Privacy policy

Who decides what happens to your information

You reach Flow because your employer runs it. There is no public sign-up: an address only gets in if the company that owns its domain is a customer, or if an admin there has listed or invited you. Nobody can start using Flow on their own.

So your employer decides that Flow is used, what it asks about, and who sees the results. In data protection terms your employer is the controller and we are the processor: we handle your information on their instructions and for nothing of our own. Ask them first, and they can ask us.

We are the controller for one thing only: a demo request, a demo request after the quick test on the Velory homepage, or a question you send us from our website. That controller is Velory AB, reg. no. 559118-9476, at Velory AB, c/o United Spaces, Sveavägen 34, 111 34 Stockholm, Sweden. Either way, write to privacy@velory.com and we will answer, or point you to your employer where it is their call.

What we collect

You sign in through Google, or with a short code we email you. The code is single-use, expires quickly, and only works in the browser that asked for it. Wrong guesses and repeat requests are both limited. When you sign in we collect your work email and a note of how you came to Flow. If you use Google, we ask it only for your basic sign-in details, and we keep no standing key to your Google account.

When you take an assessment we collect more, because the questions need it:

• Your name and work email.
• Anything you choose to type about your role or your work.
• Your answers as the conversation goes along.
• The write-up we put together for you at the end, and a few summary points drawn from your answers.
• On the AI literacy check, the level your answers work out to and your read on each part of it.

If your employer runs Flow, two more things reach us from their side rather than yours:

• Your name, work email, job title, team, and who you report to, when your employer connects their HR system so they do not have to type a list of people by hand.
• The documents your employer uploads to build the questions, usually an AI or IT policy. Those are the company's documents. We do not go looking for people in them, but a name can appear in one, so we treat them as capable of holding personal information.

If you take the quick test on the Velory homepage and book a demo from it, your name, email and company reach our sales team the same way any demo request does. We also keep your answers to its four estimate questions, stored with your email domain (like yourcompany.com) rather than your name or full address, for 90 days. Your other answers are not kept, and we keep nothing from a common personal address, like a Gmail or Hotmail one.

We do not ask for sensitive personal details, and we prefer that you do not type any in. Keep other people's personal or confidential information out of your answers unless you are allowed to share it.

Why we hold it, and what allows us to

Everything we do with your information has a purpose and a legal basis under the GDPR. All of it:

• To sign you in and let you back into your results. Basis: performing the agreement we or your employer have with you.
• To run the assessment conversation and build your write-up. Basis: the same agreement, or your employer's legitimate interest in knowing whether its own rules are understood.
• To email you that write-up and let you open it again from a private link. Basis: the same agreement.
• To show a company where time goes and where its teams stand, in aggregate, with individual answers blurred out. Basis: your employer's legitimate interest in running its business, and, where it applies, its duty under Article 4 of the EU AI Act to see that its people have a grounding in AI.
• To keep a record your employer can show a regulator that the training happened. Basis: your employer's legal obligation.
• To keep the service secure, and to answer a support question you or your employer raise. Basis: our legitimate interest in a service that works.
• To keep proof that we erased something when we were asked to. Basis: our legal obligation.
• To fill in a company's first estimates in Flow from the quick test on the Velory homepage that someone there took, so nobody answers the same questions twice. Basis: our legitimate interest in starting a new customer from what they already told us.
• To count visits to our homepage with Google Analytics, and see how people find it. Basis: our legitimate interest in knowing how buyers find us, for the count without cookies; your consent, for the cookies and for counting a booked demo, which you can take back under Cookie settings on the homepage.

We do not sell your information, we do not use it to advertise to you, and we do not use it to train AI models.

Who helps us run this

These companies help us run the service. Each one handles your information only to do its job for us:

• Cloudflare hosts the site and stores the data behind it. The database is pinned to the European Union; see Where it is stored, below. Cloudflare also runs the check on our demo form and the quick test on the Velory homepage that tells a person apart from a bot; see Cookies and tracking.
• Anthropic runs the model behind the assessment. Your answers and your role go to it so the questions fit your work. Your name and your email address are never sent. The AI literacy report itself is built on our own servers, with no model involved.
• Brevo sends our emails, like your invite and your write-up. If HubSpot cannot take a demo request, Brevo carries that request to our sales team instead, so it does not get lost. It is based in France.
• Google signs you in when you choose that way in. We ask it only for your basic sign-in details. Google Analytics also counts visits to our homepage; see Cookies and tracking.
• HaileyHR, or whichever HR system your employer connects, is where the list of people comes from. We read from it; your employer controls what it holds.
• TinyFish reads a company's public homepage when an admin sets the company up, so the name and logo fill themselves in. All it receives is the web address.
• HubSpot holds the demo and review requests sent from our website, so our sales team can answer you. We send it your name, email and company from our own server; nothing of HubSpot's runs in your browser, and Google reCAPTCHA is no longer involved at all.

