Privacy Policy

Blixtgo Agency AB, Swedish company registration number 559069-9038, Drottninggatan 6A, 212 11 Malmö, Sweden, provides the Blixtflow service and the website blixtflow.com. We are the controller for the processing described in this policy.

Send data protection questions to hello@blixtflow.com. We normally reply within a week and at the latest within one month.

It is important to distinguish between two situations:

• We are the controller for data about website visitors, people who contact us, our customers’ contact persons and Users (for example account, login, invoicing and support), and for how our own service works and is protected.
• We are a processor when a business uses Blixtflow to communicate with its customers. If you have emailed, chatted, called or texted a business that uses Blixtflow, that business is the controller of your data. We only process it on the business’s instructions and under our data processing agreement. To exercise your rights in that case, please contact the business first – we will gladly help it respond to you.

We do not collect location data, contacts from your phone or sensitive personal data (such as health data) for our own purposes.

Where we rely on legitimate interest, we have balanced our interest against your privacy and found that ours prevails. You have the right to object – see the section on your rights.

When businesses use Blixtflow, the data processed includes email, chat messages, SMS, messages via WhatsApp, Messenger and Instagram, calls with recordings and transcripts, contact details, orders, bookings and attachments. The business decides which channels are connected and how long data is kept.

We process this data only as a processor, under the data processing agreement. We do not look at the content except where needed to resolve a support request the customer has asked for, and then through a logged support mode.

Blixtflow has AI features such as the AI receptionist, the chatbot, suggested replies and summaries. For these:

• Personal identity numbers, card numbers and IBANs are masked automatically before text is sent to the AI service.
• Data sent for AI processing is used only to produce the response for the customer – not to train general AI models, neither by us nor by our AI providers.
• The AI makes no decisions with legal or similarly significant effects for you (Art. 22 GDPR).
• Businesses using the AI receptionist or chatbot must tell their customers that they are talking to an AI.

If you connect your Google Calendar to Blixtflow, Blixtflow gets access – with your explicit approval through Google sign-in – to the data covered by the permissions below, and nothing else. Blixtflow uses Google APIs for Google Calendar only.

What we access and why

• Calendar events (calendar.events) in the calendar you choose – to create, move and cancel the meetings booked in Blixtflow (from a conversation or by the AI receptionist) and show your existing events next to them.
• The list of your calendars (calendar.calendarlist.readonly) – so that you can choose which calendar Blixtflow should use.
• Free or busy (calendar.freebusy) – so that no meetings are double-booked. Only the times are read, never what the events contain.
• The account’s email address (openid, email) – to show which Google account is connected.

Gmail as an email channel: a business can connect a Gmail address as an email channel in the inbox. This is done with the address’s own mail settings (IMAP and SMTP with an app password that the business creates at Google) – not through Google APIs and not through the sign-in above. Such email is processed like all other email in the Service, see Data in our customers’ conversations.

How we use, store and share the data

• The data is used only to provide the calendar features in Blixtflow that you see and use.
• Events retrieved from Google are not stored in Blixtflow. They are kept in a short cache (at most 90 seconds) while the calendar is displayed. What is stored are the meetings booked in Blixtflow and their ID at Google, so that changes can be mirrored both ways.
• Access tokens are stored encrypted.
• The data is not shared with third parties, except with the subprocessors needed to run the Service, when required by law, or with your explicit consent.
• It is never used for advertising, never sold and not used to train general AI or machine-learning models.
• No human reads the data, except when you have explicitly asked us to (for example in a support case), when needed for security reasons, or to comply with the law.

Blixtflow’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google Calendar at any time in Blixtflow under Integrations → Google Calendar (or in the calendar settings), or remove Blixtflow’s access at myaccount.google.com/permissions. When you disconnect in Blixtflow, the access is revoked at Google, the tokens are deleted immediately and the cache is cleared. Meetings booked in Blixtflow remain in Blixtflow and in your calendar but are no longer mirrored.

If a business connects a Facebook Page, an Instagram account or WhatsApp Business to Blixtflow, we process messages, comments, the sender’s name and profile picture, and images and attachments, so that they can be shown and answered in the inbox. If the business publishes posts through Blixtflow, text and images are sent to Meta for publication.

The data is used only to provide these features. The business can disconnect the account in Blixtflow or in Meta’s settings. Instructions for deleting data are in the section Delete your data.

If a business connects its Fortnox account to Blixtflow, we receive, after approval in Fortnox’s own sign-in, access to company information (the company name and registration number), customers (search, view and create customers) and invoices (view invoices and invoice PDFs and create draft invoices). We do not read bookkeeping, payroll, supplier invoices or bank details.

The data is retrieved when an agent opens a ticket, to show the customer the ticket is about and that customer’s invoices. It is cached, encrypted, for at most five minutes. Only the link between a contact and the Fortnox customer number is stored permanently, plus an internal note when an agent creates a customer or a draft invoice. The keys from Fortnox are stored encrypted. The data is used only to provide the feature to the business that connected the account, is never sold and is not used for advertising or to train AI models. The business disconnects under Integrations → Fortnox, and the keys are then deleted immediately.

If a business connects its Spiris account (Bookkeeping & Invoicing) to Blixtflow, we receive, after approval in Spiris’s own sign-in, access to sales: the company name and registration number, customers (search, view and create customers), customer invoices (view invoices and invoice PDFs) and draft invoices. We do not read bookkeeping, payroll, supplier invoices or bank details.

