Privacy Policy — Advaflow OÜ

Draft v1.1 • Prepared 24 September 2026 • Effective date: [COMPLETE: publication/effective date]

This Privacy Policy explains how Advaflow OÜ handles personal data in connection with advaflow.eu and the services actually enabled there. Website visits and enquiries are covered even before paid products launch. Assessment, account, payment and coaching sections apply only when you use the corresponding offered feature; this notice does not mean all described features are currently available. It applies to visitors, customers, business representatives, service participants and other individuals whose data we process as controller. Company information is covered where it identifies a natural person.

1. Controller and contact details

Advaflow OÜ, a private limited company incorporated in Estonia.
Estonian registry code: [COMPLETE: registry code].
Registered office and postal address: Harju maakond, Tallinn, Kesklinna linnaosa, Tartu mnt 67/1-13b, 10115, Estonia.
VAT number: [COMPLETE: VAT number or state not VAT registered].
Customer support and complaints: contactus@advaflow.eu.
Telephone: [COMPLETE: business telephone].
Privacy contact: contactus@advaflow.eu (subject: Privacy).
Covered websites and products: advaflow.eu and the Advaflow services expressly offered there.

For the processing described here, Advaflow OÜ is the controller unless we expressly act as processor for a customer. The other company in the Adva ecosystem is not automatically a joint controller or recipient. Any actual sharing and the relevant roles must be disclosed for the service concerned. Privacy enquiries can be sent to the privacy contact above. Data Protection Officer: [COMPLETE: DPO contact if appointed; otherwise state that privacy requests are handled by the privacy contact without claiming a DPO appointment].

2. Information we collect and its sources

• Contact and account information: name, email, account identifiers, login credentials and preferences; organisation and role when needed for a business purchase.
• Transaction information: ordered products, billing details, necessary tax information, payment references and status, invoices, refunds and subscription records.
• Development information: answers, goals, self-described experiences and preferences, requested context, progress and generated analyses or plans.
• AI conversation content and relevant context where an interactive feature is enabled. The feature-specific retention settings determine whether history is kept beyond the current session.
• Human-service information where purchased: appointments, necessary coach notes and communications. Any recording or transcription is separately explained and agreed.
• Support, complaint and privacy-request correspondence; consent, objection and notice-version records.
• Technical information: IP address, device/browser information, timestamps, authentication/security events and limited service logs; cookies as described in section 10.

Information comes primarily from you and your use of the service. We also receive relevant transaction information from payment providers and, for organisation-funded programmes, minimum enrolment and administration details from the sponsor. AI creates derived descriptions and recommendations from your inputs; these are also personal data where connected to you. We do not routinely enrich a personal assessment by scraping social profiles or researching your identity.

If someone else supplies your personal data, we provide the required information within one month or at the first communication or disclosure if earlier, unless a specific lawful exception applies. Please avoid unnecessary details about other identifiable people in your responses. Public availability or inclusion in a user's message is not by itself a legal basis for unrestricted reuse.

3. Purposes and legal bases

We assess legitimate interests against your rights and reasonable expectations and apply safeguards such as minimisation and restricted access. You may request further information about the relevant assessment. We do not use contractual necessity for data merely useful to our business. Before a materially different use, we assess compatibility, provide further information and obtain a new legal basis or consent if required.

4. Required and optional information

Fields necessary to fulfil an order, secure an account or issue a legally required invoice are identified when collected. Without them we may be unable to provide the affected service. Marketing subscriptions and non-essential cookies are optional and do not condition access to an unrelated purchase. We request only information relevant to the service; government identity documents are not routinely required.

5. Sensitive information and private sessions

Personality preferences are not automatically special-category data. However, answers, coaching messages or inferences can reveal health, religion or philosophical beliefs, sexual life or other information protected by Article 9 GDPR. Removing a name does not change that sensitivity.

Standard forms should not ask for unnecessary sensitive information. Before a feature intentionally collects or analyses special-category information, we explain the specific data, purpose and recipients and obtain separate explicit consent under Article 9(2)(a), alongside an appropriate Article 6 basis, unless another clearly applicable Article 9 condition is identified. Consent is not inferred from accepting these Terms, payment, employment participation or merely typing a sensitive statement. If the required conditions are not met, we do not use that information for the optional analysis; incidental submissions are restricted and removed or redacted as appropriate.

You may withdraw consent through the privacy contact. Withdrawal does not affect earlier lawful processing. It may prevent the particular optional function that needs the data, but does not cancel unrelated services or override refund rights. We offer a less intrusive route where feasible. Any limited retention needed for a legal obligation or legal claim requires an applicable basis and safeguards.

