Privacy Policy

Last updated: 6 October 2026

This policy explains how Flowion AB ("Flowion", "we", "us") collects, uses, shares and protects personal data in connection with the Flowion platform (the "Service") — the console, the API and the infrastructure behind them — and our website, flowion.io.

Who we are

Flowion AB is a company registered in Sweden under organization number 559453-0155. For the purposes of the EU General Data Protection Regulation (GDPR), Flowion AB is the data controller for the personal data described in this policy, except where we act as a data processor on behalf of our customers, as explained below.

You can reach us about any privacy matter at privacy@flowion.io.

Controller vs. processor: who this policy covers

The Service is used by organizations ("Customers") to manage their own fleets of EV chargers, and by the individual people ("Users") those organizations authorize to sign in and work in the console on their behalf.

• Where we are the controller: your account data as a User, the billing details of your organization, and the technical data we need to run the Service securely. This policy governs that processing directly.

• Where we are a processor: the operational data a Customer stores or generates through the Service about its own charging infrastructure and the drivers who use it — for example charger configuration, connectivity status, charging sessions and meter values, and the RFID cards or other identifiers a Customer's charging network accepts. We process this data only on the Customer's documented instructions, under the data processing terms in our Terms of Service. If you are an EV driver whose data was processed through the Service, your relationship is with the Customer operating that charging network, not with Flowion directly — please contact them first.

What we collect

Account data

Sign-in is handled by Google Cloud Identity Platform. You sign in with Google, with GitHub, or with a link we email you; the Service has no passwords. The provider you choose shares your profile with Identity Platform, typically your name, your email address and a profile picture. Our own database stores:

• Your email address

• A unique identifier for your account

• Which organization(s) you belong to, and the permission policies you hold in each

We collect this when you accept an invitation or sign in for the first time, and use it to authenticate you, enforce access control, and let your organization manage who has access to what. Invitations are shared as a link rather than emailed by us, and expire after seven days.

Billing data

When your organization adds a way to pay, it enters its billing name and address, VAT number and payment card into Stripe's own payment form, embedded in the console. Card details go directly to Stripe and never reach Flowion. The billing name, address and VAT number are stored with Stripe rather than in our own database, and Stripe checks the VAT number against the EU's VIES register. Where an organization sets up payouts, it does so through Stripe's own onboarding pages.

Data from integrations a Customer turns on

A Customer can connect the Service to other systems it uses. We then process data from them on the Customer's behalf, as its processor:

• Fortnox: the company's name and organization number, and its customers' names and organization numbers, with its articles. We never read contacts' email addresses, phone numbers or postal addresses. The connection is read-only, and disconnecting it deletes what was read.

• Easee Cloud: how an Easee site is wired, its chargers' names and serial numbers, and its Equalizer readings, which we keep for 90 days.

Installer access

A Customer can grant another organization — an installer — access to its charging stations for commissioning and diagnostics. The installer then sees those stations' identifiers, connectivity, OCPP version and serial numbers, and can send them commissioning commands. It never sees the Customer's billing, members, driver identifiers or charging sessions, and either side can end the access at any time.

The Flowion Assistant

The console has an assistant that answers questions about a Customer's charging and fills in the console's forms. When a member writes to it, we process what they write and what it reads to answer: what that member can read in the console, in the project they have open, such as its chargers, charging sessions, prices and earnings. It never reads vehicle data. It changes nothing by itself: a change it suggests opens a form the member checks and saves.

We process this on the Customer's behalf, as its processor. Claude, a model made by Anthropic, produces the answers, so conversations are sent to Anthropic, a US company, and may be processed outside the European Economic Area. A Customer's Owner or Admin can turn the assistant off for their organization in the console's settings, and then nothing its members write reaches it.

Technical and log data

Operating the Service produces request logs, which include your IP address, the time, the requested path and your browser's user agent. We use them for security monitoring, debugging and abuse prevention, and keep them for 30 days. Traces of individual requests are kept for 7 days, and aggregate metrics, which do not identify you, for 90 days.

