Privacy Policy

1. Who we are

Leegwater GmbH ("Flok", "we", "our") provides a SaaS platform for clubs and associations. Our registered office is in Jona, Switzerland. For the purposes of the EU General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (nDSG), Flok acts as a data processor for the member data your organisation ("Customer") stores in Flok, and as a data controller for the account data of the administrators who sign in to Flok.

Our processing on your behalf is governed by our Data Processing Agreement, which forms part of our Terms of Service and applies automatically from the moment you accept them.

2. Data we collect

Account data (admin users)

• Name, email address and preferred language. We do not store passwords. Signing in is passwordless — by a one-time code sent to your email, or by passkey.
• Session and authentication logs, including IP address and user-agent.
• Questions you ask the Pilot assistant inside the dashboard, and its answers, kept per user and per club as separate conversations, so one can be continued. The assistant answers from our help articles. With questions about members and events switched on, it also sees the titles and dates of your club's events and a description of the kinds of data Flok holds, never a member or a figure; such answers are worked out by Flok from your records, not by the assistant, and the conversation stores only the question.
• Billing details when a paid plan is purchased — your name, email address, billing address and payment method, processed on our behalf by Stripe, our payment processor for Flok subscriptions.

Customer data (data your organisation puts into Flok)

• Member records: name, contact details, membership status, custom fields you define.
• Invoices, payments, events, tickets, newsletters and audit logs.
• Files you upload, such as logos and attachments.
• Where your club uses Finanzen, its bookkeeping: the journal, the chart of accounts and the receipts you upload. Member names appear in the journal through postings that come from invoices.

Event bookings (ticket buyers and event visitors)

• When you book a ticket or register for an event on a club's public page: your name and email address, any extra questions that club chose to ask on its own booking form, which ticket you took and how many, the amount and whether it was paid, and — if the club scans tickets at the door — whether you attended.
• The language the booking page was in, so the confirmation email and ticket reach you in that language.
• Payments go directly to Stripe or Payrexx, PCI DSS Level 1 certified providers. Flok never sees your card details.
• If the club has switched it on, your ticket can be saved to Google Wallet. The pass — your name as ticket holder, the ticket code, the event and the club — is handed to Google only when you tap the Save button, and from then on is held by Google under its own privacy terms.
• The club you booked from is the controller of this data; Flok processes it on that club's behalf. Its terms and imprint are linked in the footer of the page you booked on.

Member directory (where a club switches it on)

• A club may switch on a member directory, in which its members can show selected details to each other. It is off unless the club turns it on, and the club decides what may be shown and whether members can write their own skill tags.
• What a member chooses to publish: a short line about themselves, what they do, what they can help with, what they are looking for, skill tags, a photo, and links to a personal website or LinkedIn profile. The name, contact details, company and role already held on the member record can be released the same way.
• Each detail is separately set to visible, available on request, or hidden — by the member, not by the club and not by us. A hidden detail is left out of the response the browser receives, so it cannot be read from the page; it is indistinguishable from a detail that was never filled in.
• Asking another member to release a detail records who asked, for what, and the answer. An answer can be withdrawn later, which revokes the access it granted.
• Photos are held in a private store and served through short-lived links that are issued only to a member allowed to see that photo. Location and camera metadata are stripped from an uploaded photo before it is stored.
• Every consent and withdrawal is recorded with its date, the language it was given in, and a fingerprint of the exact wording the member agreed to — so what someone agreed to stays answerable later.
• Where a club shows who is attending one of its events, it chooses the basis: either nobody appears without opting in, or attendees of the same event see each other's names under the club's own privacy notice, with a one-click objection. That choice is the club's and is recorded with the person who made it.
• The club is the controller of all of this; Flok processes it on the club's behalf and never adds a member to a directory on its own.

Support assistant conversations

• Messages you type into the AI support assistant on a public event or ticket page, and the assistant's replies.
• Before storage we automatically remove email addresses, phone numbers, IBANs and card-shaped numbers from the text. This is not anonymisation: a message can still identify you by what it says.
• An opaque, per-browser-tab identifier held only for the length of your visit. It is not a cookie and does not follow you between sites or sessions.
• Whether the person chatting was signed in as a member of that club — not who they are.

