← Back to home

Privacy Policy

Last updated: 5 October 2026

1. Who we are

Flowgate ("Flowgate", "we", "us", "our") is owned by Primarius Group Limited, a company registered in England and Wales (company number 17120989). For the purposes of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025, we are the data controller for personal data about our clients (coaches and course creators) and website visitors, and a data processor for the personal data of your leads that we process on your behalf (see section 6).

Contact: info@flowgatesystems.co.uk

2. Scope and roles

Flowgate operates on two levels, and our role under data protection law is different for each:

  • Your data (client / account data): we are the controller. This section, and sections 3–5 and 7–13, explain how we use it.
  • Your leads' and call participants' data: where Flowgate tracks or replies to your Instagram/WhatsApp conversations, captures lead details, or (where enabled) records and analyses your sales calls, you are the controller and Flowgate is the processor acting on your documented instructions. Section 6 explains this and the split of responsibilities.

3. What data we collect

We collect the following categories of personal data:

  • Account information: name, email address, phone number or WhatsApp number.
  • Business information: details about your coaching business, services you offer, target audience, tone, qualification criteria, and (for the notetaker) a per-client currency setting.
  • Integration credentials: where you connect WhatsApp or outbound outreach triggers through ManyChat, your ManyChat API key(s), stored encrypted at rest using AES-256. Instagram DMs do not use ManyChat.
  • Instagram connection: where you connect Instagram directly through our Meta app, your Instagram professional account ID and username, the permissions you granted, and the access token Instagram issues to us, stored encrypted at rest using AES-256. See section 6a.
  • Scheduler credentials (notetaker): where you connect Calendly, the personal access token you generate in your own Calendly account, stored encrypted at rest using AES-256. It is used only to register and maintain the booking webhook that tells us a call has been booked, and to retrieve the meeting join link Calendly creates after a booking. You can disconnect it at any time from your dashboard, which deletes the token and removes the webhook.
  • Conversation data: Instagram and WhatsApp DM messages, and Instagram comments where outbound outreach is enabled, processed on your behalf directly through Meta's Instagram API for Instagram, and through ManyChat for WhatsApp and outbound outreach triggers, including lead usernames or contact names, message content, and AI-generated qualification notes.
  • Payment data: we invoice you directly and you pay by bank transfer. We keep your invoices and the payment records that appear on our business bank statements. We do not take or store card details.
  • Usage data: login timestamps, pages visited within the dashboard, and feature usage for service improvement and security.
  • Discovery call bookings: when you book a call with us through the Cal.com booking widget on our website, Cal.com collects your name, email address and any answers you give, which we use to hold and prepare for that call.

Where the relevant features are enabled, we also process, as your processor (section 6), personal data about your leads and about the people on your recorded calls:

  • Lead contact details: the bot may ask a lead for their email address before sending a booking link; where given, it is stored against that conversation and used to match a subsequent booking to the lead.
  • Booking data (notetaker): when a lead books a call through your connected scheduler (Calendly, Cal.com, SavvyCal or OnceHub), we receive the scheduler's booking webhook, which includes the invitee's name, email, the meeting join URL, the scheduled time, and their answers to your booking-form questions (including their answer to the recording-consent question).
  • Call recordings and transcripts (notetaker — only where enabled): where you enable the notetaker and the participant has consented, a recording bot joins the call to capture audio/video, which is transcribed. The transcript is analysed by AI to detect the call outcome (won / lost / follow-up / no-show), any deal value and currency mentioned, and key objections. See section 5.
  • Conversation insights: recorded call transcripts, transcripts you upload, and DM conversations are analysed by AI for the objections raised (including short verbatim quotes), what moved the sale forward, and where it stalled. These are combined into a report and playbook for your account only.
  • Past calls and message threads: the recordings or transcripts of past sales calls, and the past message threads, that you give us at kickoff. They are analysed in the same way, for your account only.
  • Guarantee evidence: where your service agreement includes our guarantee, the list of deals and the record of each payment you send us after your term so we can work out any refund. These can include your customers' names and payment details. We use them only for that check.

4. How we use your data and our lawful bases

For data where we are the controller (your account and business data), we process under the following lawful bases (Article 6, UK GDPR):

  • Performance of a contract (Art. 6(1)(b)): to provide the Flowgate service, process DM conversations, qualify leads, send booking links and notifications, and (where enabled) run the notetaker pipeline.
  • Legitimate interests (Art. 6(1)(f)): to improve and secure the service, prevent fraud and abuse, monitor service health, and communicate service updates. Where we rely on legitimate interests we balance our interests against your rights.
  • Consent (Art. 6(1)(a)): for optional marketing communications and for any non-essential cookies. You can withdraw consent at any time.
  • Legal obligation (Art. 6(1)(c)): to comply with applicable tax, accounting and regulatory requirements.