Cookies and browser storage

• The console sets no cookies. It keeps your sign-in session in your browser's local storage, together with a cache of what you have viewed, and clears the cache when you sign out.

• The payment form, when you open it, is Stripe's, and Stripe may set its own cookies to prevent fraud.

• The API reference's "Try it" keeps an API key you paste in for the length of the browser session only, and, if you sign in there instead, your sign-in session in local storage.

• Our website counts page views without cookies, using a hash of your IP address and browser that changes every day and cannot be turned back into either. For as long as the tab stays open, and in that tab only, it remembers where you first arrived from (a search engine, or a campaign name) so that a later sign-up can be credited to it. That note holds no identifier, and it leaves the site only if you click through to the console. None of this happens when your browser sends Do Not Track or Global Privacy Control. The country in our statistics is looked up from your IP address, which we do not keep, using IP to Country Lite data by DB-IP.com, licensed under CC BY 4.0.

What we don't collect

We use no advertising, no third-party analytics and no marketing tracking. We do not take payments from EV drivers. If that changes, we'll update this policy first and, where required, ask for your consent before any non-essential cookie is set.

Why we process your data (legal basis)

• Performance of a contract — to provide the Service to you and your organization, including billing for it (Art. 6(1)(b) GDPR).

• Legitimate interests — to keep the Service secure, prevent abuse, and improve reliability (Art. 6(1)(f) GDPR), balanced against your rights and interests.

• Legal obligation — where we're required to retain or disclose data by applicable law, such as bookkeeping records (Art. 6(1)(c) GDPR).

Who we share data with

We share personal data only where necessary to run the Service. These are our sub-processors:

We also share data:

• With the sign-in provider you choose, Google or GitHub, which tells Identity Platform who you are.

• With the integrations and installers a Customer turns on, as described above, on that Customer's instruction.

• With your own organization's administrators, who can see which Users belong to their organization as part of normal account management.

We do not sell personal data, and we do not share it with third parties for their own marketing purposes.

Where a provider processes data outside the European Economic Area, we rely on appropriate safeguards recognized under the GDPR, such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

How long we keep it

• Account data: for as long as your account or organization exists. When a billing account is closed we keep its data until the customer asks us to delete it, apart from what the law requires us to keep longer.

• Billing records: for as long as Swedish bookkeeping law requires.

• Request logs: 30 days. Request traces: 7 days.

• Assistant conversations: 30 days after the last message, and sooner when the member's account, their membership or the organization is deleted.

• Operational data processed for a Customer: according to that Customer's instructions. Some records expire on their own — the raw messages a charger sends after 7 days, command records and station meter readings after 90 days, connector status history after 180 days. Charging sessions, their meter values and driver identifiers are kept for as long as the Customer's account is active, and a Customer can erase a driver identifier permanently at any time.

You can ask us to delete your account at any time by writing to privacy@flowion.io, subject to the exceptions above.

Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you

• Rectify inaccurate or incomplete data

• Erase your data, subject to legal or contractual limits

• Restrict or object to certain processing

• Data portability, where technically feasible

• Withdraw consent, where processing is based on consent

To exercise any of these rights, email privacy@flowion.io. If you're not satisfied with our response, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), or the supervisory authority in your own EU/EEA member state.

Security

We protect personal data with TLS encryption in transit, sign-in without passwords through Google Cloud Identity Platform, and access to every organization's data authorized against real membership and permission checks on every request, so one organization's data isn't reachable by another. Driver identifiers are stored encrypted; revealing one takes a permission only the Owner policy includes and is written to an audit trail. See our Security page for more detail. No system is completely secure, and we continue to invest in these protections as the Service evolves.

Children's data

The Service is intended for business use by adults acting on behalf of an organization. We don't knowingly collect personal data from children.

Changes to this policy

We may update this policy as the Service or applicable law changes. We'll update the "Last updated" date above when we do, and for material changes we'll take reasonable steps to let affected Users know.

Contact us

Flowion AB · Org. no. 559453-0155 · Sweden

Email: privacy@flowion.io