Questions: hello@vlowr.ai
Oliver Tesch (vlowr.ai), c/o Online-Impressum #7955, Europaring 90, 53757 St. Augustin, Germany · Last updated: 12 November 2026 · Version 1.3
Oliver Tesch (vlowr.ai)
c/o Online-Impressum #7955, Europaring 90, 53757 St. Augustin, Germany
Email: hello@vlowr.ai
Security incidents and vulnerabilities: security@vlowr.ai
The website is operated by our provider for operation and delivery (USA) and delivered via the network of a further provider (USA) used by it. When you access it, connection data (IP address, timestamp, page accessed, browser information) is processed for technical reasons in order to deliver the page and secure its operation. Transfers to the USA are based on Standard Contractual Clauses (Art. 46(2)(c) GDPR) for the provider for operation and delivery and on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) or Standard Contractual Clauses for the network provider.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functional website).
If you write to us, for example at hello@vlowr.ai or security@vlowr.ai, we process your email address, your name and the content of your message in order to handle your request. The @vlowr.ai mailboxes are kept with our provider for email and office communication (based in Ireland). The provider may also process data in third countries, in particular the USA, based on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) or Standard Contractual Clauses (Art. 46(2)(c) GDPR).
Legal basis: Art. 6(1)(b) GDPR where your request is aimed at a contract or relates to an existing contract, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).
Access to the platform is granted by invitation only. The following data is processed during use:
The operator manages organisations and accounts. Within the application, the operator accesses the content of a customer organisation only in a logged support session whose log administrators of the customer organisation can view. Beyond that, the operator accesses the database only for troubleshooting and for metrics without content.
Purpose: contract performance. Legal basis: Art. 6(1)(b) GDPR. Where customers enter personal data of third parties into the platform, vlowr.ai processes it as a processor under the Data Processing Agreement (DPA) agreed with the customer.
For AI-assisted processing, we transmit the content required by the respective function to our AI provider (processing in the USA; the provider may also process requests in other countries). The AI provider does not use this data to train its models. Under its commercial terms, inputs and outputs are deleted within 30 days; if the provider flags a request as a potential violation of its usage policy, they may be retained for up to 2 years.
We intend to move AI processing to data centres in the EU and are currently assessing this. Until such a move, the processing described here applies; we will reflect any change in this policy.
Legal basis for the transfer: Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.
To convert speech into text, we transmit voice recordings to our provider for speech transcription and search index (processing in the USA); the provider provides for no retention of transcription requests.
To compute a search index, we transmit content from the process data and search terms to this provider. The provider retains these requests for abuse monitoring for up to 30 days and does not use them for training. The computed search index is stored in the database in Frankfurt.
Legal basis for the transfer: Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.
Invitations and notifications of the platform are sent via our provider for platform email delivery (based in the EU). Email address, name and message content are processed for this purpose. Place of processing and basis for third countries: see § 4.
We use service providers in the following categories. Where they process data on our behalf, they do so under a data processing agreement (Art. 28 GDPR). We will name the specific service providers on request at hello@vlowr.ai.
| Category of recipients | Place of processing | Basis for third countries |
|---|---|---|
| Hosting of database, files, sign-in and search index | Frankfurt am Main (Germany, EU); provider's registered office: Singapore | Standard Contractual Clauses |
| Operation and delivery of website and application | USA / worldwide | Standard Contractual Clauses |
| Network for delivery, server functions and protection against attacks (used by the provider for operation and delivery) | worldwide | EU-US Data Privacy Framework or Standard Contractual Clauses |
| AI processing | USA, possibly other countries | Standard Contractual Clauses |
| Speech transcription and search index | USA | Standard Contractual Clauses |
| Platform email delivery | EU; some of the provider's sub-processors outside the EU (including the USA) | within the EU; for sub-processors outside the EU, EU-US Data Privacy Framework or Standard Contractual Clauses |
| Email and office communication (@vlowr.ai mailboxes, calendar and documents) | EU / USA | EU-US Data Privacy Framework or Standard Contractual Clauses |
The provider processes personal data on behalf of customers in accordance with the Data Processing Agreement (DPA) agreed with the respective customer. It also sets out the sub-processors and the procedure for changing them. Customers and prospects receive the DPA and the technical and organisational measures on request at security@vlowr.ai.
Personal data is deleted as soon as it is no longer required for its processing purpose and no statutory retention obligation applies. In detail:
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20 GDPR).
To exercise your rights: hello@vlowr.ai
You have the right to lodge a complaint with a data protection supervisory authority. Competent authority: State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).
The website and the application use the following storage:
All of the storage listed is strictly necessary for the service requested by the user and therefore permitted without consent (Section 25(2) no. 2 TDDDG). No cookies are used for statistics or advertising purposes.
The current version is always available at vlowr.ai/privacy.