Event waitlists

• If a club offers a waitlist for a sold-out ticket and you ask to be told when one frees up: your email address, which ticket you are waiting for, and whether you confirmed the request.
• We only ever email an address that has followed the confirmation link in the first message.

Membership applications (where a club opens a signup form)

• A club may publish an application form on its Flok page, embed that form on its own website, or route an email address at Flok's domain into its application queue. What you give it — your name, contact details, the fields the club chose to ask for, and the consents you tick — is held as an application until someone on the club's board decides on it. Nothing is published, and you are not a member until they do.
• With the application we keep the language you applied in, a salted hash of your IP address and your browser's user-agent string — used to tell a flood of fake applications from a real one, never to identify you — and, where the application arrived by email, the email as received.
• If our rule-based reader cannot find a name or an email address in an emailed application, its text is passed once to our AI provider to read those fields out. The result is shown to the board marked as read by the assistant, and the assistant never approves or rejects anything.
• The club is the controller. Approval creates a member record in that club's account; anything not approved is deleted on the schedule in section 7.

Newsletters and event messages you receive

• Emails a club sends through Flok contain a one-pixel image that reports when the message is opened, and links that pass through Flok so that a click can be recorded, together with your browser's user-agent string. The club sees these as open and click statistics for its mailing.
• Every such email carries an unsubscribe link and the standard List-Unsubscribe header. Unsubscribing stops all further bulk mail from that club; emails that belong to something you did — a ticket, an invoice, a sign-in code — are not affected.

Contact form and support correspondence

• If you write to us through the contact form or by email, we keep your name, email address and message in our support inbox so that we can answer and follow up. The form records a salted hash of your IP address for rate limiting only.

Technical data

• Aggregated traffic statistics collected by Vercel Web Analytics, which is cookieless and does not identify you — see section 6.
• Diagnostic logs from our servers, kept only as long as needed for troubleshooting.
• Fonts. This website, including these legal pages, serves its typefaces from our own domain. The Flok app and member portal still load theirs from Google Fonts, so your browser requests the font files from Google's servers and Google sees your IP address in that request; nothing else is sent, and we are moving the app to self-hosted fonts.

You are not obliged to give us any data. Without a name and an email address we cannot open an administrator account, and without the details a club's booking or application form marks as required, that club cannot issue a ticket or consider an application. Everything else is optional.

3. How we use data

• Provide, secure and improve the Flok service.
• Send transactional emails (invoices, event tickets, sign-in codes).
• Provide customer support that you or your organisation request.
• Detect abuse, fraud and technical issues.
• Comply with legal obligations (tax, accounting, lawful requests).
• Read a membership application that arrived by email when our rule-based reader cannot, and translate a club's own email wording into its other languages when the club asks for it.
• Where a club has the churn-risk feature on, score its members on three behavioural counts so the club can see who may be drifting away. The score is a suggestion shown to the club's administrators, never a decision — see section 8 of the AI Data Addendum.
• Answer questions in the AI support assistant, and keep a short record of those conversations so we can tell whether it is helping.

We do not sell personal data, and we do not use member data to train AI models — neither our own nor anyone else's. Flok does not train, fine-tune or build models on Customer or member data at all.

Our AI provider, Infomaniak, processes the content we send it in Switzerland in order to produce a reply. Infomaniak states that it handles these requests without storing or logging them, so no copy of the content is kept once the reply is returned.

Assistant conversations are read only by Flok, to check answer quality. The club whose page you were on sees counts — how many conversations, how many were resolved — and never the conversations themselves.