The data is retrieved when an agent opens a ticket, to show the customer the ticket is about and that customer’s invoices. It is cached, encrypted, for at most five minutes. Only the link between a contact and the Spiris customer is stored permanently, plus an internal note when an agent creates a customer or a draft invoice. The keys from Spiris are stored encrypted. The data is used only to provide the feature to the business that connected the account, is never sold and is not used for advertising or to train AI models. The business disconnects under Integrations → Spiris, and the keys are then deleted immediately.

The mobile app collects no statistics and contains no trackers. When you sign in, the device name, model, platform and app version are sent to us so that you can see and sign out your devices. If you allow notifications, a push token is created and used to deliver notifications via Expo and Apple (iPhone) or Google (Android). Notification content can be hidden on the lock screen.

Your sign-in is stored encrypted in the phone’s secure storage and data cached for offline use is encrypted. Everything is removed from the phone when you sign out. The app only asks for camera and photos when you want to attach a file.

We never sell personal data. We only share it when needed:

• Subprocessors that help us run the Service, such as hosting, email, SMS, notifications and AI. The current list is on the Subprocessors page. All are bound by agreements that protect the data.
• Services you connect yourself, such as Google, Microsoft, Meta, Fortnox or an online store. Their terms and privacy policies then also apply.
• Authorities and others when required by law, or to establish, exercise or defend legal claims.
• In a business transfer to a buyer who continues to process the data under this policy.

We aim to process personal data within the EU/EEA. Some subprocessors may process data in countries outside the EU/EEA, such as the United States. In that case we make sure the transfer is lawful through an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework for certified companies) or the European Commission’s standard contractual clauses, supplemented by additional safeguards where needed. The Subprocessors page shows where each subprocessor processes data and which safeguard applies.

• Encrypted transfer (HTTPS/TLS) and encryption of keys and attachments.
• Passwords are stored with Argon2id and login tokens only as hashes.
• Two-step verification, lockout after repeated failed logins and sign-out after inactivity.
• Role-based access, private channels and full isolation between different businesses’ data.
• Email is displayed in isolation and tracking pixels are blocked by default.
• Playback of call recordings is logged.

If a personal data breach that may pose a risk to you still occurs, we report it to the Swedish Authority for Privacy Protection within 72 hours and inform you when required.

Under the GDPR you have the right to

• access your data,
• rectify inaccurate data,
• erase data (“the right to be forgotten”) when it is no longer needed or the processing lacks a legal basis,
• restrict processing, for example while an objection is being assessed,
• object to processing based on legitimate interest, and always to direct marketing,
• data portability – receive data you have provided in a machine-readable format, and
• withdraw consent where processing is based on consent, without affecting processing that has already taken place.

Send your request to hello@blixtflow.com. We may need to verify your identity. We reply within one month; in complex cases this may be extended by two further months, and we will tell you if so.

This is how to have your data deleted:

• Blixtflow users: sign in and choose Account → Delete account (in the app: More → Security → Delete account). Your account and personal data are deleted. Conversations you worked on belong to your company and remain with the company.
• Businesses (customers): an administrator can cancel the subscription and request deletion of the whole workspace. Data is deleted no later than 30 days after the agreement ends.
• Connected Google Calendar: disconnect it under Integrations → Google Calendar. Access is revoked and the tokens are deleted immediately – events from Google are never stored in Blixtflow.
• Connected Meta accounts (Facebook, Instagram, WhatsApp) and email channels: disconnect them under Settings → Channels. Retrieved data is deleted within 30 days, unless the business has chosen to keep the conversation history.
• Connected Fortnox account: disconnect it under Integrations → Fortnox. The keys and cached data are deleted immediately. Links between contacts and Fortnox customers are deleted when the workspace is deleted.
• If you contacted a business that uses Blixtflow: contact the business, which is responsible for your data. You can also write to us and we will forward your request.
• Everyone else: email hello@blixtflow.com with the subject “Delete my data” and state the email address or phone number concerned.

We confirm the deletion within 30 days. Data we are legally required to keep, such as bookkeeping records, is deleted when the retention period has ended.

On the blixtflow.com website we use analytics and marketing tools – but only if you accept them in the cookie banner (legal basis: consent, Art. 6(1)(a) GDPR). You can withdraw your consent at any time. The service itself only uses necessary cookies. The tools are listed in our cookie policy.

Visitor statistics without cookies – only with your consent: if you accept statistics in the cookie banner, the website counts its own visits – which pages are viewed, where the visitor came from, the page language, approximate country (from the browser’s time zone), device type and how long the page was viewed. No cookies are set and no IP address is stored. The same visitor is recognised for at most one day with an anonymous code that changes every night and cannot be traced back to you. Nothing is sent to third parties. If you say no, your visit is not counted at all. If you have Do Not Track or Global Privacy Control turned on, your visit is not counted either.

Proof of your choice: every choice in the cookie banner is stored with us together with a random consent ID (shown in your cookie settings), the time, what you chose, the banner version, the page and the browser type – no IP address, no name. This is how we can demonstrate that consent was given (GDPR Art. 7(1)). The records are deleted after 24 months.

Blixtflow is a service for businesses and is not directed at children. We do not knowingly collect personal data about children under 16 for our own purposes.

If you are unhappy, please contact us first and we will try to resolve it. You always have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), Box 8114, SE-104 20 Stockholm, Sweden, www.imy.se, or with the data protection authority in the EU country where you live or work.

We update the policy when our processing changes or the law requires it. The date and version are shown at the top. For material changes, we inform customers and Users by email or in the Service before the change takes effect.