Privacy policy

This is the part of our privacy policy that applies to whoever uses our Odoo modules and FlexigoTech Cloud. The complete policy, which also covers our website and our customer area, is available on request at support@flexigotech.com.

This English version is a translation for reference only. The Spanish text is the one that applies.

1. Who processes your data

Flexibles y Accesorios Gobe, S.L., which sells software under the FlexigoTech brand.

• Tax ID (NIF): B56727993.
• Registered address: Calle Roger de Llúria 54, principal 1.ª B, 08009 Barcelona (Spain).
• Barcelona Commercial Registry, volume 49059, folio 216, section 8, sheet B-606144, entry 1.
• For anything about your data: support@flexigotech.com or +34 616 809 504.

We have not appointed a data protection officer because we are not required to (article 37 GDPR and article 34 LOPDGDD).

Atendyo, another product of this same company, has its own policy, published on its website, for its customers and for the businesses it writes to. This policy covers FlexigoTech's use of Atendyo as the chat on its own website.

2. What data we process, why, on what legal basis and for how long

When a retention period ends, we erase or anonymise the data. If a law requires us to keep it longer, we block it: it is set aside and used only to answer courts or public authorities while liability can still be claimed (article 32 LOPDGDD).

2.3 What you accept and what you consent to

Data	Legal basis	Retention
Which document you accepted or consented to (such as the terms of use or the subscription terms) or were informed of (this policy), its version and the SHA-256 hash of the text, the date, the IP address, the browser and where it happened (sign-up, purchase, new acceptance or preferences). Also when you withdraw a consent.	Legal obligation to be able to prove what you accepted or consented to (articles 5.2, 6.1.c and 7.1 GDPR).	While you have the account and then, blocked, for 5 years, the period for claims under a contract (article 1964.2 of the Spanish Civil Code).

2.9 If you write to us

Data	Legal basis	Retention
What you tell us through the website forms, by email, by phone or on WhatsApp: name, company, email, phone, website, your message and your answers to the form.	Pre-contractual steps you ask for (article 6.1.b GDPR) and legitimate interest in answering you (article 6.1.f GDPR).	12 months from the last contact, unless it leads to a contract. In that case, the contract's period.

The contact forms go through FormSubmit, which forwards them to us by email. If you write to us on WhatsApp, WhatsApp also processes that conversation under its own terms.

2.15 Invoicing and accounting

Data	Legal basis	Retention
The details on each invoice.	Legal obligation (article 6.1.c GDPR).	6 years (article 30 of the Spanish Commercial Code).

We disclose them to the Spanish Tax Agency when the law requires it and to our tax and accounting advisers, who process them on our behalf.

2.16 Your requests and complaints

Data	Legal basis	Retention
What you ask for, any data we need to check and our answer.	Legal obligation to handle your rights and your complaints (article 6.1.c GDPR, article 12 GDPR and article 21 of the Spanish consumer protection act, TRLGDCU).	3 years from our answer.

2.18 FlexigoTech Cloud

FlexigoTech Cloud is the service we provide from our servers to our Odoo modules, which is contracted by subscription. Depending on the module, it syncs with a platform, provides a cloud service or monitors the official sources the module depends on and alerts you of their changes and deadlines. Your Odoo sends nothing to the cloud until an administrator of your Odoo accepts it on the FlexigoTech Cloud screen. The subscription payment is processed by Stripe, which keeps your payment method for renewals. We do not see or store your card details.

Data	Legal basis	Retention
For each database that connects: the identifier (uuid) and address (URL) of the database, the Odoo version, the FlexigoTech modules installed, with their version, whether the database is a neutralised copy (staging or test), the company name and the email of the person who accepts, with the version of the accepted text and the date. If someone starts a trial from your Odoo, also their acceptance of the subscription terms and of the data processing agreement, with the version, the fingerprint of each text and the date, which we keep with your account and with the email with which the database was connected; we do not store the Odoo user who accepts. In connectors with a hub of ours that keeps the access of our integration, also what your Odoo sends to the hub when you connect the platform: the company name, a contact email (the company's or, if it has none, that of the user who connects), the address of the database and the language of that user. Afterwards, the date of its last connection.	For the database: pre-contractual measures and performance of the subscription contract (article 6.1.b GDPR). For the email of the person who accepts: if you contract as a professional, performance of the contract (article 6.1.b GDPR); if you accept on behalf of a company, our legitimate interest in maintaining the relationship with it (article 6.1.f GDPR and article 19 LOPDGDD).	As long as the database is linked to your account. If it is not linked to any, 12 months from its last connection. What is sent to the hub of a connector, while that connection lasts and, when it ends, 30 days at most. The proof of what was accepted follows section 2.3.
Your billing account and your subscriptions: company, VAT number, country and address, email of the account holder, whether you are a partner, and your customer and subscription identifiers in Stripe; for each subscription, the modules, tier, billing period, status and dates; the trials used; the reason you give us when you cancel, if you give one; and the service permits of each database, with the history of their changes and their cause.	Performance of the subscription contract (article 6.1.b GDPR) and accounting and tax obligations (article 6.1.c GDPR). The email of the account holder, if it belongs to a person who works for your company: our legitimate interest in maintaining the relationship with it (article 6.1.f GDPR and article 19 LOPDGDD).	As long as you have the account. If you delete it, the payment and subscription data that support your invoices stay blocked for 6 years (section 2.15).
Cloud access logs: IP address, date and time, requested address, database and result of each request, without tokens, keys or the content of the request.	Legitimate interest in protecting the service and stopping abuse (article 6.1.f GDPR) and duty of security (article 32 GDPR).	12 months, the time some platforms, such as Amazon, require. Those of the hub of the Amazon connector are archived for 13 months, without buyer data, to meet that period with a margin.

