Privacy policy

1. Who is responsible?

Flow+ is the data controller for your information. Our contact details are at the bottom of this page. For privacy questions you can reach our privacy contact. For the customer app this splits in two. Your account — your e-mail address, language, devices, follow actions and points — is ours: we decide what that data is for, and your agreement is with us, not with the laundromat. The washes themselves are the operator's records; he is responsible for those and we process them on his instructions.

2. What data do we collect?

We only collect what we need to handle your request or deliver our service:

• Demo form: name, email address, phone number (optional), laundromat name, your situation and your message.
• Contact form: the same fields as above.
• Technical logs: your IP address and browser info are temporarily stored by our hosting provider for security and debugging. No tracking cookies, no Google Analytics.
• Owner portal (my.wassalonkassa.be): email address, password hash, name, language preference, and transaction data of your laundromat units.
• Reports from the owner portal (feedback): your name, your e-mail address, your report, a screenshot if you attach one, and technical details such as your browser, your screen, the page, the laundromat and the app version.

3. The customer app (app.wassalonkassa.be)

This app is for people doing their laundry at a laundromat. You can use it without an account: you then only see which machines are free, what they cost and when the place is open, and we keep nothing about you. If you create an account, we store the following:

• Your e-mail address and an encrypted version of your password. If you sign in with Google, Google gives us your e-mail address and the name it holds — we never see your Google password.
• Your language choice and whether you want notifications.
• Which laundromats you have used, and when you last did.
• For every device where you switched notifications on: the address your browser receives notifications at, and the keys used to encrypt them.
• Which machine you are following, when it started and when we notified you.
• Your points balance per laundromat, which washes earned them, and the reward codes you requested.

What the laundromat operator sees: his own turnover, and for a wash you claimed points on, an internal account number. He does not see your e-mail address, your name, your devices or your notifications — he has no access to them. He does see totals for his laundromat: how many receipts were claimed, how many points were saved, and how many people used the app there. When it concerns fewer than five people, he gets no number but 'fewer than 5'. We also keep those totals per month; they point to no one. Notifications travel through your browser's or phone's push service (Apple, Google or Mozilla); that service sees that a message is going to your device, but the text is encrypted with that device's keys. The app has a button to delete your account. It immediately deletes your sign-in (your e-mail address, your password and your link with Google), your profile, your laundromats, your devices, your reward codes and your points balance. Your washes, your follow actions and the points you saved remain as activity of the laundromat — the washes are the operator's bookkeeping — but the link to you is cut immediately, so no one can connect them to you anymore. If you also use the same account as owner or staff of a laundromat, your sign-in stays for that; only your customer data disappears. We close a follow action as soon as your laundry is done, or after one day at the latest, and after 90 days we cut the link to you. Reward codes that expire unused disappear a week later.

4. When we contact you first

We sometimes introduce Wassalon-kassa ourselves to laundromats that have not asked for it, by e-mail or phone. If you received such a message, this is what we keep about your business and where it comes from:

• Where it comes from: your company's name, enterprise number, legal form and address from the Crossroads Bank for Enterprises (KBO/BCE); your business e-mail address and phone number from your own website, from the KBO/BCE if your business registered them there itself, or from your public business listing, such as Google Maps or the Golden Pages; the location of your laundromat sometimes also from OpenStreetMap.
• What we keep: those details, when we contacted you and what you replied. This is stored in our CRM system.
• Who we e-mail: only companies, on a general address such as info@. We do not send unsolicited e-mails to sole traders or to personal e-mail addresses.
• Why: we have a legitimate interest in introducing our product to the laundromats it was built for. If you say no or do not reply, we do not keep pushing.
• No more contact: reply 'stop' to our e-mail, tell us on the phone or e-mail us. You do not have to give a reason. We remove you from our prospecting straight away.

So that we do not write to you again by mistake, for anyone who said 'stop' we keep only the business name and e-mail address, with that note. If you do not become a customer, we delete the rest no later than 24 months after the last contact.

5. Why do we use your data?

• Replying to your question or demo request (legitimate interest).
• Contacting laundromats ourselves to introduce Wassalon-kassa (legitimate interest).
• Performing a contract if you become a customer.
• Complying with accounting and tax obligations (legal obligation).
• Securing our systems (legitimate interest).

6. Legal basis

For demo and contact forms we rely on your consent when sending (you explicitly tick that you agree to processing) and on legitimate interest to follow up. For customer data we rely on contract performance and on statutory retention obligations. For prospecting laundromats (part 4) we rely on our legitimate interest; you can object to it at any time without giving a reason.

7. How long do we keep your data?

• Demo and contact requests that don't lead to a customer relationship: up to 24 months after last contact.
• Prospecting data of laundromats that do not become customers: up to 24 months after the last contact. Anyone who asked not to be contacted again stays on a suppression list (business name and e-mail address) for as long as we do prospecting.
• Customer data and operational data: for the duration of the contract plus the statutory retention period (10 years for tax, 5 years for commercial documents).
• Customer app: your account until you delete it yourself (see part 3). A follow action carries a link to you for 90 days, and no longer after that.
• Reports from the owner portal (feedback): 12 months after the report we remove your name, your e-mail address and the technical details from our database; the report itself remains, without your name. A screenshot is deleted after 30 days.
• Hosting provider security logs: up to 30 days.

8. With whom do we share your data?

We never sell your data. We do work with a number of trusted sub-processors under strict data processing agreements and GDPR compliance. These fall into the following categories of recipients:

• Hosting and security provider — hosting of this website + protection against attacks. Data stays in EU datacenters where technically possible.
• Database and authentication service — for the owner portal.
• CRM software — for following up your demo or contact request and our prospecting.
• Payment processor — receives your customer transactions, not the personal data of website visitors.
• Email service — sending transactional emails (confirmations, password reset).
• Office software — business email and file storage for our internal operations.

Sub-processors outside the EU operate under the European Commission's Standard Contractual Clauses.

9. What rights do you have?

Under the GDPR you have the right to:

• Request access to your data.
• Have incorrect data rectified.
• Have your data erased (right to be forgotten).
• Restrict the processing.
• Object to processing based on legitimate interest.
• Object at any time and without giving a reason to direct marketing, including the prospecting described in part 4.
• Transfer your data to another processor.
• Withdraw your consent at any time.

Send us an email to exercise any of these rights. We respond within 30 days. Not satisfied? You can file a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be).

10. Cookies

This website uses only technically necessary cookies from our hosting provider for security and performance. No tracking cookies, no Google Analytics, no advertising pixels. That's why we don't show a cookie banner.

11. Security

We take appropriate technical and organisational measures to protect your data: HTTPS everywhere, encryption at rest in the database, multi-factor authentication for owners, limited employee access, and regular security audits.

12. Changes to this policy

We may adapt this privacy policy if the law or our services change. The last-updated date is at the top. We notify our customers by email of material changes.

13. Contact

Questions about this policy or your data? Email us or call us. We're happy to help.