FlowGlow Studio App Privacy Policy

This English version is a translation provided for your convenience. Only the German version of this privacy policy is legally binding.

1) Information on the Collection of Personal Data and Contact Details of the Controller

1.1 We are pleased that you are using our application (hereinafter “App”). Below, we inform you about how we handle your personal data when you use our App. Personal data is all data with which you can be personally identified.

1.2 The controller in charge of data processing for this App, within the meaning of the General Data Protection Regulation (GDPR), is FlowGlow Lighting GmbH, Brentanoweg 3, 66802 Überherrn, Germany, Phone: 015736824201, e-mail: hello@getflowglow.com. The controller in charge of the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

1.3 For security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries to the controller), this App uses SSL or TLS encryption. You can recognize an encrypted connection by the character string “https://” and the lock symbol in your browser line.

2) Use of Single Sign-On Procedures

2.1 Apple Sign-In

In our App, we provide a single sign-on function offered by the following provider: Apple Distribution International (Apple), Hollyhill Industrial Estate, Hollyhill, Cork, Ireland

If you have an account with the provider, you can use this account data to create a user account or to register on our website.

When you visit this page, a direct connection between your browser and the provider's servers can be established via this login function, even if you do not have an account with the provider or are not logged in to one. The provider thereby receives the information that you have visited our site. The information collected in this respect (including your IP address, if applicable) is transmitted by your browser directly to a server of the provider and stored there. However, the information is not used to identify you personally and is not passed on to third parties.

These data processing operations are carried out in accordance with Art. 6 (1) point f GDPR based on our legitimate interest in a user-friendly and interactive design of our online presence.

If you click the sign-in button to register on our website with the data of your account with the provider, the provider transmits the general and publicly accessible information stored in your account (user ID, name, address, e-mail address, age and gender) to us, exclusively on the basis of your express consent pursuant to Art. 6 (1) point a GDPR.

We store and use the data transmitted by the provider to set up a user account with the necessary data (title, first name, last name, address data, country, e-mail address, date of birth), insofar as you have released this data to the provider. Conversely, data (e.g. information about your browsing or purchasing behavior) may be transferred from us to your account with the provider on the basis of your consent.

The consent given can be revoked vis-à-vis us at any time with effect for the future.

2.2 Google Sign-In

In our App, we provide a single sign-on function offered by the following provider: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

In addition to the transfer of data to the above-mentioned provider location, data may also be transferred to: Google LLC, USA

If you have an account with the provider, you can use this account data to create a user account or to register on our website.

These data processing operations are carried out in accordance with Art. 6 (1) point f GDPR based on our legitimate interest in a user-friendly and interactive design of our online presence.

The consent given can be revoked vis-à-vis us at any time with effect for the future.

For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.

Further information on Google's privacy policy can be found here: https://business.safety.google/privacy/

3) Log Files When Using Our Mobile App

Downloading the App

When you download our mobile App from an app store, the required information is transferred to the app store. This includes, in particular, the user name, e-mail address and customer number of your store account, the time of the download, payment information and an individual device identifier. We have no influence on this data collection and are not responsible for it. We only process the data to the extent necessary for downloading the mobile App to your mobile device.

Using the App

When you use our mobile App, we collect the personal data described below to enable convenient use of its functions. If you wish to use our mobile App, we collect the following data, which is technically necessary for us to offer you the functions of our mobile App and to ensure its stability and security:

Date and time of the request, and time zone
Function accessed or content of the request
Access status/HTTP status code
Amount of data transferred
Version of the App
Device type or model
Operating system and its version
Language setting of the device
IP address (if applicable: in shortened form)

Insofar as this data is necessary to provide the App functions you use, we base the processing on Art. 6 (1) point b GDPR. Otherwise, it is based on Art. 6 (1) point f GDPR. Our legitimate interest lies in ensuring the stability, security and functionality of the App and in analyzing errors. Access to this information on your device is strictly necessary for providing the App (Section 25 (2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG).

However, we reserve the right to check the aforementioned log files subsequently if there are concrete indications of unlawful use.

4) Hosting & Content Delivery Network

4.1 Supabase

We use the web hosting service “Supabase” of Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992, Singapore, for the purpose of hosting and displaying the App content, on the basis of processing on our behalf.

All data collected in our App is processed on Supabase's servers.

In the course of the aforementioned services, data may also be transferred to servers in the USA as part of further processing on our behalf.

We have concluded a data processing agreement with Supabase that obliges Supabase to protect the data of our site visitors and not to pass it on to third parties.

