Last updated: March 2026
Flohly ("we", "us", "our") is a UK-based software-as-a-service (SaaS) business providing AI-powered automation services to small and medium-sized businesses. For the purposes of UK data protection law, Flohly is the data controller in respect of personal data we collect about our customers and their contacts.
You can contact us at: hello@flohly.com
This Privacy Policy explains how we collect, use, store, share, and protect personal data when you:
This Policy applies to personal data about:
If you are a customer using Flohly Voice to process voicemails, please also read Section 9 (Third-Party Caller Data), which sets out your own data protection responsibilities.
When you register for or use our services, we may collect:
When you visit our website, we may collect:
We do not currently use cookies for tracking or advertising purposes. If this changes, we will update this Policy and, where required, obtain your consent.
In the course of providing Flohly Voice, we process:
This data is processed on your behalf as your data processor. It is retained only until the next daily digest email has been produced and delivered, after which it is deleted from our systems.
We use personal data for the following purposes:
We rely on the following legal bases under UK GDPR:
We retain personal data only for as long as necessary for the purposes set out in this Policy:
We use a small number of trusted third-party subprocessors to help us deliver our services. Each subprocessor is bound by contractual obligations to protect your data.
| Subprocessor | Purpose | Data Processed | Location |
|---|---|---|---|
| Stripe, Inc. | Payment processing and recurring subscription billing | Customer name, email address, payment card details, billing address | USA/EU — transfer covered by processor's standard DPA and SCCs |
| OpenAI, LLC | AI transcription (Whisper) and message analysis (GPT-4o-mini) | Voicemail audio, transcribed text | USA — transfer covered by processor's standard DPA and SCCs |
| Supabase Inc. | Database — temporary storage of transcripts and customer account data | Transcripts, customer account data | EU West (Ireland) — no international transfer |
| Resend Inc. | Transactional email delivery | Email address, voicemail summary content | USA — transfer covered by processor's standard DPA and SCCs |
| Railway Corp. | Cloud infrastructure and application hosting | Application data processed in the course of running the Flohly backend service | USA — transfer covered by processor's standard DPA and SCCs |
Where subprocessors are based outside the UK or EEA, we rely on the data transfer safeguards incorporated into each processor's standard terms of service and Data Processing Agreement (DPA). In practice, this means we rely on Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA), as included in the standard terms of each provider.
Please note that Flohly Voice also requires you to hold your own account with Twilio Inc., a telephony provider through which your voicemail recordings are received and delivered to us for processing. Twilio is your service provider, not ours — you contract with Twilio directly and are responsible for your own Twilio account.
We may also share personal data:
We do not sell, rent, or share personal data with third parties for their own marketing purposes.
Some of our subprocessors are based in the United States. Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place to protect that data, in accordance with UK GDPR requirements. This currently includes reliance on Standard Contractual Clauses (UK SCCs or the International Data Transfer Agreement, as applicable).
Where you use Flohly Voice, the voicemails you receive will contain personal data about third-party callers (such as their name, phone number, and the content of their message). You are the data controller in respect of this data.
As a data controller, it is your responsibility to:
Flohly processes Third-Party Caller Data solely on your instructions and as your data processor, in accordance with these obligations and the terms of our Data Processing Agreement. If you require a Data Processing Agreement, please contact us at hello@flohly.com.
We strongly recommend you seek independent legal advice if you are unsure of your obligations in this area.
We take the security of personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, or disclosure. These include:
No system is completely secure. If you become aware of a potential security incident relating to our services, please contact us immediately at hello@flohly.com.
Under UK data protection law, you have the following rights in relation to your personal data:
To exercise any of these rights, please contact us at hello@flohly.com. We will respond within one calendar month. We may need to verify your identity before fulfilling a request.
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data practices. We will notify you of material changes by email and will update the "Last updated" date at the top of this document. We encourage you to review this Policy periodically.
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us: