Last updated: 30 September 2026
If this English text and the Dutch version differ, the Dutch version prevails.
This Privacy Policy explains how YouthCommerce (“PhiFlow”, “we”, “us”) collects and uses personal data when you visit our website phiflow.ai, sign up through the form on the website, or contact us. PhiFlow is a brand operated by YouthCommerce.
This policy covers our website only. Personal data processed inside the PhiFlow platform (app.phiflow.ai), including on behalf of our customers, is governed by the PhiFlow Platform Privacy Policy and by the data processing agreement we conclude with each customer.
1. Who we are (controller)
For the processing described in this policy, the data controller is:
| Name | YouthCommerce, trading as PhiFlow |
| Address | Breukelaarweg 4, 7051 DX Varsseveld, the Netherlands |
| Chamber of Commerce (KvK) | 75504014 |
| Privacy contact | Owen Ebbers, [email protected] |
2. What personal data we collect
We only collect data you provide or that is generated automatically when you use the website.
a. Sign-ups and contact. When you sign up through the form on the website: your name, company name, business email address, website, phone number (optional), type of business and your agreement to this policy. When you email us: your email address and the content of your message.
b. Technical and usage data. Our servers automatically log technical information on each request: IP address, browser type and version, operating system, referring page, pages viewed, and timestamps.
c. Cookies and analytics. See section 5.
We do not intentionally collect special categories of data (such as health data) through this website. Please do not submit such information in the form or by email.
3. Why we use your data and on what legal basis
| Purpose | Personal data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Handling your sign-up or contact request | Form and email data | Art. 6(1)(b) (pre-contractual steps) / Art. 6(1)(f) (legitimate interest) |
| Operating, securing and improving the website | Technical and log data | Art. 6(1)(f) (legitimate interest in security and a functioning site) |
| Analytics and measuring website performance | Cookie and analytics data | Art. 6(1)(f) (legitimate interest in privacy-oriented website analytics) |
| Complying with legal obligations | As applicable | Art. 6(1)(c) (legal obligation) |
Where we rely on legitimate interest, we have weighed our interest against your rights and limited the processing accordingly. You can object to this processing at any time (see section 8).
4. Who we share data with
We share personal data only with:
- Service providers who help us run the website. They process data only for the services they provide to us.
- Public authorities, where we are legally required to do so.
A current overview of our service providers for the website:
| Provider | Purpose | Location |
|---|---|---|
| Hostinger International Ltd. | Website and database hosting; receiving your sign-up by email | Germany (Frankfurt), EEA |
| Twilio Inc. (Segment) | Website analytics | United States |
| Google (Google Fonts) | Loading the fonts of the website; your browser sends your IP address to Google | Worldwide network |
| Cloudflare, Inc. (cdnjs) and jsDelivr | Loading scripts of the website; your browser sends your IP address to these networks | Worldwide network |
We do not sell your personal data.
5. Cookies and similar technologies
We use cookies and similar technologies (including browser local storage) to operate the website and to measure how it is used.
Essential storage is required for the site to function and is set automatically. This includes remembering your language and your choice in the cookie notice.
Analytics. We use Segment to measure how the website is used, for example which pages are viewed and whether someone signs up. Segment sets an anonymous ID in your browser to recognise returning visitors. When you sign up, we only send the type of business and the language to Segment, not your name or contact details. We do not use these tools for advertising.
Your choice. In the cookie notice you can accept or decline analytics. If you decline, we stop sending analytics data from your browser. The page view of your first visit may already have been measured at that moment.
You can also block or delete cookies and clear local storage through your browser settings. If you would like us to delete the analytics data associated with you, contact us using the details in section 1.
6. International transfers
We aim to keep personal data within the European Economic Area (EEA). Some of our service providers process data in the United States or through a worldwide network. For these transfers we rely on an appropriate transfer mechanism, such as the European Commission’s Standard Contractual Clauses and/or the provider’s certification under the EU–US Data Privacy Framework. You can request more information using the contact details in section 1.
7. How long we keep your data
| Data | Retention period |
|---|---|
| Sign-up and contact data | Up to 24 months after our last contact |
| Server logs | Up to 12 months |
| Analytics data | Per analytics tool configuration |
After these periods we delete or anonymise the data, unless we are legally required to retain it longer.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- rectify inaccurate or incomplete data;
- erase your data (“right to be forgotten”);
- restrict or object to processing;
- data portability: receive your data in a structured, machine-readable format;
- withdraw consent at any time, without affecting processing that already took place.
To exercise any of these rights, contact us at [email protected]. We will respond within one month.
You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or the authority in your country of residence.
9. Security
We take appropriate technical and organisational measures to protect your data, including encryption in transit and access controls. No method of transmission over the internet is fully secure, but we work to protect your data against unauthorised access, loss or misuse.
10. Automated decision-making
We do not make decisions about website visitors based solely on automated processing that produce legal or similarly significant effects.
11. Changes to this policy
We may update this policy from time to time. The “Last updated” date reflects the latest version. For substantive changes, for example a change in purpose or in how you can exercise your rights, we will provide notice where required.
12. Contact
Questions about this policy or about your personal data? Contact us at [email protected] or write to YouthCommerce, Breukelaarweg 4, 7051 DX Varsseveld, the Netherlands.