Further information on data protection at Supabase is available at https://supabase.com/privacy

Further processing on servers other than the aforementioned Supabase servers takes place only within the scope set out below.

4.2 Cloudflare

We use a content delivery network offered by the following provider: Cloudflare Inc., 101 Townsend St. San Francisco, CA 94107, USA

This service enables us to deliver large media files such as graphics, page content or scripts faster via a network of regionally distributed servers. The processing is carried out to protect our legitimate interest in improving the stability and functionality of our website pursuant to Art. 6 (1) point f GDPR. We have concluded a data processing agreement with the provider, ensuring the protection of our site visitors' data and prohibiting unauthorized disclosure to third parties.

5) Cookies

To make our App attractive and to enable the use of certain functions, we use so-called cookies. These are small text files that are stored on your device. Some of the cookies we use are deleted again after the App is closed (so-called session cookies). Other cookies remain on your device and enable us to recognize you (so-called persistent cookies). When cookies are set, they collect and process certain user information to an individual extent, such as browser and location data and IP address values. Persistent cookies are deleted automatically after a specified period, which may differ from cookie to cookie.

Some cookies serve to simplify the operation of the App by saving settings. If personal data is also processed by individual cookies we use, the processing is carried out in accordance with Art. 6 (1) point b GDPR for the performance of the contract, in accordance with Art. 6 (1) point a GDPR if consent has been given, or in accordance with Art. 6 (1) point f GDPR to safeguard our legitimate interests in the best possible functionality of the App and a customer-friendly and effective design of its use.

You can configure the settings of your mobile operating system and of the App as you wish and, for example, refuse to accept third-party cookies or all cookies. Please note, however, that you may then no longer be able to use all functions of our mobile App.

6) Contacting Us

6.1 When you contact us (e.g. via contact form or e-mail), personal data is collected. Which data is collected when you use a contact form can be seen from the respective contact form in the App. This data is stored and used exclusively for the purpose of responding to your request or for establishing contact and for the associated technical administration. The legal basis for processing this data is our legitimate interest in responding to your request pursuant to Art. 6 (1) point f GDPR. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6 (1) point b GDPR. Your data will be deleted once your request has been fully processed. This is the case if it can be inferred from the circumstances that the matter in question has been conclusively clarified, provided there are no statutory retention obligations to the contrary.

6.2 Resend

For sending transactional e-mails, i.e. event-related messages triggered by a specific user interaction (such as the conclusion of a contract, registration or a password reset), we use this provider: Plus Five Five, Inc., 2261 Market Street, #5039, San Francisco, CA 94114, USA

On the basis of our legitimate interest in effective and user-friendly e-mail communication, we pass on the data you provide when carrying out such a user action to this provider pursuant to Art. 6 (1) point f GDPR, so that it can send the e-mails on our behalf.

We have concluded a data processing agreement with the provider that protects the data of our site visitors and prohibits disclosure to third parties.

7) Data Processing When Opening a Customer Account

Pursuant to Art. 6 (1) point b GDPR, personal data will continue to be collected and processed if you provide it to us for the performance of a contract or when opening a customer account. Which data is collected can be seen from the respective input forms. You can delete your customer account at any time by sending a message to the above-mentioned address of the controller. We store and use the data you provide for processing the contract. After the contract has been fully processed or your customer account has been deleted, your data will be blocked with regard to tax and commercial retention periods and deleted after these periods have expired, unless you have expressly consented to further use of your data or we have reserved the right to a further use of data permitted by law, about which we inform you below.

8) Data Processing for Contract Processing

8.1 To process contracts concluded via the App, we work with the service provider(s) listed below, who support us in whole or in part in the performance of concluded contracts. Certain personal data is transferred to these service providers in accordance with the following information.

As part of the contract processing, the personal data collected by us is passed on to the transport company commissioned with the delivery, insofar as this is necessary for the delivery of goods ordered. As part of payment processing, we pass on your payment data to the commissioned credit institution, if any, insofar as this is necessary for the processing of payments. If payment service providers are used, we inform you about this explicitly below. The legal basis for passing on the data is Art. 6 (1) point b GDPR.