We can also share information if the law requires it, or if Velory is ever involved in a merger or acquisition. In that case we will tell you first.

Ask us at privacy@velory.com for the current list and we will send it, along with the agreements behind it.

Where it is stored

The database that holds your information is pinned to the European Union on Cloudflare's infrastructure. Cloudflare may only place it on EU servers. The pin is fixed when the database is created and cannot be changed afterwards, so it cannot quietly lapse.

Some of the companies that help us run the service are based in the United States, so some processing happens there. Anthropic and Google are the two that matter. For those transfers we rely on the European Commission's standard contractual clauses, and on the EU-US Data Privacy Framework where the provider is certified under it.

What your admins and managers can see

Your employer's admins and your manager see how the team is doing. What they get:

• Admins and managers see totals and team summaries, with individual answers blurred into the group.
• On the AI literacy check, your manager and your company's admins also see the level it gives you, and your read on each part of it, next to your name. We tell you this on screen before you answer the first question of that check.
• What you wrote stays with you. No admin or manager is shown your typed answers, your conversation, or a sentence of yours with your name on it, and there is no admin setting that opens them.
• We never show an admin or manager a figure or an answer drawn from fewer than five people, so no single person can be read out of it. The number is five for every company, and nothing in the product can move it.
• Nobody sees more about you than you see about yourself. Every read an admin's or manager's view carries is on your own report too.
• Admins and managers do see the shape of the organisation, the teams and who sits in them, because that is theirs to manage. That view never carries anyone's answers.

Your own write-up is yours.

The level is worked out automatically

Your literacy level comes out of your own answers, worked out by software. It decides nothing on its own, and we do not use it to decide anything about you. It is a read on where someone is against your employer's own rules, and it is not built to be a measure of performance. Your employer agrees to that when it buys Flow.

If you think the level is wrong, say so. Write to privacy@velory.com or tell your employer, and a person will look at it.

Your report link

Your company decides when write-ups go out. Everyone's results are held until an administrator sends them, and then we email you a private link to yours. If you finish after that, we email you when you finish. For two days the link opens straight from the email, so you can read it and pass it on if you want to. After that the link closes, and you reach your write-up by signing in, so it stays yours.

No Velory staff member can open your write-up. There is no support override, no admin setting, and no export button that hands your text to our staff: past those two days, the only session that opens your report is yours, and our own support runs on the same aggregates an admin or manager sees. We used to have a tool that pulled your write-up and your conversation into a file on request. We switched it off, because a screen nobody watches is a door.

You are still entitled to a copy of your own information, and you still get it: write to privacy@velory.com. Producing it now takes a deliberate change to our code and a deployment, which is slower for us and the point. Nobody at Velory can pull your write-up on a whim.

What our staff can reach is the list of people who have signed in, with names and emails, which is how we help a company get set up and answer a question about access. That is limited to named Velory staff. Four actions they can take on a company are written down with the staff member who took them: putting an assessment on hold, releasing it, running a test, and clearing one person's finished attempt.

How long we keep it

What we intend to keep, and for how long. Apart from the quick test answers, nothing deletes any of it on a timer, and we run no manual routine either, so treat these periods as what we hold ourselves to. Ask us if you need one enforced.

• The running transcript of your conversation: kept for 90 days after your write-up is built, then deleted. The write-up is the part worth keeping. The raw back-and-forth is not.
• Your finished write-up and answers: kept for as long as your employer is with us, plus 30 days, then erased.
• The people list from your employer's HR system: kept while your employer is with us. When someone leaves the HR system, the next sync marks them inactive rather than removing the row, and it refuses a run that would deactivate a large share of a company at once, so a broken export cannot empty the list. A list your employer uploads as a file works differently: being missing from it is never read as a departure, because a file is whatever list the admin happened to have. A status column in the file can still mark someone inactive.
• Documents your employer uploads: kept until your employer deletes them or leaves us.
• Sign-in codes: they expire shortly after we send them, and a used code cannot be used again. We do not clear the spent rows on a schedule, so a spent code stays in our database, with the name and address beside it, until an erasure reaches it.
• Invites: kept for six months after they are sent.
• Quick test answers (the four estimates): deleted on a timer 90 days after the test. They go sooner when a company in Flow takes them up as its first estimates, or when you ask us to delete them.
• Your account record: erased when your employer leaves us, or sooner if you ask.
• A note that an erasure happened: kept for three years, as proof we did it. It holds a random reference, the identifiers of the companies your data sat in, a count of your rows per table, the date, and the address of the Velory person who ran it. It holds no name or address of yours, and nothing you said.