When Flowgate processes your leads' and call participants' data as your processor, you are responsible for identifying and documenting the lawful basis for that processing (section 6). We do not determine the purposes of that processing and we do not use it for our own purposes.

5. AI meeting notetaker and call recording

The notetaker is an optional feature that, where you switch it on, records and transcribes the sales calls that leads book with you through your connected scheduler, and uses AI to detect whether the deal closed and for how much. It is off by default for every client and only runs for clients who switch it on. The following applies wherever it is enabled.

  • How consent is captured: recording consent is collected as a question on your booking form (e.g. "Do you consent to this call being recorded and transcribed to create meeting notes?"). The lead's answer travels back with the booking. Recording is fail-closed: a bot is only ever dispatched where consent is explicitly granted. If consent is declined, missing, or cannot be interpreted, no recording takes place.
  • Named participant: where a recording proceeds, a clearly named bot ("Flowgate Notetaker") joins the call as a visible participant.
  • No biometric processing: Flowgate does not create voiceprints, perform biometric speaker identification, or otherwise process voice for the purpose of uniquely identifying an individual. We transcribe speech to text and analyse the text. We do not process special-category biometric data through this feature.
  • What is produced: an audio/video recording and a transcript (held by our recording sub-processor and in our database), plus an extracted deal record (outcome, any value/currency, objections) shown on your dashboard.
  • Sub-processors and transfers: recording and transcription are provided by Recall.ai, and transcript analysis by OpenAI. Both are US-headquartered providers; see sections 8 and 9.
  • Your role: for recorded calls you are the controller. You are responsible for the lawfulness of recording each call, for informing all participants, and for honouring participant rights and any request to stop or delete. This is important where a participant may be located outside the UK — some jurisdictions require the consent of every party to a call. See section 6.

6. Data about your leads and call participants (Flowgate as processor)

When you connect Instagram, WhatsApp (through ManyChat), a scheduler, or enable the notetaker, Flowgate processes personal data about your leads and call participants on your behalf. In this context you are the data controller and Flowgate is the data processor, acting only on your documented instructions and the terms of our agreement.

We process this data solely to deliver the agreed service — qualifying leads, sending booking links, capturing a lead email to match bookings, and (where enabled) recording, transcribing and analysing booked calls. We do not sell it, share it beyond the sub-processors in section 8, or use it to train our own models or build any cross-client data product.

As the controller for this data, you are responsible for:

  • Having and documenting an appropriate lawful basis to process your leads' and participants' data (for example, legitimate interest in responding to enquiries, or consent).
  • Providing a privacy notice to your leads and participants, and, for recorded calls, informing every participant and obtaining any consent required in their jurisdiction.
  • Assessing whether your processing requires a Data Protection Impact Assessment (DPIA) — systematic monitoring and the large-scale or novel use of AI and call recording are the kinds of processing that may require one.
  • Responding to data subject requests (access, erasure, objection, etc.) from your leads and participants. We will assist you in meeting these requests as your processor.

The terms governing our processor role, including the security measures, sub-processor arrangements and our duty to act only on your instructions, are set out in our Data Processing Agreement.

6a. Instagram and Meta Platform data

You can connect your Instagram professional account to Flowgate directly, using Instagram Login through our own Meta app, which has passed Meta's App Review for Instagram messaging and uses Instagram's official API. This section explains what we receive from Meta and how we use it.

  • Permissions we request: instagram_business_basic (your account ID and username), instagram_business_manage_messages (to receive and reply to DMs sent to your account) and instagram_business_manage_comments (to receive comments on your posts and, only where you switch on outbound outreach, send one private reply to the commenter).
  • What we receive: messages people send to your account, messages you or your team send from it (so each conversation is complete and the bot can step back when a human replies), comments on your posts, the sender's Instagram-scoped ID and username, and message timestamps. We do not access your followers list, your posts' insights, your password, or messages in other accounts.
  • How we use it: only to provide the service you configured: to qualify the lead with AI, reply on your behalf and send your booking link (where AI replies are on), alert you when a lead needs a human, and show the conversation and insights in your dashboard. Message content is sent to OpenAI to generate replies (section 8).
  • What we never do: we do not sell Instagram data, use it for advertising or profiling, share it with data brokers, combine it across clients, or use it to train AI models. We only message people who contacted you first or engaged with your content, and only within the time limits Meta allows.
  • Automated replies: where you switch AI replies on, replies are generated by AI on your behalf. The bot does not claim to be human; if someone sincerely asks whether they are talking to a bot, it says it is an AI assistant. You can take over any conversation from your dashboard, and the bot stops replying to it.
  • Disconnecting: you can disconnect Instagram at any time from your dashboard, or by removing Flowgate in Instagram under Settings › Apps and websites. We then stop receiving and sending messages for your account.
  • Deleting your data: if you ask Meta to delete the data Flowgate holds (through Instagram's app settings), we immediately delete everything we received through your Instagram connection: the access token, the conversations and comment replies that came in through it, and the lead notes, conversation insights and deal records built from those conversations. You get a confirmation code and a status page. Your Flowgate account and any conversations handled through ManyChat are not affected; to delete those too, email info@flowgatesystems.co.uk from your account email and we will delete them within 30 days. If you are a lead who messaged one of our clients, contact that client, or email us and we will pass your request to them and assist.