8.2 Klarna

If you choose a Klarna payment service, the payment is processed by Klarna Bank AB (publ) [https://www.klarna.com/de], Sveavägen 46, 111 34 Stockholm, Sweden (hereinafter “Klarna”). To enable the payment to be processed, your personal data (first and last name, street, house number, postcode, city, gender, e-mail address, telephone number and IP address) and data related to the order (e.g. invoice amount, items, delivery method) are passed on to Klarna for the purpose of identity and credit checks, provided that you have expressly consented to this pursuant to Art. 6 (1) point a GDPR during the ordering process. You can see here to which credit agencies your data may be forwarded:
https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/credit_rating_agencies

The credit report may contain probability values (so-called score values). Insofar as score values are included in the result of the credit report, they are based on a scientifically recognized mathematical-statistical procedure. The calculation of the score values includes, but is not limited to, address data. Klarna uses the information received about the statistical probability of a payment default to make a balanced decision on the establishment, performance or termination of the contractual relationship.

You can revoke your consent at any time by sending a message to the controller or to Klarna. However, Klarna may still be entitled to process your personal data if this is necessary for the contractual processing of payments.

Your personal data will be handled in accordance with the applicable data protection regulations and with the information in Klarna's privacy policy for data subjects based in Germany https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_de/privacy
or for data subjects based in Austria https://cdn.klarna.com/1.0/shared/content/legal/terms/0/de_at/privacy.

PayPal

One or more online payment methods of the following provider are available on this website: PayPal (Europe) S.a.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg

If you select a payment method of the provider for which you make an advance payment, your payment data provided during the ordering process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order will be passed on to the provider pursuant to Art. 6 (1) point b GDPR. In this case, your data will be passed on exclusively for the purpose of processing the payment with the provider and only to the extent necessary for this purpose.

If you select a payment method for which we make an advance payment, you will also be asked to provide certain personal data (first and last name, street, house number, postcode, city, date of birth, e-mail address, telephone number, if applicable data on an alternative means of payment) during the ordering process.

To safeguard our legitimate interest in determining your solvency in such cases, we pass this data on to the provider for the purpose of a credit check pursuant to Art. 6 (1) point f GDPR. On the basis of the personal data you provided and further data (such as shopping cart, invoice total, order history, payment history), the provider checks whether the payment option you selected can be granted with regard to payment and/or bad debt risks.

You can object to this processing of your data at any time by sending a message to us or to the provider. However, the provider may still be entitled to process your personal data if this is necessary for the contractual processing of payments.

Shopify Payments

One or more online payment methods of the following provider are available on this website: Shopify International Limited, Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland

If you select a payment method of the provider for which you make an advance payment (such as credit card payment), your payment data provided during the ordering process (including name, address, bank and payment card information, currency and transaction number) as well as information about the content of your order will be passed on to the provider pursuant to Art. 6 (1) point b GDPR. In this case, your data will be passed on exclusively for the purpose of processing the payment with the provider and only to the extent necessary for this purpose.

8.3 Electronic Withdrawal Function for Distance Contracts

Consumers who conclude contracts via this App for which a statutory right of withdrawal exists can declare their withdrawal via an electronic withdrawal function in accordance with the applicable withdrawal provisions.

When using the withdrawal function, in addition to details identifying the contract being withdrawn from, further personal information, such as the consumer's first and last name and e-mail address, must be provided or confirmed.

The collection of this information and its transmission to us is carried out pursuant to Art. 6 (1) point b GDPR and only to the extent necessary for the proper processing of the withdrawal. Also on the basis of Art. 6 (1) point b GDPR, the personal data provided is used to confirm receipt of the withdrawal declaration by e-mail. A further legal basis for the processing is Art. 6 (1) point c GDPR. We are legally obliged to provide an electronic withdrawal function for distance contracts concluded with consumers against payment.

9) Registration in the App

You can register in our App by providing personal data. Which personal data is processed for registration can be seen from the input form used for registration.

We use the so-called double opt-in procedure for registration. Your registration is only complete once you have confirmed it, either via the link in the confirmation e-mail we send you or by entering the code you receive by SMS. If you do not confirm within the time period stated in the App, we automatically delete your registration data. The information mentioned above is required for registration. All other information is voluntary and can be added by you while using our App.

When you use our App, we store the data required for the performance of the contract, including any information on the method of payment, until you finally delete your access. We also store the data you provide voluntarily for the period of your use of the portal, unless you delete it beforehand. You can manage and change all information in the protected customer area. The legal basis is Art. 6 (1) point f GDPR.

In addition, we store all content you publish in the App in order to operate the App. This may include public posts, pinboard entries, guestbook entries or other content. We have a legitimate interest in providing the App with the complete user-generated content. The legal basis for this is Art. 6 (1) point f GDPR. If you delete your account, your statements published in a forum provided in the App remain visible to all readers, but your account can no longer be accessed. All other data will be deleted in this case.

