Privacy Policy

1. Introduction

GenticFlow Ltd. ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our IT support platform and services.

2. Data Controller and Processor

For Personal Data processed on behalf of a subscribing organization, our role depends on the activity. An organization using GenticFlow for its own internal IT generally acts as Controller, and we act as Processor. Where a managed service provider ("MSP") uses GenticFlow on behalf of its clients ("MSP Clients"), the MSP may act as Processor and we act as Subprocessor for the underlying Controller. Applicable US roles, including Business and Service Provider under California law, are determined by the relevant law and processing. An MSP may separately act as Controller for its own workforce or administration.

"Organization Data" means data submitted to or collected by the Service on an organization's behalf, including endpoint diagnostics, support content, and MSP Client data. We process Personal Data within Organization Data under the Data Processing Agreement (DPA) and authorized instructions, including configured support workflows, end-user chat, and portal interactions.

We act as Controller for separate activities where we determine the purposes and means, such as managing our account and billing relationships, business communications, marketing contacts, and public website analytics. Security and telemetry activities are assessed according to their actual purpose and context; describing an activity here does not authorize independent reuse of Organization Data contrary to the DPA. For processing on an organization's behalf, the DPA controls if this Policy conflicts with it.

3. Information We Collect

3.1 Information You Provide

• Account information (name, email, company details)
• Sign-in information from your organization's identity provider when single sign-on is enabled (such as name, email, and profile attributes)
• Contact information for support requests
• Payment and billing information (full payment card details are processed by our payment processor and are never stored on our systems)
• User-generated content (support tickets, chat messages, and uploaded documents and knowledge content)

3.2 Information Collected Automatically

• Endpoint diagnostic data (system logs, hardware info, software inventory)
• Support activity details (timestamps, participants, commands, approvals, and remediation records)
• Usage data (feature usage, session duration, interaction patterns), including data on user interaction with AI features and automation workflows
• Technical data (IP addresses, browser type, device information)
• Mobile app data (device identifiers and push notification tokens) when you use our mobile applications
• Performance and error logs

4. How We Use Your Information

We use collected information to:

• Provide and maintain our IT support services
• Gather real-time endpoint diagnostics for troubleshooting
• Process payments and send billing notifications
• Respond to support requests and improve support services
• Analyze usage and performance to operate and improve the Service, including the quality of AI-assisted support, only within the purposes, instructions, and restrictions applicable to the data; this does not involve training AI models on Organization Data or building fine-tuning datasets from it
• Comply with legal obligations and enforce our terms

5. Legal Basis for Processing (GDPR)

Where we act as Controller and GDPR or UK GDPR applies, we rely on the following grounds as appropriate to the processing. For data processed on an organization's behalf, that organization or its upstream Controller establishes the lawful grounds and we act under the DPA.

• Contract Performance: Processing necessary to perform a contract with you as an individual or take steps you request before entering that contract
• Legitimate Interests: Administering business relationships, communicating with organization representatives, securing our operations, preventing fraud, and permitted service improvement and analytics, where those interests are not overridden by your rights
• Legal Obligation: Tax records, regulatory compliance, and responding to lawful requests
• Consent: Marketing communications and non-essential cookies where consent is legally required; you may withdraw consent without affecting the lawfulness of earlier processing

6. AI and Machine Learning

GenticFlow Ltd. uses AI and machine learning, including large language models operated by third-party providers, to deliver the Service's support features, such as issue investigation, recommended fixes, and end-user chat. AI processing is an integral part of the Service:

• Data relevant to a support case may be processed by AI models to generate findings, responses, and recommendations
• We apply automated controls designed to detect and redact certain sensitive values before sending prompts to AI providers. These controls may not identify every sensitive value and do not make all submitted content anonymous. Organizations should minimize sensitive content and follow the data restrictions in the Terms and DPA.
• We use third-party AI providers (listed in our DPA) under strict data processing agreements
• We do not use Organization Data to train our own AI models. We select third-party AI providers whose commercial API terms state that data submitted through their APIs is not used to train their models; the providers we use are listed in our DPA. An organization's independently selected model provider or API account is also subject to its own agreement and settings with that provider.