4. Legal bases (GDPR Art. 6)

Processing	Legal basis
Providing the service to admins & the Customer	Contract (Art. 6(1)(b))
Sending service and security notifications	Legitimate interests (Art. 6(1)(f))
Processing member data on behalf of a Customer	Customer's chosen basis under a Data Processing Agreement
Billing, tax and accounting records	Legal obligation (Art. 6(1)(c))
Answering questions in the support assistant	Legitimate interests (Art. 6(1)(f)) — answering a question you asked us
Telling you a waitlisted ticket has freed up	Consent (Art. 6(1)(a)), given by confirming the link we email you
Listing a member in a club's member directory	Consent (Art. 6(1)(a)), given to the club and withdrawable at any time
Showing attendees of one event to each other, where a club has chosen that basis	The club's legitimate interests (Art. 6(1)(f)), with a right to object
Aggregated, cookieless traffic statistics	Legitimate interests (Art. 6(1)(f)) — understanding how the site is used, without identifying you
Handling a membership application you send a club	The club's basis — normally steps taken at your request before entering into a membership (Art. 6(1)(b)), plus any consent the club's form asks for (Art. 6(1)(a))
Recording that a club's newsletter was opened or a link in it clicked	The club's legitimate interests (Art. 6(1)(f)) in knowing whether its mail is read; you can unsubscribe at any time
Answering a message you send us	Legitimate interests (Art. 6(1)(f)) — replying to you
Optional marketing communications	Consent (Art. 6(1)(a))

5. Sharing & subprocessors

We share data only with vetted providers under signed data processing agreements. Categories include cloud hosting (Swiss and EU data centres), transactional email delivery, error monitoring, payment processing, and the AI provider behind the Pilot and support-assistant features.

Payment processing involves Stripe in two separate ways, and it is worth being precise about which is which.

• For your club's own payments — member dues and event tickets — your club connects its own Stripe or Payrexx account. Your club is that provider's customer; we only pass the payer to a checkout page the provider hosts. No card details reach Flok.
• For what you pay us — your Flok subscription — we use our own Stripe account. Stripe processes your name, email address, payment method and billing address on our behalf so that we can bill you. This applies to every paying customer, whether or not your club has enabled payments for its own members.

The full, current list of subprocessors — who they are, what they process, where, and their certifications — is published on our subprocessors page. We give at least 30 days' notice before adding or replacing one.

6. Cookies & tracking

Flok sets one cookie: sidebar_state, which remembers whether you left the dashboard sidebar open. It contains no identifier and is not used to track you. It is a functional cookie and does not require consent.

For traffic statistics we use Vercel Web Analytics, which is cookieless: it sets no cookies and identifies visitors by a hash derived from the incoming request that is reset every day, so a visitor cannot be tracked between days or between sites.

We also record a small number of named events — for example that someone opened the dashboard, clicked “Start free”, or viewed a public event page. These carry no identifier: we record that it happened and, for a public event page, the event’s own title. They are not linked to you, to your club, or to each other.

We do not use Google Analytics, advertising or retargeting pixels, session-recording or heatmap tools, or any cross-site tracker. We do not sell or share data with advertising networks.

Signing in stores your session in your browser's local storage, not in a cookie. It stays on your device and is cleared when you sign out.

During a ticket purchase, the details you type are held in your browser's session storage until checkout completes, so a page reload does not lose them; they are gone when you close the tab. Staff scanning tickets at a door keep a queue of scans on their own device for up to seven days, so that check-in keeps working without a connection.

When the Flok app hits an error, a diagnostic report — the technical error and where it happened — is sent to Sentry, our error-monitoring provider, from production only. We do not enable the option that would attach personal identifiers to those reports.

The public support assistant uses an opaque, per-browser-tab identifier that lasts only for the length of your visit. It is not a cookie and does not follow you between sites or sessions.