10) Use of Your Data for Direct Advertising

10.1 Subscribing to Our E-mail Newsletter

If you subscribe to our e-mail newsletter, we will regularly send you information about our offers. The only mandatory information for sending the newsletter is your e-mail address. Providing further data is voluntary and is used to address you personally. We use the so-called double opt-in procedure for sending the newsletter. This means that we will only send you an e-mail newsletter once you have expressly confirmed that you consent to receiving newsletters. We will then send you a confirmation e-mail asking you to confirm, by clicking on a corresponding link, that you wish to receive the newsletter in the future.

By activating the confirmation link, you give us your consent to the use of your personal data pursuant to Art. 6 (1) point a GDPR. When you subscribe to the newsletter, we store your IP address as entered by your Internet service provider (ISP) and the date and time of your subscription, in order to be able to trace any possible misuse of your e-mail address at a later date. The data we collect when you subscribe to the newsletter is used exclusively for promotional purposes by way of the newsletter.

You can unsubscribe from the newsletter at any time via the link provided for this purpose in the newsletter or by sending a corresponding message to the controller named at the beginning. After you unsubscribe, your e-mail address will be deleted from our newsletter distribution list without undue delay, unless you have expressly consented to further use of your data or we reserve the right to a further use of your e-mail address for advertising purposes that is permitted by law and about which we inform you in this declaration.

After you unsubscribe from the newsletter, your e-mail address may be stored in a so-called blocklist and compared from there with the recipient lists of future newsletters, in order to technically prevent newsletters requiring consent from being sent to you again. This processing is based on our legitimate interest in avoiding unwanted advertising mailings pursuant to Art. 6 (1) point f GDPR.

10.2 Sending the E-mail Newsletter to Existing Customers

If you have provided us with your e-mail address when purchasing goods or services, we reserve the right to regularly send you offers by e-mail for goods or services from our range that are similar to those already purchased. Pursuant to Section 7 (3) of the German Act against Unfair Competition (UWG), we do not need to obtain separate consent from you for this. In this respect, the data processing is carried out solely on the basis of our legitimate interest in personalized direct advertising pursuant to Art. 6 (1) point f GDPR. If you initially objected to the use of your e-mail address for this purpose, we will not send you any e-mails.

You are entitled to object to the use of your e-mail address for the aforementioned advertising purpose at any time with effect for the future by notifying the controller named at the beginning. In this regard, you only have to pay the transmission costs according to the basic rates. Upon receipt of your objection, the use of your e-mail address for advertising purposes will cease immediately.

10.3 Klaviyo

Our e-mail newsletters and other promotional e-mail communication are sent via this provider: Klaviyo, Inc., 125 Summer St., Ste 600, Boston, MA 02110, USA

On the basis of our legitimate interest in effective and user-friendly e-mail marketing, we pass on the data you provided when subscribing to this provider pursuant to Art. 6 (1) point f GDPR, so that it can send the e-mails on our behalf.

Subject to your express consent pursuant to Art. 6 (1) point a GDPR, the provider also carries out a statistical analysis of the success of e-mail campaigns by means of web beacons or tracking pixels in the e-mails sent, which can measure opening rates and specific interactions with the content of the newsletter. In the process, device information (e.g. time of access, IP address, browser type and operating system) is also collected and analyzed, but not combined with other data records.

You can revoke your consent to e-mail tracking at any time with effect for the future.

We have concluded a data processing agreement with the provider that protects the data of our site visitors and prohibits disclosure to third parties.

11) Sending Push Notifications

You can sign up to receive our push notifications. Through our push notifications, you regularly receive information related to the services we offer.

To sign up, you must confirm that you want to receive notifications or allow them in the settings of your operating system. This process is documented and stored.

For technical delivery, your device is assigned a so-called push token (a randomly generated, unique device identifier), which is stored together with the time of sign-up.

The collection of this data is necessary so that we can display the push notifications and, in the event of misuse, trace the processes, and therefore serves our legal protection. This data is processed on the basis of your express consent pursuant to Art. 6 (1) point a GDPR.

The notifications themselves are sent via the services of the respective operating system providers:

Apple Push Notification service (APNs) for iOS devices (Apple Distribution International (Apple), Hollyhill Ln, Hollyhill Industrial Estate, Cork, T23 YK84, Ireland).
Firebase Cloud Messaging (FCM) for Android devices (Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland).

You can revoke your consent to the storage and use of your personal data for receiving our push notifications at any time with effect for the future. To revoke your consent, you can turn off the setting provided for receiving push notifications in the App's settings in your operating system.

Your data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected. Accordingly, your data is stored for as long as your subscription to our push notifications is active.