Our use of information received from Meta's APIs follows the Meta Platform Terms and Developer Policies.

7. Outbound messaging and direct marketing

Where you enable outbound outreach (off by default), the bot can send the first message to someone who has just taken a warm action towards your account — commenting a keyword, following, replying to a story, or clicking a "send message" ad. Flowgate does notsend unsolicited "cold" messages to people who have not engaged with you, and the feature is built to prevent that.

Depending on content and context, an automated opening message may amount to electronic direct marketing under the Privacy and Electronic Communications Regulations 2003 (PECR). You are the sender and the controller for these messages and are responsible for ensuring you have a lawful basis (consent or the "soft opt-in", where its conditions are met) and for honouring any objection or opt-out. Flowgate provides per-lead personalisation, exclusion lists and rate controls to support compliant use, but you remain responsible for how you configure and use outreach.

8. Sub-processors

We use the following sub-processors to deliver the service, each bound by a data processing agreement. A dedicated, maintained list is at flowgate › sub-processors.

  • Supabase — database, authentication and hosting (our project is hosted in the EU / eu-west-1).
  • Vercel (US) — hosting and delivery of the web dashboard and marketing site.
  • DigitalOcean — VPS hosting for the bot cron process (London, UK).
  • OpenAI (US) — AI processing of DM conversations and (where enabled) call transcripts for lead qualification and deal analysis. OpenAI does not use data submitted via its API to train its models.
  • ManyChat (US) — WhatsApp messaging integration and outbound outreach triggers, for clients who enable them. Instagram DMs connect directly through Meta and do not pass through ManyChat.
  • Recall.ai (US) — meeting-recording and transcription for the notetaker (recording storage region: EU). Only used where the notetaker is enabled and consent is granted.
  • Resend (US) — transactional and notification email (including authentication emails and coach alerts).

We will give notice of changes to our sub-processors via the sub-processor page and, for material changes, by email or dashboard notice.

9. International transfers

Several of our sub-processors are located in, or transfer data to, the United States. Where personal data is transferred outside the UK, we rely on an appropriate transfer mechanism under the UK GDPR, namely: the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge") where the receiving organisation is certified to it; and otherwise the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment and supplementary measures where needed.

The specific mechanism relied on for each sub-processor is listed on the sub-processor page. You can request more detail on any transfer safeguard by contacting us.

10. Data retention

  • Account data: retained for the term of your agreement with us plus 30 days, unless you request earlier deletion.
  • Conversation and lead data: retained for the term of your agreement with us. Deleted within 30 days of the end of your term or account closure, except for what we need to complete a guarantee check and any refund. Conversations received through a direct Instagram connection are deleted immediately if you ask Meta to delete your data (section 6a).
  • Call recordings and transcripts (notetaker): raw recordings are deleted from our recording sub-processor after transcription. The transcript, extracted deal data and conversation insights are retained for the term of your agreement with us. See section 5.
  • Guarantee evidence: kept only as long as needed to work out the amount made back under the guarantee and for our accounting records.
  • Billing records: retained for 6 years as required by UK tax law (HMRC).
  • Encrypted credentials: deleted upon account closure. An Instagram access token is also deleted when you disconnect Instagram or ask Meta to delete your data (section 6a).

11. Your rights

Under UK GDPR, you have the right to:

  • Access your personal data (Subject Access Request).
  • Rectify inaccurate or incomplete data.
  • Erase your data ("right to be forgotten"), subject to legal retention requirements.
  • Restrict processing in certain circumstances.
  • Object to processing based on legitimate interests, and to direct marketing at any time.
  • Data portability: receive your data in a structured, machine-readable format.
  • Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email info@flowgatesystems.co.uk. We will respond within one calendar month. If you are a lead or call participant of one of our clients, please contact that client (the controller) in the first instance; we will assist them in responding.

12. Security

We take reasonable technical and organisational measures to protect your data, including: encryption of sensitive credentials at rest (AES-256), Row Level Security on all database tables, HTTPS-only communication, per-tenant isolation, and regular security audits.

No system is 100% secure. If you discover a vulnerability, please report it to info@flowgatesystems.co.uk.

13. Cookies

See our Cookie Policy for details on cookies and similar technologies used on our website.

14. Children

Flowgate is a business-to-business service intended for users aged 16 and over. We do not knowingly collect data from anyone under 16. If we become aware that a user is under 16, we will take steps to delete their account and associated data.

15. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email or a dashboard notification. The "last updated" date at the top reflects the most recent revision.

16. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

ico.org.uk/make-a-complaint