Version 1.0 · 30 September 2026
This policy covers the personal data we process through the PhiFlow platform (app.phiflow.ai). For the website phiflow.ai, the website privacy policy applies.
This text is for you if you have an account or received an invitation, if you complete the growth scan, or if an organisation processes your data in PhiFlow.
If this English text and the Dutch version differ, the Dutch version prevails.
1. Who we are
PhiFlow is a platform of YouthCommerce
| Name | YouthCommerce, trading as PhiFlow |
| Chamber of Commerce (KvK) | 75504014 |
| Address | Breukelaarweg 4, 7051 DX Varsseveld, the Netherlands |
| Privacy contact | Owen Ebbers, [email protected] |
2. Two roles: controller and processor
Depending on the data, we have one of two roles.
We are the controller for our own data: your account, the security of the platform, our contacts with customers, support and the growth scan. We decide why and how we use that data. See section 3.
We are a processor for the data an organisation brings into PhiFlow or has retrieved from its own systems. Think of customer, lead and order data, conversation transcripts or email. That organisation is the controller. We process this data only on its behalf, following its instructions and our data processing agreement. We do not use this data for our own purposes. We do create anonymised, aggregated statistics from it, without personal data, to improve PhiFlow and to make comparisons. We do not attempt to re-identify those statistics and we prohibit others from doing so.
Is your data in PhiFlow through an organisation? Please contact that organisation with your questions and requests. If you send your request to us anyway, we will pass it on to that organisation without undue delay and help it respond.
3. What we do as controller
| Purpose | Which data, and from whom | Legal basis | Retention |
|---|---|---|---|
| Account and access: creating, inviting, signing in, roles | name, email address, role, workspace, sign-in and session data. We receive this data from you or from the organisation that invites you | performance of the contract; our legitimate interest in managing access securely | as long as the account exists plus 3 months. An invitation that is not accepted expires after 7 days |
| Security and abuse prevention: activity log | user ID, action, time, IP address and browser data | our legitimate interest; our legal obligation to secure data appropriately | activity log 24 months; technical logs up to 12 months |
| Customer relationship, contract and invoicing | name, job title, business contact details, invoicing data | contract; legal obligation (tax retention) | accounting records 7 years after the end of the financial year; other data 2 years after the relationship ends |
| Support and service emails | name, email address, content of your question | contract; our legitimate interest in helping you properly | 24 months after resolution |
| Growth scan | we do not ask for your name or email address. We do store your answers, type of business, a revenue band and your own comments. Your result can only be retrieved with the personal link you receive | our legitimate interest in giving you a result and improving the scan | 24 months |
We cannot create an account without a name and email address. You can complete the growth scan without giving any data about yourself; please do not include names or other personal data in your comments.
Where we rely on legitimate interest, we have weighed that interest against your privacy. You can object (see section 9).
4. AI in PhiFlow
PhiFlow uses language models to help summarise, analyse and prioritise data and to draft recommendations. AI suggestions are recognisable as such in the platform. A person decides. We do not make automated decisions that have legal effects for you or similarly significantly affect you. Actions with an effect outside PhiFlow, such as sending data to an advertising platform, only happen after human approval.
Data from the platform is not used to train third-party AI models.
5. Who we share data with
We only share data with parties we need to operate PhiFlow, and only for that purpose. They act as our (sub)processors under a contract and may not use the data for their own purposes. They are:
- Supabase: database, sign-in and file storage (EU, Ireland);
- Vercel: application hosting (EU, Frankfurt);
- Google Cloud: data storage, processing and backups (EU);
- OpenAI: language models for the AI features (United States);
- Mailjet: sending email from the platform, such as invitations, sign-in emails and notifications (EU);
- in addition, only if an organisation switches on the related feature: a service for receiving and routing incoming email.
For our own email and support we use Google Workspace, and for payments our bank.
The current list with names, purposes and locations is in our list of subprocessors. We also disclose data to third parties where the law requires it, for example to a supervisory authority, and to advisers bound by confidentiality.
6. Transfers outside the EEA
We store data in the EU as much as possible. Some parties have a US parent company or process data in the United States. In that case we ensure an appropriate safeguard: an adequacy decision (the EU-US Data Privacy Framework, where the party is certified) or the European Commission's standard contractual clauses, with supplementary measures where needed. You can request a copy or more information from our privacy contact.
7. Cookies in the platform
The platform only uses functional cookies: cookies for your session and for signing in, and a cookie that remembers your language preference. Without these cookies the platform does not work as you would expect. We do not use tracking or analytics cookies in the platform. We therefore do not ask for consent (exemption for functional cookies in article 11.7a of the Dutch Telecommunications Act). The cookie rules in the website policy apply to the website phiflow.ai.
8. Security
We take appropriate technical and organisational measures, including:
- each customer organisation's data is strictly separated, and this is tested automatically;
- access within a workspace is role-based;
- data is encrypted in transit and at rest;
- credentials and connections to external systems are only accessible server-side, and secrets are not stored in our code;
- actions are recorded in a log that cannot be altered afterwards;
- there is a daily backup to storage in the EU, and we periodically test that restoring works;
- everyone who works with data for us has signed a confidentiality agreement;
- AI actions with an effect outside PhiFlow require human approval.
Absolute security does not exist. Do you suspect a security issue or data breach? Report it to our privacy contact straight away.
9. Your rights
You have the right of access, rectification, erasure, restriction of processing, portability of data you provided yourself, and to object to processing based on legitimate interest. Where you gave consent, you can withdraw it; this does not affect processing before the withdrawal.
- Send your request to [email protected]. We respond within one month. If your request is complex, we may extend this by up to two months. We will tell you why.
- We may ask you to confirm your identity, but no more than necessary to be sure the request comes from you.
- Is your request about data an organisation has put into PhiFlow? Then that organisation is responsible. We will pass your request on to it (see section 2).
10. Complaints
Do you disagree with how we handle your data? Please contact us first so we can resolve it. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or with the supervisory authority in the country where you live or work.
11. Changes
We may update this policy, for example when we add a feature or a new party. The date below shows when it was last changed. We announce important changes in the platform or by email.
Last updated: 30 September 2026