12) Data Processing for Order Handling

To process your order, we may work with service providers who support us in whole or in part in the performance of concluded contracts. The personal data required for the performance of the contract is transferred to these service providers, Art. 6 (1) point b GDPR.

As part of the contract processing, the personal data collected by us is passed on to the transport company commissioned with the delivery, if any, insofar as this is necessary for the delivery of the goods. As part of payment processing, we pass on your payment data to the commissioned credit institution or payment service provider, insofar as this is necessary for payment processing. If payment service providers are used, this is done on the basis of the performance of the contract, Art. 6 (1) point b GDPR.

To fulfill our contractual obligations to our customers, we may work with external shipping partners insofar as this is necessary for the performance of the contract. In this case, we pass on your name and delivery address and, if necessary for the delivery, your telephone number, exclusively for the purpose of delivering the goods (Art. 6 (1) point b GDPR), to a shipping partner selected by us.

13) Web Analytics Services

Google Analytics 4

This App uses Google Analytics 4, a service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (“Google”), which can be used to analyze the use of apps.

When Google Analytics 4 is used, so-called “cookies” are used by default. Cookies are text files that are stored on your device and enable an analysis of your use of an app. The information collected by cookies about your use of the App (including the IP address transmitted by your device, shortened by the last digits, see below) is usually transmitted to a Google server and stored and processed there. This may also result in information being transmitted to the servers of Google LLC, a company based in the USA, where the information is further processed.

When Google Analytics 4 is used, the IP address transmitted by your device when you use the App is always collected and processed by default and automatically only in an anonymized form, so that a direct personal reference of the collected information is excluded. This automatic anonymization is carried out by Google shortening the IP address transmitted by your device by the last digits within member states of the European Union (EU) or other contracting states of the Agreement on the European Economic Area (EEA).

On our behalf, Google uses this and other information to evaluate your use of the App, to compile reports on your App activities or usage behavior, and to provide us with other services related to your App use and internet use. In this context, the shortened IP address transmitted by your device within the scope of Google Analytics 4 is not merged with other Google data. The data collected in the context of the use of Google Analytics 4 is retained for 14 months and then deleted.

Via a special function, the so-called “demographic characteristics”, Google Analytics 4 also enables the creation of statistics with statements about the age, gender and interests of App users, based on an evaluation of interest-based advertising and with the involvement of third-party information. This makes it possible to determine and distinguish between groups of App users for the purpose of targeting marketing measures. However, data collected via the “demographic characteristics” cannot be assigned to a specific person and therefore not to you personally. The data collected via the “demographic characteristics” function is retained for two months and then deleted.

All processing described above, in particular the setting of Google Analytics cookies for storing and reading information on the device you use for the App, only takes place if you have given us your express consent for this pursuant to Art. 6 (1) point a GDPR. Without your consent, Google Analytics 4 is not used during your use of the App. You can revoke your consent once given at any time with effect for the future. To exercise your revocation, please deactivate this service via the “Cookie Consent Tool” provided in the App.

We have concluded a so-called data processing agreement with Google for our use of Google Analytics 4, by which Google is obliged to protect the data of our App users and not to pass it on to third parties.

Further legal information on Google Analytics 4 can be found here: https://business.safety.google/privacy/ and https://policies.google.com/privacy?hl=en

Details on the processing triggered by Google Analytics 4 and on Google's handling of data from apps can be found here: https://policies.google.com/technologies/partner-sites

14) Rights of the Data Subject

14.1 The applicable data protection law grants you comprehensive rights as a data subject (rights of information and intervention) vis-à-vis the controller with regard to the processing of your personal data, about which we inform you below:

