to the contact details in Section 13. The Company will respond within the time required by law.

9. Cookies

The System uses functional cookies necessary for its operation (e.g. authentication and preferences). No third-party advertising cookies are used.

10. Third-Party Services

The System integrates with third-party services, including but not limited to Meta (WhatsApp Business API), Google (SSO, Google Drive), Anthropic (the Claude AI engine) and SMS / email providers. Use of these services is subject to those providers' own privacy policies and terms, and the Company is not responsible for their actions, availability or policies.

11. Google User Data

The System offers an optional connection to Google services via OAuth. The connection is initiated only by an organization administrator and can be disconnected at any time.

  • Google Drive (drive scope): the System displays the contents of Drive folders that the user has manually linked to their firm's clients, allows downloading and importing files from them, and saves documents into them when the user explicitly chooses to. The System does not proactively scan the user's Drive and does not access content beyond the actions the user performs.
  • Gmail (gmail.readonly scope, if activated): locating invoice attachments solely for display within the System.
  • Sign-in (SSO): receiving name and email address for authentication only.

The System's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements:

  • Google user data is used only to provide the user-facing features described above, and for no other purpose.
  • Google user data is never sold, never transferred to third parties for advertising purposes, and never used to serve advertisements.
  • Google user data is not used to train or develop generalized AI/ML models.
  • Humans do not read this data except with the user's consent, for security purposes, to comply with applicable law, or when aggregated for internal operations.
  • OAuth tokens are stored encrypted at rest. Disconnecting the integration in the System's settings deletes the tokens and revokes access; permissions can also be revoked at Google Account settings.

12. Changes to the Policy

The Company reserves the right to update this Policy from time to time. An updated version will be posted on this page with an updated date. Continued use of the System after an update constitutes agreement to the updated version.

13. Contact

For any question regarding this Policy, contact Flow Advanced Systems Ltd. via WhatsApp at +972-54-302-5750, or any other communication channel provided by the Company.

14. Governing Law and Jurisdiction

This Policy is governed exclusively by the laws of the State of Israel. Exclusive jurisdiction over any dispute relating to this Policy or the use of the System is granted to the competent courts of the Tel Aviv – Jaffa district, and to them alone.