Privacybeleid | Fire & Flow

Privacy Policy

Fire & Flow (our “Website” and related product, including the Fire & Flow browser extension and associated application services) is owned by Monto (“we”, “us”), which acts as the data controller for personal data processed via https://fireandflow.be and when you use the Fire & Flow software and services described in this policy. We respect your privacy and process personal data in accordance with the General Data Protection Regulation (GDPR).

1. Who We Are

Fire & Flow (Monto)
Email: winthe@fireandflow.be

2. Personal Data We Collect

We may collect:

Contact data: name, email address, and information you submit via forms
Scheduling data: when booking meetings via Calendly
Device & usage data: IP address, browser, device, pages visited, referral source
Marketing interaction data: interaction with Instagram advertisements
Cookies: required for website and third-party functionality

We do not intentionally collect sensitive personal data.

When you use the Fire & Flow Product, Chrome extension and our application (backend) services, we may also process:

Account and authentication data: for example, your email address, a user identifier, and related account information when you sign in (including through Google).
Connection and product metadata: for example, extension version, install/last-activity timing, and whether certain companion or integration features are in use, as needed to operate the product.
Product usage and analytics data: for example, product interaction events (such as feature usage and flows), associated technical metadata our app attaches to those events, session identifiers where used, and which part of the product the interaction came from.
Energy-related inputs you provide in the product: for example, self-reported energy check-ins, how you label meetings or time blocks, objectives you define, and similar inputs you choose to save.
Product-generated guidance: for example, in-product insights, summaries, or suggestions derived from your usage and inputs.
Notes and feedback you add in the product: for example, free-text reflections or similar fields you save, and in-product survey responses.
Satisfaction and research data: for example, Net Promoter Style scores and optional written comments, where we prompt you.
Feature feedback and support content: for example, suggestions, reports, and descriptions you submit through in-product feedback, including optional community-visible content where that feature is available (see also section 3).
Calendar-related data processed through Google integrations: to provide calendar-based features, we may process identifiers and metadata associated with your calendar, such as event identifiers, event timing, calendar identifiers, attendee information, and, where applicable, event titles or similar fields supplied by the calendar, as well as rules you configure in the app (for example, keywords, attendees) where those features are offered.
We do not intentionally collect sensitive categories of personal data as defined under GDPR. Energy or mood self-assessments in the app are optional productivity inputs you choose to provide; they are not intended to be medical, diagnostic, or health care data.

We do not intentionally collect sensitive personal data in the original sense of that statement above.

3. How & Why We Process Your Data

We process personal data only where legally permitted and only for the following purposes:

To operate, secure, and improve the website (legitimate interest)
To respond to messages or form submissions (consent)
To send information or updates if you request them (consent)
To schedule meetings via Calendly (consent)

Providing personal data is optional, but some website features may not be available without it.

In addition, we process personal data for the Fire & Flow product, including:

To provide and secure the extension and related services, authenticate you, and keep sessions and integrations working (contract; and, where applicable, steps taken at your request before entering a contract; and legitimate interest in security and abuse prevention)
To synchronise and display your calendar-related information and in-product data across devices and sessions, where you connect Google or use those features (contract)
To generate and show in-product insights, objectives, energy-related views, and similar functionality based on the data the product is designed to use (contract; and legitimate interest in delivering and improving the service, where applicable)
To analyse how the product is used in aggregate and at a per-account level, to understand adoption, performance, and product quality (legitimate interest; and, where required, your consent for non-essential analytics—if you implement separate consent, describe it in your UI and, if you use a cookie/tracking banner for the site, only link what actually applies)
To administer optional surveys (such as NPS) and in-product feedback (legitimate interest and/or consent, depending on the mechanism you use)
Where you use community or public-by-design feedback features, to show certain submissions (for example, text and feature area) to other signed-in users, as the feature is designed (consent and/or contract, depending on how you present it; be sure your in-product wording matches)

Providing personal data is optional in many cases, but some website and product features may not be available without it (for example, sign-in, sync, or calendar-based features).

4. Hosting & Infrastructure

Our website and form data are hosted by Hostinger, which processes data on our behalf to ensure website functionality, security, and performance.
Automatically collected data is used only to prevent abuse and generate anonymous usage statistics.

Application data for the Fire & Flow product (including accounts, product databases, and related processing) is hosted and processed using Supabase (and its infrastructure), which provides database, authentication, and related services on our behalf. Supabase processes this data to operate the extension, store your in-product information, and run application logic.

5. Marketing

We use Instagram advertising services provided by Meta Platforms, Inc. to direct visitors to our website.
Meta processes ad interaction data under its own privacy policy. Fire & Flow only receives personal data when you voluntarily submit it on our website.

6. Scheduling

We use Calendly (Calendly, LLC) to allow visitors to book meetings.
When you book a meeting:

Calendly collects personal data such as your name and email address
Calendly may place cookies on your device (including when embedded on our site)
Data may be processed outside the EEA (including the United States)

Calendly acts as a data processor under GDPR-compliant terms.

7. Use of Artificial Intelligence

Submitted data may be processed using LLMs (like Claude or Gemini) for internal analysis or communication support.

Your data is not used to train or improve AI models
Data is processed confidentially and only for the intended purpose
OpenAI acts as a data processor under applicable safeguards

For the Fire & Flow product, we can leverage Google Gemini to generate break suggestions and insights from your event titles and energy tags. We do not use other LLMs to process your Fire & Flow product data (such as calendar or energy data) by default; the above primarily concerns submissions and communications (for example, website or business enquiries) and internal analysis, as applicable.

8. Internal Processing

Personal data may be stored and processed within Google Workspace for internal communication and documentation.

Sign-in and Google services: When you use Google to sign in to the Fire & Flow product or to connect Google Calendar, Google processes information in accordance with Google’s terms and privacy policy, and we receive the data needed to provide authentication and calendar features (such as account identifiers, email, and calendar content permitted by the permissions you grant).

9. Data Retention

We retain personal data only as long as necessary for the purposes described above, or until you withdraw consent or request deletion.

For product data, we keep information until it is no longer needed for the relevant purpose, or until you delete your account or specific content where the product offers deletion, except where we must keep certain data longer for legal, security, or accounting reasons.

10. International Data Transfers

Some service providers (Meta, Google, OpenAI, Calendly) may process data outside the EEE. Supabase and its subprocessors may also process data in multiple regions.
Where applicable, we rely on Standard Contractual Clauses (SCCs) or equivalent GDPR safeguards.

11. Your Rights (GDPR)

You have the right to:

Access, correct, or delete your data
Restrict or object to processing
Withdraw consent at any time
Request data portability
Lodge a complaint with a supervisory authority

Requests can be sent to winthe@fireandflow.be.

12. Cookies

We use cookies necessary for website functionality.
If non-essential cookies (e.g. marketing or third-party embeds such as Calendly) are used, consent will be requested via a cookie banner.

13. External Links

Our website may contain links to third-party websites. We are not responsible for their privacy practices.

14. Data Security

We apply appropriate technical and organizational measures to protect personal data. However, no online transmission is fully secure.

15. Legal Disclosure

We may disclose data if required by law or to protect our rights, users, or comply with legal obligations.

16. Changes

This Privacy Policy may be updated from time to time. The latest version will always be available on this page.

17. Contact

Questions about this Privacy Policy can be sent to:
📧 winthe@fireandflow.be