Right of access pursuant to Art. 15 GDPR: In particular, you have the right to obtain information about your personal data processed by us, the purposes of processing, the categories of personal data processed, the recipients or categories of recipients to whom your data has been or will be disclosed, the planned storage period or the criteria for determining the storage period, the existence of a right to rectification, erasure, restriction of processing, objection to processing and complaint to a supervisory authority, the origin of your data if it was not collected by us from you, the existence of automated decision-making including profiling and, where applicable, meaningful information about the logic involved and the scope and intended effects of such processing for you, as well as your right to be informed about the safeguards pursuant to Art. 46 GDPR when your data is transferred to third countries;
Right to rectification pursuant to Art. 16 GDPR: You have the right to obtain without undue delay the rectification of inaccurate data concerning you and/or the completion of your incomplete data stored by us;
Right to erasure pursuant to Art. 17 GDPR: You have the right to request the erasure of your personal data if the conditions of Art. 17 (1) GDPR are met. However, this right does not apply in particular if the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defense of legal claims;
Right to restriction of processing pursuant to Art. 18 GDPR: You have the right to request the restriction of the processing of your personal data for as long as the accuracy of your data, which you contest, is being verified; if you refuse the erasure of your data because of unlawful processing and request the restriction of the processing of your data instead; if you need your data for the establishment, exercise or defense of legal claims after we no longer need it because the purpose has been achieved; or if you have objected on grounds relating to your particular situation, as long as it has not yet been determined whether our legitimate grounds prevail;
Right to notification pursuant to Art. 19 GDPR: If you have asserted the right to rectification, erasure or restriction of processing against the controller, the controller is obliged to communicate this rectification or erasure of the data or restriction of processing to all recipients to whom the personal data concerning you has been disclosed, unless this proves impossible or involves disproportionate effort. You have the right to be informed about these recipients.
Right to data portability pursuant to Art. 20 GDPR: You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request its transmission to another controller, insofar as this is technically feasible;
Right to withdraw consent pursuant to Art. 7 (3) GDPR: You have the right to withdraw consent to the processing of data once given at any time with effect for the future. In the event of withdrawal, we will delete the data concerned without undue delay, unless further processing can be based on a legal basis for processing without consent. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent before its withdrawal;
Right to lodge a complaint pursuant to Art. 77 GDPR: If you consider that the processing of personal data concerning you infringes the GDPR, you have the right, without prejudice to any other administrative or judicial remedy, to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement.

14.2 RIGHT TO OBJECT

IF, WITHIN THE FRAMEWORK OF A BALANCING OF INTERESTS, WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED. HOWEVER, WE RESERVE THE RIGHT TO FURTHER PROCESSING IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENSE OF LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING. YOU MAY EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

15) Duration of Storage of Personal Data

The duration of the storage of personal data is based on the respective legal basis, the purpose of processing and, where relevant, the respective statutory retention period (e.g. commercial and tax retention periods).

If personal data is processed on the basis of express consent pursuant to Art. 6 (1) point a GDPR, the data concerned is stored until you revoke your consent.

If there are statutory retention periods for data processed within the framework of legal or quasi-legal obligations on the basis of Art. 6 (1) point b GDPR, this data is routinely deleted after the retention periods have expired, provided it is no longer necessary for the performance or initiation of the contract and/or we no longer have a legitimate interest in its continued storage.

If personal data is processed on the basis of Art. 6 (1) point f GDPR, this data is stored until you exercise your right to object pursuant to Art. 21 (1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

If personal data is processed for the purpose of direct marketing on the basis of Art. 6 (1) point f GDPR, this data is stored until you exercise your right to object pursuant to Art. 21 (2) GDPR.

Unless otherwise stated in the information in this declaration on specific processing situations, stored personal data is otherwise deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.

Copyright notice: The German original of this privacy policy was created by the specialist lawyers of IT-Recht Kanzlei and is protected by copyright (https://www.it-recht-kanzlei.de). This English version is our own translation.

Version: 26.10.2026, 23:25:57

Additional Information on the FlowGlow Studio App

The following sections supplement the privacy policy above. They describe functions that concern only the FlowGlow Studio app and FlowGlow lamps.

Other Service Providers and Server Locations

Supabase (section 4.1) runs our database and the app's server functions in a data center in Paris (France). For data transfers to the USA, Supabase has agreed the European Commission's Standard Contractual Clauses with us.

We also use the following service providers, each under a data processing agreement:

Fly.io, Inc., Chicago, USA: runs the service in Frankfurt am Main that relays commands between our servers and your lamps. For data transfers to the USA, the provider participates in the EU-US Data Privacy Framework.
84codes AB, Stockholm, Sweden (CloudAMQP): runs the message server that connects your lamps to our servers, on servers in Ireland.
Hetzner Online GmbH, Gunzenhausen, Germany: hosts app.getflowglow.com, the page you return to after linking Amazon Alexa. The server processes your IP address when you open it.

Setting Up a Lamp: Bluetooth and Wi-Fi

You set up a new lamp in the app via Bluetooth. On Android 11 and older, the operating system requires the location permission for this, because scanning for Bluetooth devices is tied to it there. We do not determine or store your location. When you control a lamp via Bluetooth, commands go directly from your phone to the lamp, not through our servers.

If you connect the lamp to your Wi-Fi, it scans for nearby networks and the app shows you their names. The app sends the name of the network you choose and its password directly to the lamp via Bluetooth, encrypted if the lamp runs current firmware. We do not pass either on to our servers or to third parties. Only if you choose “Remember for my next lamps” does the app store the password, encrypted, on your phone.