7. Data Security

We maintain security measures appropriate to the nature of the data and risks of processing, as described in the DPA, including:

• Encryption in transit using TLS for all connections
• Application-layer encryption of sensitive fields with per-tenant key separation
• Role-based access controls with custom roles
• Two-factor authentication with TOTP and FIDO2 passkeys
• Endpoint agents run with the permissions necessary for support functions, with audited command execution
• Complete command history with outputs, approvals, and verification results for endpoint operations

8. Data Sharing and Disclosure

We do not sell your personal information. Personal Data processed on an organization's behalf is also subject to the DPA's prohibitions on sale, sharing for cross-context behavioral advertising, and targeted advertising. We may disclose data for the purposes described in this Policy and subject to the DPA where applicable:

• Service Providers: Hosting, AI-assisted support, communications, payment processing, and analytics providers under agreements appropriate to their processing roles; our Subprocessors are subject to the DPA
• Your Organization and MSP: Authorized administrators, technicians, and the MSP managing your environment may access support content, diagnostics, and activity information according to the organization's permissions and instructions
• Legal Requirements: When required by law, court order, or government request
• Business Transfers: In connection with a merger, acquisition, or asset sale, subject to appropriate confidentiality protections, applicable law, and continuing DPA obligations for Organization Data

9. Aggregated and Anonymized Data

Where permitted by the DPA and applicable law, we may create aggregated or de-identified information for analytics, benchmarking, product improvement, and industry reports. We take reasonable measures to prevent de-identified information from being associated with, or used to infer information about, an identifiable individual or household. We publicly commit to maintaining and using it in de-identified form and not attempting re-identification, except solely to test our de-identification processes where expressly permitted by law. Recipients of de-identified information must contractually comply with applicable safeguards and restrictions. Information that remains identifiable or reasonably linkable, including pseudonymized information, remains Personal Data and subject to the relevant protections.

10. Third-Party Integrations

When you enable integrations with third-party services (such as Microsoft, Google, or other vendors):

• Data shared with third parties is governed by their respective privacy policies
• You control which integrations are enabled and what data is shared
• Independent third-party providers are responsible for their own processing practices; this does not exclude our obligations for our disclosures or our Subprocessors under the DPA
• Disabling an integration may affect related Service functionality

11. Cookies and Tracking

We use cookies and similar technologies to:

• Essential Cookies: Required for Service functionality and security
• Analytics Cookies: Help us understand usage patterns and improve the Service
• Preference Cookies: Remember your settings and preferences

On our public marketing website at genticflow.com (and only on the marketing website - never inside the authenticated GenticFlow application), we use Google Analytics 4. It is loaded only after you accept cookies in regions that require consent or where your region is unknown. A saved decline prevents analytics collection in every region:

• Google Analytics 4: Aggregated page views, traffic sources, and conversion events. Marketing website only.

You can manage cookie preferences through your browser settings or at any time via the Cookie Preferences link in the website footer, which opens the consent banner in every region so you can accept or decline analytics cookies. Your updated choice takes effect without reloading the page. Disabling essential cookies may affect Service functionality.

12. Data Retention

Retention depends on the data category, processing purpose, configured retention settings, and applicable legal obligations. Personal Data processed on an organization's behalf is subject to its authorized instructions and the DPA, including the return and deletion periods after termination. We use the following criteria for separate processing in our own capacity:

• Account and business contact records: For the relationship and any limited period needed to close the account, resolve disputes, or meet applicable recordkeeping requirements
• Billing and tax records: For the period required by applicable tax and accounting law
• Marketing records: While relevant to a permitted marketing relationship, with limited suppression records retained as needed to honor opt-outs
• Website analytics and security records: For the period reasonably needed for the stated analytics or security purpose, subject to applicable settings and legal requirements

We delete or de-identify data when it is no longer required for these purposes. Legally required retention is limited to the relevant records and purpose. Contact us for information about the retention applicable to your data. The DPA's termination periods do not defer an individual's applicable rights-request deadline.