7. Retention

• Account data: while the account is active and up to 90 days after closure.
• Member data processed for a Customer: kept as long as the Customer decides, then deleted or returned on request within 30 days of contract termination.
• Inactive free accounts: after 12 months without activity we email you, give you at least 90 days' notice, and delete the account only if nothing happens in that time. See section 6 of the Terms of Service.
• Invoicing records: retained for 10 years to meet Swiss accounting law.
• Support assistant conversations: 90 days, then deleted automatically.
• Event waitlist entries: deleted within 24 hours of the event ending.
• Membership applications: an application you never confirmed is deleted after 7 days; the form payload or email as received is deleted after 30 days; a rejected application, or one marked as spam, is deleted 90 days after that decision; an approved one becomes the member record.
• Newsletter open and click events: kept with the club's mailing statistics for as long as the club keeps the mailing.
• Contact and support correspondence: kept while the matter is open and afterwards as the record of how it was handled; the header data of inbound email is deleted after 90 days.
• Pilot assistant conversations (staff): deleted twelve months after a conversation was last used, or earlier when the person deletes it themselves.
• Member directory entries: kept while the member wants to be listed. Withdrawing consent removes the entry and its photo; the record that consent was given and withdrawn is kept, because it is the evidence that the processing was lawful.
• Attendee lists for an event: reachable by fellow attendees for a period the club sets, up to a year, and by default 30 days after the event.
• Server logs: rotated within 30 days.
• Encrypted backups: our long-retention archive holds at least 60 days of history; our database provider keeps 7 days of daily backups. Data in a backup is removed by the ordinary expiry of those windows rather than deleted individually.

8. Your rights

Under GDPR and nDSG you may request access, rectification, deletion, restriction, portability, or object to processing. Members, ticket buyers and event visitors should contact the club they dealt with first, because that club is the controller of that data. For account data held by Flok, write to privacy@getflok.app.

Where processing rests on your consent, you can withdraw it at any time with effect for the future — by the same route you gave it, or by writing to the club or to us. Withdrawing does not make what happened before unlawful.

You also have the right to lodge a complaint with a supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC / EDÖB), Feldeggweg 1, 3003 Berne, Switzerland — www.edoeb.admin.ch.

If you live in the EU or the EEA, you may instead complain to the data protection authority of your own country of residence, your place of work, or the place where the alleged infringement occurred. A list of national authorities is maintained by the European Data Protection Board at edpb.europa.eu.

9. Security

• TLS 1.2+ for all data in transit.
• Encryption at rest at the storage layer.
• Role-based access control and row-level security in the database.
• Least-privilege access for engineers, audit-logged, and time-boxed per club with the club's own approval.
• Regular backups with tested restore procedures.
• An audit log of changes to member, event, invoice and ticket records — who changed what, when, and the values before and after.

Our technical and organisational measures are described in full in Annex 2 to our Data Processing Agreement.

10. International transfers

Member and club data is stored in Switzerland (Zürich). Static assets and our encrypted database backups are stored in the EU (Frankfurt, Germany). Transactional and newsletter email is delivered from the EU (Ireland). Where a subprocessor processes data outside Switzerland and the EEA, we rely on the EU Standard Contractual Clauses, the Swiss addendum and additional safeguards.

Messages sent to the AI support assistant, and text you ask Flok Pilot to work on, are processed by Infomaniak in Switzerland. Like everything else — your database, our backups, our static assets and our email delivery — it stays in Switzerland or the EU. You can turn each Pilot feature off individually in Settings; a feature that is off sends nothing.

11. Children

Flok is not directed at children under 16. Clubs that manage junior members do so under their own consent framework and remain the controller of that data.

12. Changes to this policy

We will notify admins by email of material changes at least 30 days in advance. Minor clarifications will be posted here with an updated "Last updated" date.

13. Contact

Leegwater GmbH · Jona, Switzerland · privacy@getflok.app · Contact form.

Data protection officer. Flok is not required to appoint a data protection officer. Under Swiss law, appointing a data protection adviser is voluntary for private companies (Art. 10 nDSG); under the GDPR, the Art. 37(1) triggers — a public authority, core activities requiring large-scale regular and systematic monitoring, or large-scale processing of special-category data — do not apply to Flok at its current size and activity. Data protection questions can be sent to privacy@getflok.app and reach us directly.

EU representative. Flok does not currently offer its service to data subjects in the European Union. Should we do so, we will appoint a representative in the Union under Art. 27 GDPR and publish their name and address here beforehand.