When you add the lamp to your account, we store its device identifier (MAC address), the name you give it, its device type and its firmware version, and link the lamp to your account. We also log the public IP address through which your phone and your lamp complete the setup. The legal basis is Art. 6 (1) point b GDPR, and for the log Art. 6 (1) point f GDPR, based on our legitimate interest in detecting misuse during setup.

Cloud Control

Once your lamp is connected to Wi-Fi, you can control it over the internet, use schedules and connect voice assistants. For this, the lamp keeps a connection to our message server. A command from the app travels through our servers and the message server to the lamp, which confirms receipt.

While it is connected, the lamp reports its state to us: whether it is on, its brightness, color, effect and color palette, whether it reacts to music, its firmware version, its Wi-Fi signal strength and its temperature, and at regular intervals technical values such as uptime and free memory. It sends this report on every change, including when you operate it via Bluetooth, the remote control or its button. If the lamp crashes, it sends an error report with technical details of the crash, a short excerpt from its internal log and the last command it ran. After a firmware update, it reports whether the update succeeded.

The lamp's microphone is only there so that effects can react to music. The lamp analyzes the sound itself. It does not send us audio recordings or volume levels.

For schedules based on sunrise or sunset, we store your phone's time zone in your account and calculate the times for a fixed location in that time zone. We do not collect your location.

We store:

the current state of each lamp,
commands, in a command log for 90 days,
state reports and events such as the setup, the regular renewal of the lamp's access credentials or sent commands, each with its source (app, schedule, Alexa, Google Home) and the IP address transmitted with it, in an event log for 180 days,
regular snapshots of state and signal strength, for 90 days,
error reports, for 365 days,
logs of your schedules running, for 90 days,
for reliability statistics, the type, source, status and time of each command, for at most as long as your account exists,
records of firmware updates, for the lifetime of the lamp.

The legal basis is Art. 6 (1) point b GDPR insofar as the processing is necessary for cloud control. We keep the logs, error reports and statistics on the basis of Art. 6 (1) point f GDPR; our legitimate interest lies in stable and secure operation and in troubleshooting. If you delete your account, we unlink your lamps from it.

Voice Control with Amazon Alexa and Google Home

You can control your FlowGlow lamps with the voice assistants Amazon Alexa and Google Assistant (Google Home). To do this, link your FlowGlow account in the Alexa app or the Google Home app. The providers are:

Amazon Alexa: Amazon Europe Core S.à r.l., 5 Rue Plaetis, L-2338 Luxembourg
Google Home / Google Assistant: Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

Data may also be transferred to Amazon.com Services LLC, USA, and Google LLC, USA.

When you link your account, you sign in with your FlowGlow account. The provider then receives an access token (OAuth 2.0) that lets it control your lamps. We do not share your FlowGlow password with the provider.

While the link is active, we send the provider: a pseudonymous identifier of your FlowGlow account (Google Home only); the list of your lamps (a technical device ID, the name you gave the lamp in the FlowGlow Studio app, the device type and the functions it supports, including the effect names); and the current state of each lamp (on or off, brightness, color, effect, whether it reacts to music, whether it can be reached, and for Alexa also the effect speed). We send the state when the provider requests it or sends a command.

When you give a command (for example “turn on”, a brightness level or a color), the provider passes it to us with a request ID, and we forward it to your lamp. We keep the command in our command log, and its source (Alexa or Google Home) and the request ID in our event log, to provide the service and to find errors; how long we keep them is set out under “Cloud Control”. Your voice is processed by the provider under its own privacy policy; we do not receive voice recordings.

The legal basis is Art. 6 (1) point b GDPR, as the processing is necessary to provide the voice control you have requested.

You can unlink at any time in the Alexa app or the Google Home app; after that, we no longer exchange data with the provider. If you unlink in the Google Home app, we revoke the access token immediately. For Alexa, you can also revoke access in the FlowGlow Studio app under Profile → Settings → Smart home.

For data transfers to the USA, the providers participate in the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.

Amazon's privacy notice: https://www.amazon.de/gp/help/customer/display.html?nodeId=201909010

Google's privacy policy: https://policies.google.com/privacy

Signing In with Apple or Google

If you sign in with Apple or Google (section 2), we receive from Apple your name (only on the first sign-in) and your e-mail address or, if you choose “Hide My Email”, a forwarding address from Apple. From Google, we receive your name, your e-mail address and the address of your profile picture. From both providers, we also receive a user ID. We use this data only to create your account and sign you in; we do not display your profile picture. We do not request any further information, and we do not transfer any data to your account with the provider. If you delete your account, we also revoke the app's access to your Apple or Google account.