Ask us to delete your information sooner and we will, unless the law requires us to hold some of it.

How we protect it

What sits behind those promises:

• Everything travels encrypted, and the database is encrypted where it sits.
• Credentials for a connected HR system are encrypted with a key that is not in the code.
• Access to live data runs through one named staff list. A Velory address is either on it or reaches nothing, and there is no second, narrower grant: the product names that role instead of handing it out silently.
• The five-person floor and the rule against showing an admin or manager anyone's own answers are enforced in the code and covered by tests, so a new screen inherits them.
• Security risk is part of running anything on the internet, so we will not promise nothing can ever go wrong. If a breach affects you, we will tell you and the regulator within the time the law allows.

Your choices

You can ask us to:

• Show you what we hold about you, or give you a copy you can take elsewhere.
• Correct anything that is wrong.
• Delete everything we hold on you. We remove it from Flow and then sweep the whole database to check that nothing is left. Two things can sit outside that reach, both of them writes into your employer's own HR system: a level of yours put on your profile there, and a record that you completed a check filed against your employer's training log. We cannot pull either of them back, so what has already been written there is your employer's to delete.
• Stop using it for a while, and hold it without touching it, while a question about it is open.
• Stop a use that rests on someone's legitimate interest, including any use you object to.

Where we asked for your consent to something, you can take it back at any time, and that does not undo what was lawful before. Make any of these requests through your employer or by writing to us at privacy@velory.com. We answer within a month. To stop the emails, reply to any email from us and ask.

If you think we have got this wrong, you can complain to a data protection authority. In Sweden that is Integritetsskyddsmyndigheten (IMY). You can also go to the authority where you live or work, and you can do that without raising it with us first.

Cookies and tracking

When you sign in we set one cookie, which keeps you signed in for seven days. Inside Flow there is no analytics, no advertising, and no third-party tracker.

That holds on the homepage too. The demo booking form there is ours: the boxes you fill in are served by us, and when you send it we pass your name, email and company to HubSpot, the system our sales team works in. Nothing of HubSpot's loads in your browser.

One other thing runs on that form, and on the demo form at the end of the quick test on the Velory homepage: a Cloudflare check that tells a person apart from a bot. We added it because bots were filling the form in. It reads your IP address, your browser's user agent and a fingerprint of your connection, and it may set a cookie of its own to do that. Cloudflare does not use any of it to profile you or to sell advertising, and they already carry every request to this site. Its only job is keeping bots off our demo forms.

On the homepage, and only there, we ask whether we may use Google Analytics. Google's script loads with the page. Until you answer, it counts the visit without a cookie, under a random number that lasts only for that page view and is never stored: the page you saw, the site that sent you, the campaign tags in the link, the country and region you are in, and your browser and device. Google sees your IP address to work out where you are, and does not store it. If you accept, it also sets cookies whose names start with flow_ga, which last up to 13 months, so it can tell a returning visit from a new one and see whether you booked a demo. Accepting keeps the random number from that page view as the one in the cookie. Before anything goes to Google, we cut the page address down to its path and campaign tags, and the site that sent you down to its name. Google deletes the visit-level data after two months and keeps only totals, and its advertising features are off. Google may process it in the United States, under the EU-US Data Privacy Framework.

If you reject, nothing more is sent to Google, on this visit or later ones until we ask again, though its script still loads with the page. Your answer is stored in your own browser, not in a cookie. To change it, use Cookie settings at the foot of the homepage. If you take a yes back, we stop sending and delete those cookies. We ask again after a year.

Children

Flow is for people at work. It is not for anyone under 16. We do not knowingly collect a child's information, and we delete it if we find we have.

Changes to this policy

If we change how any of this works, we update this page and the date at the top. If the change is a big one, we will tell you directly.

Contact

Write to privacy@velory.com, which reaches Velory's Data Protection Officer.

By post: Velory AB, c/o United Spaces, Sveavägen 34, 111 34 Stockholm, Sweden.

Flow is one of Velory's products, and Velory publishes its own privacy policy and its own list of the services it uses for the rest of the platform. This page covers Flow.