Live human sessions are not recorded, transcribed or submitted to an AI meeting assistant by default. A proposed recording has its own notice covering provider, purpose, access, retention and choice. Text messages submitted to an AI feature are processed under the separately disclosed conversation settings. A claim that live sessions are not recorded is not a claim that AI messages are never retained.

Sponsors do not automatically receive private notes, answers, messages or individual results. Reporting is explained to participants before collection and is limited to the agreed lawful scope. Small-group summaries are not described as anonymous where individuals could reasonably be identified. Confidentiality may be limited by a specific legal obligation or a lawful response to a serious threat to life; our service is not continuously monitored for emergencies.

6. AI processing, pseudonymisation and profiling

How information moves through the service

1. You submit answers or messages through the website or application. Your account and billing records are kept separately from the material selected for AI analysis.
2. Before external processing, the workflow removes direct identifiers such as name, email and contact details, minimises unnecessary context and screens the outgoing request on the backend. The identity-to-request link remains in our controlled environment. Details about other people are also considered.
3. An approved AI service processes the reduced input to create the requested analysis, plan or response. Relevant previous context is included only as necessary for the enabled feature.
4. Our system links the result back to your request or account for delivery. Any retained history, provider logs and backups follow the periods and arrangements disclosed below.

This is generally pseudonymisation and data minimisation, not a guarantee of complete anonymity. We continue to protect answers and results as personal data where we can associate them with you. Narrative details or combinations of facts may also identify someone without a name. Only information that has been irreversibly anonymised to the applicable legal standard falls outside personal-data rules.

What the AI does and whether a person reviews it

The system uses your answers, selected assessment framework, stated goals and relevant context to infer patterns and generate descriptive profiles or suggestions. A profile may influence the content and exercises shown to you. It is a probabilistic interpretation and can be inaccurate; it is not a clinical diagnosis or established fact about your personality.

Automated analyses and AI coaching responses may be delivered without individual human review. Human review or live coaching is provided only when expressly included in the selected service. Customer support and any limited quality review do not amount to continuous monitoring. Authorised staff may access specific content when needed to deliver a purchased human service, resolve a reported issue, investigate a security problem or meet a legal obligation. Access is limited and does not authorise broad reuse of private conversations for product training.

We do not use these profiles to make solely automated decisions with legal or similarly significant effects, such as hiring, credit or educational admission. Voluntary development recommendations may be profiling without constituting those decisions. A future feature involving Article 22 decisions requires a separate lawful assessment, specific information and applicable safeguards before activation.

Models and training restrictions

The planned model options include OpenAI, Anthropic and Google, with selected Qwen or DeepSeek models, accessed through approved service operators or a gateway. The actual feature-specific providers, contracting entities, regions and retention are disclosed in section 7 before use. A model name does not identify the entity receiving data or where it processes it.

Private questionnaire answers, profiles and conversations are not used to train general-purpose models. We use contracted and configured services consistent with this restriction. This does not itself mean zero retention: necessary service processing, security records and history are separately described. Optional research or model-improvement reuse of identifiable private content is not included in this notice or in acceptance of the Terms.

7. Recipients and provider schedule

Authorised staff, any purchased human coaches and service providers receive only the data needed for their roles. Relevant categories include hosting, backup, account, email, payment, AI, appointment/video and professional advisory services. Processors require appropriate agreements; an independent payment provider or adviser may separately determine processing required for its own obligations. We do not sell personal data or automatically share it with other Adva companies.

The schedule below must be completed for enabled features. Future options are not represented as approved recipients. A model developer is not necessarily the hosting or contracting entity.

With hosted checkout, full card numbers and security codes are entered directly with the payment service; we may receive a token, card brand, last digits and transaction status. Its notice explains its independent processing. Authorities may receive data where lawfully required. A genuine business transfer may involve limited disclosures with appropriate confidentiality and data protection safeguards.

8. EU hosting and external AI processing

[CONFIRM BEFORE ACTIVATION: planned EU service hosting and Frankfurt server location against the actual deployment. This is not a verified description of the current private preview.] The provider schedule must describe all relevant processing locations, including AI inference, retention, backups and remote support. A server in Germany does not itself establish where an external AI service operates.

For individual analyses and coaching, reduced inputs ordinarily remain personal data. Unlike a generic non-personal market question, a pseudonymised personal-development submission is not treated as exempt from GDPR transfer requirements.

The service design uses approved EU processing arrangements for customer and AI data. A feature may be enabled only after the required provider configuration and contractual arrangements are in place. We do not state that an unconfirmed gateway or a model brand already meets that commitment. Any independent-controller processing, such as payment processing, must be accurately identified before collection.