Public Name, Community and Leaderboards

To publish Flows, add friends or appear on the leaderboards, you choose a public name. We never show your real name or your e-mail address to others.

Anyone can see published Flows, even without an account: the Flow's name and description, its settings, your public name, your status, a random identifier of your account, and how often the Flow has been downloaded and marked with a Spark. Once you have published at least one Flow, your public profile shows your public name, your status, when you joined and the numbers for your Flows. Others cannot see who marked a Flow with a Spark or downloaded it.

On the leaderboards, signed-in users see your rank, your public name and your FlowPoints for the week, the month or all time, and, if you refer friends, the number of your successful referrals in the current month. Without a public name, you do not appear there.

The legal basis is Art. 6 (1) point b GDPR. If you delete your account, your published Flows stay in the library without your public name. Copies that other users have saved still show the name under which you published the Flow.

FlowPoints and Referrals

You earn FlowPoints for actions in the app, such as setting up a lamp, publishing Flows or successful referrals. For this, we keep a points account with the individual entries, your status and your badges; only you can see them. You can redeem FlowPoints for a discount code for our shop. Shopify receives only the code and its value, no information about you.

With your personal referral code, you can recommend FlowGlow. If someone orders with your code, you see the date, the status of the referral and your reward, which depends on the order value. You do not receive buyers' names or e-mail addresses. Likewise, if you order with someone else's code, that person learns that an order was placed with their code, when, and what the order value was. So that each lamp triggers a reward only once, we store for each lamp that has been set up whether a reward has already been paid for it.

The legal basis is Art. 6 (1) point b GDPR. We keep redeemed rewards and manual corrections for commercial and tax law reasons (Section 257 of the German Commercial Code, HGB; Section 147 of the German Fiscal Code, AO); after an account deletion, without any link to your account. Which lamps a reward has been paid for also remains after an account deletion. After an account deletion, we keep referrals in pseudonymized form for up to 18 months after payment, so that we can match refunds and detect misuse (Art. 6 (1) point f GDPR).

Light Greetings (Lichtgruß)

With light greetings, you connect with friends and send each other greetings that briefly light up on the other person's lamps. A connection only exists once the other person accepts your invitation; invitation codes are valid for 30 days. You join a group when the person who manages the group approves.

People you are connected with and members of your groups see your public name, your signature color and the settings of your signature Flow; group members also see when you joined. For each light greeting, we store the sender, the recipients, the time and your optional note (up to 120 characters). Only you and the recipients see the note; it is not sent to the lamp. The recipients receive a push notification with your public name, your signature color and your note. If you plan rituals, we store the target, effect, note and time; we delete one-time rituals once they have been sent, and recurring ones when you remove them.

Light greetings remain stored as your “Moments” until you remove the connection, leave or delete the group, or one of the two people deletes their account. The legal basis is Art. 6 (1) point b GDPR.

Push Notifications: Addition to Section 11

On iOS devices too, we send push notifications via Firebase Cloud Messaging (Google); Google forwards them to the Apple Push Notification service. We send notifications about your Flows, the Flow of the week, your status, light greetings and referral rewards. We do not send product advertising by push. We delete your push token when you sign out, when Google reports it as invalid, or when you delete your account.

Analytics: Giving and Withdrawing Consent

You give or withdraw your consent to Google Analytics for Firebase (section 13) in the app under Profile → Settings → Your Data. After you withdraw, we collect nothing further, delete the analytics data on your phone and assign a new app-instance ID. We do not collect an advertising ID.

Shop

The app opens the FlowGlow shop in your phone's browser. The privacy policy of our website applies there, including for cookies and orders.

Deleting Your Account, a Copy of Your Data, and Backups

You can delete your account in the app under Profile: tap your name at the top, then “Delete account”. The deletion takes effect immediately. Without access to the app, you can also request it by e-mail (here is how). What remains after a deletion is described in the sections above: published Flows without your name; redeemed rewards, referrals and rewards for set-up lamps, without any link to your account; and your orders in the shop.

You can request a copy of your data (Art. 15 and 20 GDPR) at privacy@getflowglow.com. We reply to the e-mail address of your account and send you a file in JSON format.

Our database is backed up regularly. Backups cannot be changed afterwards; deleted data may remain in them for up to 30 days. If we restore a backup, we carry out the deletions from that period again.

Children

The FlowGlow Studio app is not directed at children under 16, and we do not knowingly collect their data.