Privacy Policy

1. Controller

FlowRyd GmbHLakeside 19020 Klagenfurt am WörtherseeAustriaEmail: hello@flowryd.ai

Reach us at this address for any privacy question and to exercise your rights.

2. Hosting and server logs

We run the website, database and servers at DigitalOcean in a data centre in Frankfurt am Main (EU). When you open our pages we process technically necessary data such as your IP address, the time, the address requested, your browser and error messages, to run the service securely and reliably (legitimate interest, Art. 6(1)(f) GDPR). We delete these logs after 30 days.

3. Search and conversations

When you tell FlowRyd what you need, we process the text of your conversation and the requirements derived from it to find and explain suitable cars. With an account, we keep the history in your account (performance of a contract, Art. 6(1)(b) GDPR). Without an account, a guest cookie links the conversation to your browser and we delete it after 30 days unless you move it into an account (legitimate interest in providing the service you asked for, Art. 6(1)(f) GDPR).

Please do not enter names, phone numbers or addresses in the conversation. The search does not need them.

4. Language models

To understand your words and explain recommendations, we send the conversation text and vehicle facts to language models through the OpenRouter service (USA). We remove names, email addresses, phone numbers and postal codes before every transfer. We only use providers that neither store the data nor use it for training.

5. Voice input

Voice input uses your browser's speech recognition. Depending on your browser, its vendor may process the recording under its own terms. FlowRyd never receives or stores audio, only the recognised text you send.

6. Account

For an account we process your email address, an encrypted password (as a hash) or, if you sign in with Google, the identifier and email address Google provides, and your language setting (performance of a contract, Art. 6(1)(b) GDPR). The data is kept while the account exists. When you delete the account, access is blocked at once and the data is anonymised within 30 days.

7. Contacting a dealer

When you contact a dealer, we send your contact details and what you enter in the form, together with the car and a summary of your requirements, to that dealer only. This happens only with your explicit consent, which you see before sending (Art. 6(1)(a) GDPR). You can withdraw it at any time in your account, and we then inform the dealer. The FlowRyd concierge team may pass the request to the dealer by phone or email instead of sending it automatically; the consent screen tells you which. We keep the enquiry and the record of your consent for 12 months after its last status change or your withdrawal.

8. Chat with the FlowRyd team

When you use the chat, we store your messages, the files you attach (photos without location data), the cars and searches you choose to share, and the time of each message. Only you and the FlowRyd concierge team can read the conversation. To answer you, the team also sees your first name, language, recent searches, saved cars and dealer requests. The team's internal notes about your conversation are part of your data export. We process this data to answer your request (performance of a contract, Art. 6(1)(b) GDPR). Chat messages are never sent to a language model.

If you agree to a handover to a dealer, FlowRyd passes your contact details, the car and, only if you tick it, the concierge's summary to that dealer only (see section 7). The chat conversation itself never goes to a dealer.

We delete a conversation 12 months after its last message. You can delete a closed conversation in the chat history at any time; deleting your account removes all conversations at once. When a reply is waiting for you, we email you by default, without the message text; you can switch this off in the chat or in your account settings.

9. Emails

We send emails to confirm your address, reset your password, deliver invitations and dealer enquiries, and tell you that a chat reply is waiting (without the message text), through the Resend service. Resend stores message content and delivery logs in the USA. This transfer is based on a data processing agreement and appropriate safeguards under Art. 44 et seq. GDPR.

10. Car listings and images

The cars shown come from publicly available listings on marketplaces such as willhaben.at, AutoScout24 and mobile.de. We remove private sellers' names, phone numbers, email addresses and postal addresses when we collect the listings. Your browser loads car photos directly from the marketplace's servers, which receive your IP address; no referrer is sent.

11. Cookies

We use strictly necessary cookies only:

• Sign-in cookie (better-auth.session_token): keeps you signed in, up to 30 days.
• Guest cookie (flowryd_guest_journey): links a search without an account, 30 days.
• Language cookie (NEXT_LOCALE): remembers whether you use FlowRyd in German or English.

We use no cookies or trackers for advertising, profiling or web analytics.

12. No automated decisions

We compute recommendations from the requirements you state yourself and from vehicle facts. We build no profile from your behaviour, add no data from other sources and make no decision with legal effect on you.

13. Your rights

Under the General Data Protection Regulation you have the right to:

• access your data (Art. 15 GDPR)
• have inaccurate data corrected (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on legitimate interests (Art. 21 GDPR)
• withdraw consent with effect for the future (Art. 7(3) GDPR)

With an account you can export your data and delete your account yourself. For anything else, write to hello@flowryd.ai. We reply within one month.

You also have the right to lodge a complaint with a supervisory authority. In Austria this is the Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, www.dsb.gv.at.

14. Changes

We update this policy when our service or the law changes. The version published on this page applies.