A proposed change involving personal-data processing or access outside the EU must be assessed and disclosed before implementation and must respect existing customer commitments. Where Chapter V GDPR applies, an applicable adequacy decision or appropriate safeguards, such as relevant EU Standard Contractual Clauses with a transfer assessment and necessary supplementary measures, must be established. Merely removing a name, accepting these Terms or publishing this notice does not authorise a transfer. You may request information or a copy of applicable safeguards, subject to justified redactions, from the privacy contact.

9. Retention

We keep identifiable data only for the purpose and period justified for its category. The schedule below is part of this notice and must be completed with the actual retention configuration before publication.

After the relevant period we delete or irreversibly anonymise data. A documented legal hold may require restricted retention of specific records until the relevant obligation or claim ends. We do not retain all account or coaching data simply because an invoice must be kept.

10. Cookies, similar technologies and marketing

The current website code does not set cookies, use browser storage, load analytics or advertising tools, embed external services or load fonts from third parties. Language selection uses language-specific page URLs. Contact links open your email application rather than submitting an on-site form. Hosting, access protection and email infrastructure may process technical or correspondence data independently of this page code.

[COMPLETE BEFORE PUBLICATION: identify the actual production hosting and email providers, their technical logs and retention, and any infrastructure cookies. The private preview's access infrastructure is separate from the intended public website.]

Account, checkout, consent-management and optional analytics functions are not currently enabled. If they are introduced, update this section and provide any necessary notices and controls before activating them.

Marketing messages have a simple, free unsubscribe mechanism. You may also object through the privacy contact. We stop processing for direct marketing after an objection, including related profiling. Essential account, payment and service notices are sent separately from optional marketing. We do not treat a publicly available business email address or a purchase from another group company as permission to send marketing.

11. Security and incidents

We apply proportionate technical and organisational safeguards, including access controls, appropriate encryption, secure configuration, backup controls and incident response. No internet system can guarantee absolute security. If a personal data breach occurs, we assess the risk, notify the competent authority within 72 hours of becoming aware where required, and notify affected individuals without undue delay where the legal high-risk threshold is met. A processor acting for a customer notifies that customer without undue delay and assists with its obligations.

12. Your rights

Subject to the conditions and exceptions in the GDPR, you may request access and a copy, correction, erasure, restriction, and portability of data you provided where processing is automated and based on consent or contract. You may object, on grounds relating to your situation, to processing based on legitimate interests. We then stop unless we demonstrate overriding compelling grounds or need the data for legal claims. Your objection to direct marketing is unconditional.

You may withdraw consent at any time as easily as giving it, without affecting earlier lawful processing. Erasure is not absolute: for example, statutory accounting evidence may need to be retained. Where applicable, safeguards concerning solely automated significant decisions include human intervention, expressing your view and contesting the decision.

Send requests to the privacy contact in section 1. We normally respond within one month. For a complex request or multiple requests we may extend by up to two further months, explaining the extension within the first month. Requests are normally free. A fee or refusal is possible only under the GDPR's conditions, with reasons and information about complaint rights. If there are reasonable doubts about identity, we request only proportionate additional verification.

13. Complaints to a supervisory authority

You may complain to a supervisory authority, particularly in the EEA country of your habitual residence, workplace or the alleged infringement. In Estonia this is the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate): aki.ee/en. You do not need to contact us first to exercise this right.

14. Organisation-funded programmes and controller roles

Advaflow is controller where it determines how it provides individual services, manages accounts and billing, or handles its own support and security. Paying for a participant does not itself entitle an employer to that participant's private content or make the employer controller of every processing activity.

If an organisation determines the purposes of a distinct activity and Advaflow processes solely on its documented instructions, that activity requires an Article 28 GDPR processing agreement. The organisation must establish its lawful basis and provide its own information. We assist it with rights requests. Where purposes are jointly determined, the parties assess and disclose an appropriate joint-controller arrangement.

Before a sponsored programme begins, participants receive information about enrolment sources, administrative visibility, the proposed reporting and any optional disclosure of individual results. Organisation administrators may manage seats and see disclosed administrative information, but do not receive unrestricted access to answers, profiles or conversations. Sensitive-data consent must be genuinely voluntary; it is not assumed valid merely because participation is employer-sponsored.

15. Children and updates

Standard services are intended for adults aged 18 or over. We do not intentionally enrol children through the standard purchase flow. A future youth service requires its own age-appropriate notice and lawful authorisation arrangements before collection. Contact us if you believe a child has submitted data through an adult-only service.

We update this policy when processing changes and identify the effective date. Material changes are brought to your attention appropriately before the new processing begins where required. Updating this notice does not itself create consent or a new legal basis. Previous versions may be requested from the privacy contact.