moreflow logo black font

Privacy Policy

Last updated: July 17, 2026

1. Scope and controller

This privacy policy explains how we process personal data when you visit moreflow.io, contact us, or use the moreflow platform.

The controller is:

valie media GmbH
Brühlscher Weg 91
47608 Geldern, Germany
Email: [email protected]
Phone: +49 2831 3959475

2. The most important point: core customer data stays in Germany

moreflow's core application services run on a Hetzner VPS located in Germany. Our primary PlanetScale database is deployed in the AWS eu-central-1 region in Frankfurt, Germany. PlanetScale states that database data and backups remain in the selected European region unless an additional region is explicitly configured.

This Germany-only statement applies to moreflow's core customer data and primary storage. If you choose to connect an external integration, use a payment or communications provider, or enable an AI-powered feature, the data required for that feature may be transmitted to the provider you selected. Those providers process data under their own terms and may operate outside Germany.

Our current core infrastructure providers are listed on our Subprocessors page.

3. Hosting and platform infrastructure

Hetzner

We use Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, to host the website and moreflow's application services on infrastructure located in Germany. In connection with hosting, Hetzner may process IP addresses, request and log data, account data, customer content, and other data transmitted through the service.

Processing is necessary to provide the website and platform, perform our contracts, and operate a secure and reliable service (Art. 6(1)(b) and (f) GDPR). We have concluded a data processing agreement with Hetzner in accordance with Art. 28 GDPR.

PlanetScale

We use PlanetScale, Inc. to operate our primary PostgreSQL database in Frankfurt (eu-central-1). This database contains the account, CRM, workflow, configuration, and other platform data required to provide moreflow. Database connections are encrypted in transit, and PlanetScale provides encryption at rest.

Processing is necessary to perform our contracts and provide a secure and reliable platform (Art. 6(1)(b) and (f) GDPR). PlanetScale provides a data processing addendum for its services.

4. Visiting our website

Server log files

When you access our website, our systems automatically process technical data such as your IP address, timestamp, requested URL, referrer, browser, operating system, and response status. We use this data to deliver the website, diagnose errors, and defend against abuse. The legal basis is our legitimate interest in the secure and reliable operation of the website (Art. 6(1)(f) GDPR). Log data is deleted when it is no longer required for these purposes, unless a security incident requires longer retention.

Language preference

We store the technically necessary NEXT_LOCALE cookie so the website can remember your selected language. It is used only to provide the requested language version. The legal basis is Section 25(2) No. 2 TDDDG and Art. 6(1)(f) GDPR.

Analytics and advertising

With your consent, we use:

  • PostHog EU Cloud to understand website usage and improve moreflow;
  • Vercel Web Analytics to measure aggregated page and interaction statistics; and
  • Meta Pixel to measure the effectiveness of campaigns on Meta platforms.

These services may process page URLs, interaction data, device and browser information, IP-derived location information, identifiers, and campaign attribution data. Meta may process data in countries outside the European Economic Area. Where required, transfers are based on appropriate safeguards such as the EU Standard Contractual Clauses.

These tools are activated only after you consent (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). You may reject or withdraw consent at any time through the privacy choices shown on the website. Withdrawing consent does not affect processing that took place before withdrawal.

5. Contact and chat

If you contact us by email, phone, or the chat on our website, we process the information you provide and the related contact details to respond to your request. The legal basis is Art. 6(1)(b) GDPR for contractual or pre-contractual requests and otherwise our legitimate interest in answering enquiries under Art. 6(1)(f) GDPR.

The moreflow chat widget is delivered from our own application infrastructure. Chat messages are retained only as long as required to handle the conversation and any resulting business relationship, subject to statutory retention obligations.

6. Accounts and use of moreflow

When you create or use an account, we process identifiers, contact and account data, authentication information, customer content, CRM records, documents, communications, workflow data, billing metadata, and usage information as required for the features you use. The legal basis is performance of our contract (Art. 6(1)(b) GDPR), compliance with legal obligations (Art. 6(1)(c) GDPR), and our legitimate interest in securing and improving the service (Art. 6(1)(f) GDPR).

Where a business customer uploads or otherwise controls personal data in moreflow, that customer is generally the controller and valie media GmbH acts as processor under a data processing agreement.

7. Customer-enabled integrations

moreflow can connect to external services such as Google, Microsoft, advertising platforms, payment providers, email or telephony providers, and other tools selected by the customer. When you enable an integration, we store the identifiers and authorization credentials needed to maintain the connection and exchange the data required for the actions you request.

We do not activate these providers for your customer data without your instruction. The scope of processing depends on the integration and your configuration. Disabling an integration stops future exchanges, but data already transmitted remains subject to the connected provider's retention rules.

8. Retention

We retain personal data only for as long as necessary for the stated purpose, to provide the service, or to meet statutory obligations. When an account or individual record is deleted, associated data is deleted or anonymized unless contractual, tax, commercial, security, or legal requirements justify further retention. Backup copies are removed through the applicable backup lifecycle.

9. Your rights

Subject to the requirements of the GDPR, you have the right to:

  • access your personal data (Art. 15 GDPR);
  • correct inaccurate data (Art. 16 GDPR);
  • request deletion (Art. 17 GDPR);
  • restrict processing (Art. 18 GDPR);
  • receive data you provided in a portable format (Art. 20 GDPR);
  • object to processing based on legitimate interests (Art. 21 GDPR); and
  • withdraw consent at any time for the future (Art. 7(3) GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority. You may contact us at [email protected] to exercise your rights.

10. Changes to this policy

We update this policy when our services, providers, or legal obligations change. The date at the top shows the current version.