Flowtusk logoFlowtusk

Legal

Privacy Policy

Last updated: 30 March 2026 · Effective date: 30 March 2026

This Privacy Policy describes how Makeshift Digital Oy (“we”, “us”, “our”), the operator of Flowtusk, collects, uses, stores, and transfers personal data. We are committed to protecting your privacy in accordance with the EU General Data Protection Regulation (GDPR) 2016/679, the Finnish Data Protection Act (1050/2018), and the Act on the Protection of Privacy in Electronic Communications (516/2004).

1. Data Controller

The data controller responsible for your personal data is:

Makeshift Digital Oy
Business ID (Y-tunnus): 3429015-7
Eerinkatu 28, 00180 Helsinki, Finland
Email: [email protected]

2. Personal Data We Collect

2.1 Account and Contact Data

  • Name and email address (when you sign up or contact us)
  • Company name and job title
  • Billing address and payment information (processed by our payment provider)

2.2 Usage and Technical Data

  • IP address and browser type
  • Pages visited, time spent, and clickstream data
  • Integration configuration data (e.g. connected Webflow forms, HubSpot pipeline settings)
  • Log data and error reports

2.3 Form Submission Data (Processed on Your Behalf)

Flowtusk processes Webflow form submissions on behalf of our customers. This data is considered customer data and we act as a data processor for it. See our Data Processing Agreement.

3. Legal Basis for Processing

  • Contract performance (Art. 6(1)(b)) — to provide the Flowtusk service you have subscribed to
  • Legitimate interests (Art. 6(1)(f)) — to improve our service, prevent fraud, and ensure security
  • Legal obligation (Art. 6(1)(c)) — to comply with Finnish and EU law (e.g. accounting, invoicing)
  • Consent (Art. 6(1)(a)) — for marketing communications and non-essential cookies (you may withdraw at any time)

4. How We Use Your Data

  • Providing, maintaining, and improving the Flowtusk service
  • Processing payments and sending invoices
  • Sending transactional emails (account, billing, security alerts)
  • Sending marketing emails, where you have consented
  • Complying with legal obligations under Finnish and EU law
  • Preventing misuse, fraud, and ensuring platform security

5. Data Sharing and Third Parties

We do not sell your personal data. We may share data with:

  • Amazon Web Services (AWS) — cloud infrastructure and data storage
  • PostHog — product analytics and event tracking
  • Webflow, HubSpot, Slack — as part of service integrations you explicitly configure
  • Legal authorities — when required by Finnish law or a court order

All third-party processors are contractually bound to process data only on our instructions and in compliance with GDPR.

6. International Data Transfers

Some of our service providers are located outside the EU/EEA. When we transfer personal data to third countries, we ensure an adequate level of protection through European Commission adequacy decisions or Standard Contractual Clauses (SCCs) approved by the European Commission.

7. Data Retention

  • Account data: retained for the duration of the contract plus 3 years (Finnish statute of limitations)
  • Accounting and invoice data: 7 years (Finnish Accounting Act, kirjanpitolaki 1336/1997)
  • Log and usage data: up to 12 months
  • Marketing consent: until withdrawn

Upon account deletion, we will delete or anonymise your personal data within 30 days, except where retention is required by law.

8. Your Rights Under GDPR

  • Right of access (Art. 15) — request a copy of your personal data
  • Right to rectification (Art. 16) — correct inaccurate data
  • Right to erasure (Art. 17) — request deletion (“right to be forgotten”)
  • Right to restriction of processing (Art. 18)
  • Right to data portability (Art. 20) — receive your data in a machine-readable format
  • Right to object (Art. 21) — object to processing based on legitimate interests or for direct marketing
  • Right to withdraw consent — at any time, without affecting prior processing

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

9. Right to Lodge a Complaint

You have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutettu):

Office of the Data Protection Ombudsman
PO Box 800, 00521 Helsinki, Finland
Email: [email protected]
Website: tietosuoja.fi

10. Cookies

We use cookies and similar tracking technologies. For detailed information, see our Cookie Policy.

11. Children’s Privacy

Flowtusk is a B2B service intended for business use only. We do not knowingly collect personal data from individuals under 16 years of age. If you believe a minor has provided us with personal data, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notice at least 30 days before taking effect. The “Last updated” date at the top of this page reflects the most recent revision.

13. Contact Us

Makeshift Digital Oy — Privacy Enquiries
Eerinkatu 28, 00180 Helsinki, Finland
Email: [email protected]