Privacy Statement

Ezyflow is provided by EzyFlow.ai B.V., registered in the Netherlands under Chamber of Commerce (KvK) number 91433398. This Privacy Statement explains what personal data may be processed in connection with the Ezyflow service, why, and what rights and responsibilities apply.

It describes data processing. It is not a description of how Ezyflow is technically built.

Generally, when a customer submits or routes personal data into Ezyflow for the customer's own business purposes, the customer acts as controller and Ezyflow processes that information on the customer's behalf. Depending on the circumstances, other arrangements may apply.

Ezyflow typically acts as an independent controller for the limited processing it performs for its own purposes, such as account administration, commercial administration, billing, security, fraud prevention, support administration and legal compliance.

• Account and user data, such as name, business email address and access rights.
• Organization and subscription data, including commercial and billing administration.
• Dossier content, including fields, interpreted values, Items and Issues.
• Email data, including sender and recipient addresses, subject, message body, attachments, technical headers, message identifiers and delivery metadata.
• WhatsApp data, including telephone numbers, WhatsApp identifiers, sender and participant information, group or conversation identifiers, message content, timestamps, media, attachments, message identifiers and technical delivery information.
• Documents and attachments, extracted document text and document metadata.
• Technical and usage data, such as log data needed for security and operation.

Business communications and documents processed through Ezyflow may contain personal data. Where relevant to the requested dossier processing, such personal data may therefore also be processed by the cloud, AI, email, messaging or other technical service providers used by Ezyflow.

Business communications can incidentally contain sensitive or special-category personal data. Customers should avoid submitting special-category or other highly sensitive personal data where such information is not necessary for the relevant business process, and remain responsible for ensuring an appropriate legal basis and safeguards where such data is processed.

• To provide the Service and maintain each dossier's current state.
• To receive, store and interpret communications and documents.
• To identify evidence and link information to its source.
• To identify potential Items and Issues.
• To provide internal and external views of a dossier.
• To administer accounts, subscriptions and billing.
• To secure the Service, prevent misuse and comply with legal obligations.

Ezyflow uses AI services hosted on enterprise cloud infrastructure to assist with extracting, structuring, interpreting and maintaining information in a dossier. The underlying AI models and technical configuration may change over time.

Where relevant to dossier processing, the information processed by AI may include:

• email content and WhatsApp communication;
• sender and participant information, subjects and timestamps;
• attachments, documents, extracted document text and document metadata;
• relevant existing dossier context, template structure and field definitions;
• evidence references, Items and Issues;
• other context reasonably required to interpret new or changed evidence.

This processing is performed to:

• extract and structure information;
• interpret communications in dossier context;
• classify documents and identify relevant evidence;
• link information to evidence and detect inconsistencies;
• update dossier information and identify potential Items and Issues;
• produce structured summaries where applicable.

Ezyflow is designed to process only the information reasonably required for the relevant dossier operation. In normal incremental processing, this generally consists of new or changed evidence together with the existing dossier context reasonably required to interpret that evidence.

Additional historical information may be processed where necessary, including during reprocessing, correction of inconsistent information, resolution of an Issue, template changes, integrity checks or other exceptional processing operations.

Inference. Customer data may be processed by AI services to perform the requested Ezyflow functionality.

Model training. Ezyflow does not intentionally combine customer communications and documents into a shared Ezyflow foundation-model training dataset.

Provider security and abuse processing. Infrastructure and AI providers may use automated mechanisms for security, abuse detection, misuse prevention and policy enforcement, and limited authorised provider personnel may in defined circumstances obtain access to flagged information. Ezyflow cannot independently guarantee the internal processing of such providers beyond its contractual arrangements with them.

Interpreted values, dates, amounts, status information, summaries, document classifications, evidence relationships, Items, Issues and detected inconsistencies are interpretations, not statements of objective truth.

• AI can make mistakes.
• Extracted information can be incomplete or incorrect.
• Evidence identifies the source supporting an interpretation.
• Evidence does not prove that the underlying statement is objectively true.
• Unsupported information may remain unknown or uncertain.
• Conflicting information may be surfaced rather than silently resolved.
• Materially important decisions should receive appropriate human review.