What the cloud processes so that the service works (the credentials of your platforms, the notifications and business data that pass through it, the metrics and errors your Odoo sends and the fingerprints of the records a module seals) we process on behalf of your company, as processors, under the FlexigoTech Cloud data processing agreement (section 10).

3. Where the data comes from

You give us almost all of it. Stripe gives us the payment result and the billing details you type on its page, and Scaleway and Brevo tell us whether an email was delivered. In FlexigoTech Cloud, your Odoo sends us the database details when an administrator of your Odoo accepts it, and Stripe tells us the status of your payments and your subscription.

4. Who we share your data with

We do not sell personal data or share it for other companies' advertising. We disclose it to public authorities and courts when a law requires it. These providers process it on our behalf (article 28 GDPR), each only for what is shown:

Provider	What for	Where
netcup GmbH	Servers for our website and its forms, the customer area, FlexigoTech Cloud and the chat, their databases and their backups.	Germany
Stripe Payments Europe, Limited	Payments, subscriptions and invoices. Stripe also processes some data as a controller in its own right, to prevent fraud and meet its legal obligations.	Ireland; part of the processing in the United States
Scaleway SAS	Main sender of our emails, and reporting their delivery.	France
Sendinblue SAS (Brevo)	Internal notices to our team, and backup sender of our emails if Scaleway fails or its free monthly allowance runs out, and reporting their delivery.	France
GitHub, Inc.	Private repository with the log of orders, while we still use it.	United States
ImprovMX Incorporated	Forwards email sent to our FlexigoTech addresses to our mailbox.	United States
GoDaddy	Our mailbox, where we receive forms and enquiries.	United States
Calendly LLC	Video call bookings.	United States
Mistral AI SAS	Chat answers and, as a sub-processor of FlexigoTech Cloud, the hosted AI of the local modules that use it (section 10).	France; before we switch on the hosted AI we will confirm where it processes that data and with which sub-processors
Groq	Chat answers and descriptions of the photos you attach.	United States
Cloudflare, Inc. (Workers AI)	Chat answers.	United States
Google Ireland Limited and Google LLC	Analytics and advertising, only with your permission. Fonts on the three Arabic pages of the website.	Ireland and United States
PostHog	Analytics, only with your permission.	European Union (PostHog's European cloud)
Supabase, Inc.	Old accounts of our website, until they are erased.	United States
Odoo S.A. (Odoo.sh)	Our Odoo instance, where the service that connects our Amazon connector to the seller's account runs (section 10).	Belgium, on Google Cloud servers; backups in France, the Netherlands and Sweden, with Google and OVH, and, until Odoo completes its transition, expected in the fourth quarter of 2026, one more in Canada
Our tax and accounting advisers	Accounting and taxes.	Spain

Two other services receive data without a data processing agreement signed with us, because they do not offer one: FormSubmit, which receives what you write in the contact forms and forwards it to us by email, and jsDelivr, a file distribution network with servers in many countries that serves the icons on many pages of our website and sees your IP address. FormSubmit does not publish a privacy policy. If you would rather your enquiry did not go through FormSubmit, write to us directly at support@flexigotech.com.

5. Transfers outside the European Economic Area

Some of the providers in the table in section 4 process data in the United States. Each transfer has to rely on a GDPR safeguard: the adequacy decision on the EU-US Data Privacy Framework of 10 July 2023 (article 45 GDPR), if the provider is certified, or the European Commission's standard contractual clauses (article 46.2.c GDPR). Stripe (Stripe, LLC) and Cloudflare are certified under the Framework. Groq is not, and its safeguard is the standard contractual clauses. For GitHub, Calendly, Google, GoDaddy, ImprovMX, PostHog and Supabase we are checking which of the two safeguards applies to each. If you want to know or would like a copy, ask us. Odoo S.A. hosts our instance in the European Union; it may still keep a backup in Canada, which has an adequacy decision of the European Commission (article 45 GDPR), and give its affiliates outside the European Union limited and temporary access, under standard contractual clauses.