13. Your Rights and Request Routing

Depending on applicable law, our role, and any lawful exceptions, your rights may include:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Export your data in a machine-readable format
• Restriction: Limit how we process your data
• Objection: Object to processing based on legitimate interest
• Withdraw Consent: Withdraw consent at any time for consent-based processing
• Automated Decisions: Not be subject to decisions based solely on automated processing that significantly affect you
• Complaint: Lodge a complaint with your local data protection supervisory authority

GenticFlow is intended for IT investigation, support, and authorized remediation under policies configured by an organization. Its AI features are not offered for recruitment, employee ranking, evaluation of worker performance or behaviour, employment decisions, or task allocation based on individual behaviour or personal characteristics. These uses are restricted under Section 3 of the Terms of Service. Whether a deployment constitutes regulated profiling or automated decision-making depends on the facts and applicable law. Each party retains its own legal duties, including any provider and transparency obligations applicable to GenticFlow; an organization's assessment or use of oversight controls does not remove those duties. The Service does not certify that every configured use falls outside those laws.

If your data is managed by your employer, another organization, or an MSP, contact that organization or MSP first. We assist the subscribing organization under the DPA. Requests concerning MSP Client data are normally routed through the MSP; we may acknowledge and redirect a request but do not independently decide it or disclose, alter, or delete Organization Data without authorized instructions unless law requires us to do so.

For processing where we act as Controller, or if you need help identifying the appropriate contact, email [email protected]. We may request information reasonably necessary to verify your identity or an authorized agent's authority and locate the relevant data. We respond within the period required by applicable law; under GDPR this is normally one month, with any permitted extension explained within the initial period. Mandatory rights are not limited by the commercial liability provisions in our Terms.

14. US State Privacy Rights

Where the CCPA or another US State Privacy Law applies, and subject to its scope and exceptions, residents may have rights to:

• Access and Portability: Know about processing and obtain access to personal information, including a portable copy where required
• Correction and Deletion: Correct inaccurate personal information and request deletion
• Opt-Out: Opt out of sale, sharing for cross-context behavioral advertising, targeted advertising, or qualifying profiling, where applicable
• Sensitive Information: Limit certain uses and disclosures of sensitive personal information or exercise applicable consent rights
• Appeal: Appeal a rights-request decision where state law provides that right
• Non-Discrimination: Exercise rights without unlawful discrimination; we do not offer financial incentives in exchange for retaining or selling personal information

Submit a request, including through an authorized agent where permitted, to [email protected]. To appeal a decision where applicable, use the same address and identify the decision you wish reviewed. We will explain our response and any available further complaint route within the applicable statutory period. For Personal Data processed on an organization's behalf, Section 13's routing process applies and we assist that organization with the request or appeal. Our website analytics and cookie controls are described in Section 11; the DPA's restrictions concern processing on an organization's behalf.

15. Marketing Communications

We may send you promotional communications about our services. You can opt out at any time by:

• Clicking "unsubscribe" in any marketing email
• Updating your communication preferences in account settings
• Contacting us at [email protected]

Opting out of marketing does not affect transactional communications (billing, security alerts, service updates).

16. International Data Transfers

Your data may be transferred to and processed in countries outside your residence. We ensure appropriate safeguards through:

• Standard Contractual Clauses (EU approved)
• Data Processing Agreements with all subprocessors
• Applicable UK transfer safeguards where required, as described in the DPA
• Any regional hosting commitments expressly agreed in your order; a hosting region does not by itself mean every support, integration, or Subprocessor activity occurs in that region

17. Children's Privacy

Account holders must be at least 18. The Service is intended for organizational IT use and is not directed to children. Organizations must not use the Service to collect children's information unlawfully and must establish any required authority and safeguards for managed endpoint data. If you believe a child has provided data improperly, contact us. We will assess the report and take action required by law, coordinating through the relevant organization or MSP for data processed on its behalf rather than independently deleting its records without authority.

18. Changes to This Policy

We may update this Privacy Policy as our practices or legal requirements change. We will give subscribing organizations at least 30 days' notice of material changes via email or platform notification, unless a shorter period is required by law, and provide any additional notice or consent process required for affected individuals. Continued use does not substitute for consent where consent is legally required or waive statutory rights. MSPs are responsible for forwarding relevant notices under the DPA. Keep your account contact information current and review the published update date.

19. Contact Us

For questions about this Privacy Policy or to exercise your data rights, contact us at [email protected].

Data protection contact: [email protected]

GenticFlow Ltd.
Dublin, Ireland