If a communication states that payment has been made, that communication is evidence that the sender reported payment. It does not by itself prove that the payment was actually received.

Ezyflow uses carefully selected third-party service providers to operate the Service, including providers of cloud infrastructure, AI processing, email delivery, messaging connectivity, storage and document processing, and security, monitoring and operational services. These providers may process personal data only to the extent necessary for the relevant service and subject to applicable contractual and data-protection requirements.

The specific providers used may change over time. Where required under applicable data-protection law, current subprocessor information — including provider identity, purpose, relevant categories of personal data, relevant processing geography and applicable transfer safeguards — is made available to customers through the applicable data-processing documentation.

Where email is used to send information into or out of a dossier, email delivery and processing providers may process sender and recipient addresses, message subject, message body, attachments, technical headers, message identifiers and delivery or webhook status information.

When WhatsApp connectivity is enabled, WhatsApp communications may pass through third-party messaging connectivity infrastructure before being received and processed by Ezyflow.

Data processed in that context may include telephone numbers, WhatsApp identifiers, sender and participant information, group or conversation identifiers, message content, timestamps, media and attachments, message identifiers and technical delivery information.

The providers used for messaging connectivity may change over time. Current subprocessor information is made available to customers where required under applicable data-protection law.

Some service providers used by Ezyflow may process personal data outside the European Economic Area. Where such processing constitutes an international transfer under applicable data-protection law, Ezyflow uses the contractual or other transfer mechanisms applicable to the relevant processing, such as adequacy decisions, Standard Contractual Clauses or other legally recognised safeguards.

The location in which data is processed may depend on the infrastructure, service and configuration used for the relevant processing activity. Further information about relevant subprocessors and international processing is available to customers through Ezyflow's applicable data-processing documentation.

Where Ezyflow processes personal data on behalf of a customer, the customer determines the legal basis for that processing. Where Ezyflow processes personal data for its own purposes, it relies on the performance of a contract, compliance with a legal obligation, or its legitimate interests in operating, securing and improving the Service and administering the commercial relationship.

Customers are responsible for determining whether their use of Ezyflow is appropriate for their organisation, data, legal obligations and intended business process, and must ensure that they have an appropriate legal basis and other required rights to provide personal data and business communications to Ezyflow for processing.

Current dossier state. A dossier holds the currently interpreted state of the case, project or file it represents.

Source and historical evidence. Communications and documents may be retained as historical evidence in accordance with the customer's use of the Service, applicable settings, contractual requirements and retention obligations. Correcting a current interpreted value does not necessarily require altering a historically accurate source communication: a delivery date first reported as 20 November and later changed to 23 November leaves the dossier showing 23 November while the earlier communication remains part of the historical evidence.

Service-provider technical data. Some technical providers may temporarily process or retain operational data according to the relevant service and contractual arrangements.

Ezyflow applies appropriate technical and organisational measures, including access control, authentication, encryption where appropriate, segregation of customer data where applicable, logging and monitoring, backup and recovery measures where applicable, vulnerability and security management, and restricted personnel access.

Individuals have the right to request access to their personal data, and to request rectification, erasure, restriction of processing, data portability, or to object to processing, subject to the conditions of applicable data-protection law.

Where Ezyflow processes personal data on behalf of a customer, requests are normally directed to that customer as controller. Ezyflow supports its customers in responding to such requests.

Individuals in the Netherlands may also lodge a complaint with the Autoriteit Persoonsgegevens, or with their local supervisory authority.

This Privacy Statement and the Terms & Conditions do not replace a Data Processing Agreement. Where Ezyflow acts as processor, a Data Processing Agreement governs that processing and gives customers access to the subprocessor information they need for their own obligations.

The Ezyflow website and application use only the cookies and comparable technologies necessary to provide the site and keep users signed in securely. No advertising or cross-site tracking cookies are used.

This Privacy Statement may be updated to reflect changes to the Service, our providers or applicable law. The date of the most recent version is shown at the top of this page.

EzyFlow.ai B.V., KvK 91433398, the Netherlands. support@ezyflow.ai