6. Automated decisions

We do not take decisions based solely on automated processing that have legal effects on you or affect you in a similar way (article 22 GDPR). The chat answers automatically, but it does not decide anything about you. The fraud checks Stripe applies to payments are Stripe's own. In FlexigoTech Cloud, when a trial ends or a payment remains unpaid, the service stops automatically, as the subscription terms say. If you think it is a mistake, write to us and a person reviews it.

7. Your rights

You can ask us for access to your data, its rectification or erasure, object to our processing it, ask us to restrict its use and take it with you in a machine-readable format (articles 15 to 22 GDPR). If you gave us your consent, you can withdraw it at any time, without affecting what we did before (article 7.3 GDPR).

In your account, in the Privacy section, you can download a copy of your data (a JSON file downloaded through a link that is valid for 7 days and only opens with your session signed in), and delete the account. For anything else, or if you have no account, write to support@flexigotech.com or by post to the address in section 1. Any other channel you use to ask us is also valid.

We will not ask for your ID card. If you write from the email of your account or your purchase, that is enough for us. Only if we have reasonable doubts about who you are will we ask for the minimum detail that lets us check (article 12.6 GDPR).

We answer within one month at most. If the request is complex or we receive many, we can extend that by two more months, and we would tell you within the first month (article 12.3 GDPR). Exercising your rights is free.

Some data cannot be erased while its legal retention period lasts, such as invoices. In that case we block it and tell you which data and until when. If you ask us to erase an order or download that is in the GitHub repository, we remove it from the log, but it may remain in the repository's history while we still use it; we will tell you what remains and until when.

If you think we have not handled your rights properly, you can complain to the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid).

8. Security

• All connections to our servers are encrypted (HTTPS).
• Our servers are in Germany. The customer area has its own database, separate from those of our other products.
• For passwords we store only a hash (Argon2). They must have at least 12 characters and cannot be among the most common ones.
• Any account can turn on two-step verification, with an authenticator app and recovery codes. It is mandatory for staff who administer the area.
• We limit sign-in, password recovery and sign-up attempts.
• We email you when your password, your email or your two-step verification changes.
• We make a daily backup of the customer area database. The copy that leaves the server is encrypted and is kept on a computer of ours in Spain.
• What we erase may remain in the backups until they expire, at most after 90 days, both in those on our servers and in the encrypted copy we keep in Spain. In the hub of the Amazon connector, which runs on Odoo.sh, 3 months at most, because Odoo.sh keeps monthly backups for the last three months.
• Version 1.4 of this policy said that what we erase also disappeared from the backups within 30 days at most. That was not accurate: the periods are the ones in this section.
• The security measures of FlexigoTech Cloud are in Annex II of its data processing agreement.

If we suffered a security breach, we would notify the Spanish Data Protection Agency within 72 hours when the law requires it, and the people affected if it poses a high risk to them (articles 33 and 34 GDPR).

9. Minors

Our website, our modules and FlexigoTech Cloud are aimed at businesses and professionals, not at children under 14 (article 7 LOPDGDD). You must be of legal age to open an account or buy.

10. Data we process on behalf of our customers

Our modules and connectors run inside each customer's Odoo. The data they handle (orders, invoices, customers) belongs to the customer, who is its controller, and stays in their installation. When a connector passes data through one of our servers, or when we provide support with access to a customer's Odoo, we process it on their behalf, only for that purpose and under the data processing agreement we sign with them (article 28 GDPR). If you are a customer of one of our customers, ask that company for your rights; if you write to us, we will pass your request on to them.

What FlexigoTech Cloud processes on behalf of our customers (the credentials of their platforms, the notifications and business data that pass through the cloud, and the metrics and errors their Odoo sends) is governed by the FlexigoTech Cloud data processing agreement, which forms part of the subscription terms. It sets out its sub-processors, its security measures and when the data is deleted.

The authorisation that connects our connector to the seller's Amazon account goes through our Odoo instance on Odoo.sh.

For data our connector obtains from the Amazon Selling Partner API, we also commit to:

• using it only to manage and fulfil the seller's orders;
• not keeping buyers' personal data longer than needed to fulfil the orders and meet legal obligations;
• encrypting it in transit and at rest and limiting access to those who need it;
• reporting any security incident affecting Amazon data to Amazon within 24 hours of detecting it, and to the seller within the same period, so that, as controller, it can notify its supervisory authority where applicable (article 33 GDPR);
• not sharing it with unauthorised third parties.

11. Changes to this policy

Each version has a number and a date, and previous versions remain available in the customer area. If a change affects how we use your data, we will tell you by email or in your account before it applies.

Version 1.5. DRAFT (BORRADOR) of 07-10-2026, pending review and approval by the sole director of Flexibles y Accesorios Gobe, S.L.