Privacy Policy

Blixtgo Agency AB, Swedish company registration number 559069-9038, Drottninggatan 6A, 212 11 Malmö, Sweden, provides the Blixtflow service and the website blixtflow.com. We are the controller for the processing described in this policy.

Send data protection questions to hello@blixtflow.com. We normally reply within a week and at the latest within one month.

It is important to distinguish between two situations:

• We are the controller for data about website visitors, people who contact us, our customers’ contact persons and Users (for example account, login, invoicing and support), and for how our own service works and is protected.
• We are a processor when a business uses Blixtflow to communicate with its customers. If you have emailed, chatted, called or texted a business that uses Blixtflow, that business is the controller of your data. We only process it on the business’s instructions and under our data processing agreement. To exercise your rights in that case, please contact the business first – we will gladly help it respond to you.

We do not collect location data, contacts from your phone or sensitive personal data (such as health data) for our own purposes.

Where we rely on legitimate interest, we have balanced our interest against your privacy and found that ours prevails. You have the right to object – see the section on your rights.

When businesses use Blixtflow, the data processed includes email, chat messages, SMS, messages via WhatsApp, Messenger and Instagram, calls with recordings and transcripts, contact details, orders, bookings and attachments. The business decides which channels are connected and how long data is kept.

We process this data only as a processor, under the data processing agreement. We do not look at the content except where needed to resolve a support request the customer has asked for, and then through a logged support mode.

Blixtflow has AI features such as the AI receptionist, the chatbot, suggested replies and summaries. For these:

• Personal identity numbers, card numbers and IBANs are masked automatically before text is sent to the AI service.
• Data sent for AI processing is used only to produce the response for the customer – not to train general AI models, neither by us nor by our AI providers.
• The AI makes no decisions with legal or similarly significant effects for you (Art. 22 GDPR).
• Businesses using the AI receptionist or chatbot must tell their customers that they are talking to an AI.

If you choose to connect a Google account to Blixtflow – for example Gmail to receive and send email in the inbox, or Google Calendar to sync meetings – Blixtflow gets access, with your explicit approval through Google sign-in, to the data covered by that permission.

What we access and why

• Email (Gmail): messages, headers, attachments and labels in the inbox you connect – to show them in the shared inbox, let your team reply and send replies from your address.
• Calendar: events in the calendars you choose – to show free slots, let the AI receptionist book and mirror meetings between Blixtflow and Google Calendar.
• Basic profile: name, email address and profile picture – to identify the connected account.

How we use, store and share the data

• The data is used only to provide and improve the user-facing features of Blixtflow that you see and use.
• It is stored encrypted in the Service for as long as the connection and the account exist. Access tokens are stored encrypted and deleted when you disconnect the account.
• It is not shared with third parties, except with the subprocessors needed to run the Service, when required by law, or with your explicit consent.
• It is never used for advertising, never sold and not used to train general AI or machine-learning models.
• No human reads the data, except when you have explicitly asked us to (for example in a support request), when needed for security, or to comply with law.

Blixtflow’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google at any time in Blixtflow under Settings → Channels, or remove Blixtflow’s access at myaccount.google.com/permissions. Data retrieved is then deleted as described in the section on deletion below.

If a business connects a Facebook Page, an Instagram account or WhatsApp Business to Blixtflow, we process messages, comments, the sender’s name and profile picture, and images and attachments, so that they can be shown and answered in the inbox. If the business publishes posts through Blixtflow, text and images are sent to Meta for publication.

The data is used only to provide these features. The business can disconnect the account in Blixtflow or in Meta’s settings. Instructions for deleting data are in the section Delete your data.

The mobile app collects no statistics and contains no trackers. When you sign in, the device name, model, platform and app version are sent to us so that you can see and sign out your devices. If you allow notifications, a push token is created and used to deliver notifications via Expo and Apple (iPhone) or Google (Android). Notification content can be hidden on the lock screen.

Your sign-in is stored encrypted in the phone’s secure storage and data cached for offline use is encrypted. Everything is removed from the phone when you sign out. The app only asks for camera and photos when you want to attach a file.

We never sell personal data. We only share it when needed:

• Subprocessors that help us run the Service, such as hosting, email, SMS, notifications and AI. The current list is on the Subprocessors page. All are bound by agreements that protect the data.
• Services you connect yourself, such as Google, Microsoft, Meta or an online store. Their terms and privacy policies then also apply.
• Authorities and others when required by law, or to establish, exercise or defend legal claims.
• In a business transfer to a buyer who continues to process the data under this policy.

We aim to process personal data within the EU/EEA. Some subprocessors may process data in countries outside the EU/EEA, such as the United States. In that case we make sure the transfer is lawful through an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework for certified companies) or the European Commission’s standard contractual clauses, supplemented by additional safeguards where needed. The Subprocessors page shows where each subprocessor processes data and which safeguard applies.

• Encrypted transfer (HTTPS/TLS) and encryption of keys and attachments.
• Passwords are stored with Argon2id and login tokens only as hashes.
• Two-step verification, lockout after repeated failed logins and sign-out after inactivity.
• Role-based access, private channels and full isolation between different businesses’ data.
• Email is displayed in isolation and tracking pixels are blocked by default.
• Playback of call recordings is logged.

If a personal data breach that may pose a risk to you still occurs, we report it to the Swedish Authority for Privacy Protection within 72 hours and inform you when required.

Under the GDPR you have the right to

• access your data,
• rectify inaccurate data,
• erase data (“the right to be forgotten”) when it is no longer needed or the processing lacks a legal basis,
• restrict processing, for example while an objection is being assessed,
• object to processing based on legitimate interest, and always to direct marketing,
• data portability – receive data you have provided in a machine-readable format, and
• withdraw consent where processing is based on consent, without affecting processing that has already taken place.

Send your request to hello@blixtflow.com. We may need to verify your identity. We reply within one month; in complex cases this may be extended by two further months, and we will tell you if so.

This is how to have your data deleted:

• Blixtflow users: sign in and choose Account → Delete account (in the app: More → Security → Delete account). Your account and personal data are deleted. Conversations you worked on belong to your company and remain with the company.
• Businesses (customers): an administrator can cancel the subscription and request deletion of the whole workspace. Data is deleted no later than 30 days after the agreement ends.
• Connected Google or Meta accounts: disconnect the account under Settings → Channels. Data retrieved from the account is deleted within 30 days, unless the business has chosen to keep the conversation history.
• If you contacted a business that uses Blixtflow: contact the business, which is responsible for your data. You can also write to us and we will forward your request.
• Everyone else: email hello@blixtflow.com with the subject “Delete my data” and state the email address or phone number concerned.

We confirm the deletion within 30 days. Data we are legally required to keep, such as bookkeeping records, is deleted when the retention period has ended.

The blixtflow.com website uses no cookies for tracking, analytics or advertising. The service itself only uses cookies that are necessary for sign-in and security. Read more in our cookie policy.

Blixtflow is a service for businesses and is not directed at children. We do not knowingly collect personal data about children under 16 for our own purposes.

If you are unhappy, please contact us first and we will try to resolve it. You always have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), Box 8114, SE-104 20 Stockholm, Sweden, www.imy.se, or with the data protection authority in the EU country where you live or work.

We update the policy when our processing changes or the law requires it. The date and version are shown at the top. For material changes, we inform customers and Users by email or in the Service before the change takes effect.