Privacy Policy

Last updated: 22 September 2026.

1. Who we are

This Privacy Policy is issued by GEO Advisor, Inc., a Delaware corporation doing business as flowscope (“flowscope”, “we”, “us”, “our”). It describes how we collect, use, share, retain, and protect personal information, and what rights you have.

This Privacy Policy applies to:

• Visitors to our website at https://flowscope.com and any page or subdomain that links to this Privacy Policy.
• Employees of our customers whose business-application activity is captured by the flowscope Chrome extension or desktop application, where that capture has been authorized by their employer.
• People who contact us, request a demo, or otherwise interact with us in a business context.

For data collected about website visitors and people who contact us directly, we act as a controller. For data captured from employees on behalf of their employer, we act as a processor. The employer is the controller, and the employer’s own privacy notice governs the employer-employee relationship.

2. Information we collect

2.1 Information you provide directly

• Contact details (name, email address, company, role) when you request a demo, sign up, or contact us.
• Account authentication data when you register for product access.
• The contents of messages you send us.

2.2 Information captured by the flowscope extension or desktop application

When your employer installs the flowscope extension or desktop application on your device and authorizes capture, we collect business workflow events generated while you use the applications your employer has approved. This can include:

• Click, keyboard shortcuts (modifier and named keys, not raw typing), navigation, copy, and paste events on approved applications.
• Element context: labels (e.g. “Approve”, “Submit Invoice”), field placeholders, section headings, and page titles.
• Committed field values, clipboard and paste content, and selected text on approved applications, after redaction of personal-data entities.
• URLs and timestamps of activity on approved domains.
• Session identifiers and a stable user identifier for your account.
• The work email address configured by your employer’s administrator.

We do not knowingly collect:

• Content from applications or websites your employer has not approved for capture (personal email, personal banking, health portals, and similar).
• Password values.
• Biometric identifiers.
• Information from users under 18.

You can see whether capture is active and pause capture at any time.

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

2.3 Information collected automatically on our website

Our website uses Google Analytics 4 (Google LLC) for usage analytics. It sets first-party cookies and processes device identifiers, IP addresses, pages visited, session duration, referrer, device characteristics, and interaction events in the United States.

Our website also uses Maverick Intelligence Inc. for B2B visitor identification (Section 2.4).

Our website also loads the LinkedIn Insight Tag (LinkedIn Corporation) for advertising measurement and retargeting. It processes device identifiers, IP address, pages visited, referrer and the LinkedIn cookie in the United States. It loads only after you accept cookies in the cookie banner; choosing Decline opts you out (Section 10).

2.4 Information collected by B2B visitor identification

We use a third-party B2B visitor identification service to identify the organization associated with visitors to our website, and (for visitors located in the United States) the individual professional contact associated with the visit. The provider identifies you from your visit and from identity data it holds from partner websites. For visitors outside the United States, the service identifies the organization only.

This service runs only after you accept analytics and identification cookies.

3. How we use information

We use personal information to:

• Provide, maintain, improve, and secure the flowscope Services.
• Map and analyze business processes for our customers.
• Respond to demo requests, customer-support enquiries, and other communications.
• Send administrative messages (security notices, policy updates, invoicing).
• Detect, prevent, and investigate fraud, abuse, and security incidents.
• Comply with legal obligations, enforce our agreements, and defend our legal rights.
• Operate and improve our marketing website.

Where required by law, we rely on the following legal bases: contract performance (providing the Services you or your employer have engaged us to provide), legitimate interests (product improvement, security, business administration), consent (analytics cookies and marketing communications, where consent is required), and legal obligation (tax, accounting, and responses to lawful requests).

Where flowscope creates deidentified data from customer use of its software, flowscope maintains and uses that data only in deidentified form and does not attempt to reidentify it, except solely to test whether its deidentification processes comply with applicable law.

4. Artificial intelligence

flowscope uses a third-party large-language-model provider to generate workflow summaries, process analyses, and related outputs. Our agreement with this provider prohibits use of the data we submit to train its models. The current provider is listed at trust.flowscope.com/subprocessors.

5. How we share information

We share personal information only as described below:

• Service providers who operate parts of our infrastructure and this website under written contracts that restrict their use of personal information. For the website, where flowscope is the controller, they are:

Subprocessors of customer data, for which flowscope acts as a processor, are listed at trust.flowscope.com/subprocessors.

• Your employer, when we are acting as their processor and delivering analytics, reports, or other outputs derived from workforce-captured data.
• Law enforcement, regulators, and other authorities, when we believe in good faith that disclosure is required by law, court order, or similar legal process.
• Successors, in connection with a merger, acquisition, financing, reorganization, or sale of all or substantially all of our assets.

We do not sell or rent personal information. Website-visit data is shared with LinkedIn Corporation for advertising through the LinkedIn Insight Tag, which loads only after you accept cookies in the cookie banner; choosing Decline opts you out.

6. How long we keep information

We retain personal information for as long as we have a business need, as required to provide the Services, or as required by law.

• Workforce-captured data (data we process on behalf of an employer): retained, returned and deleted as instructed by the employer under our agreement with it.
• Website-visitor and demo-request data: retained until you request deletion, or until we no longer have a legitimate business need, whichever is earlier.
• Account-level and billing information: retained for the life of the account plus any period required by law (seven years for financial records).
• Backups: deleted at the end of the backup rotation cycle.

You can request deletion of your personal information at any time (Section 9).

7. Security

We apply administrative, technical, and physical safeguards to protect personal information.

We notify affected customers and, where required, the supervisory authority of a personal data breach within 72 hours of becoming aware of it. Where the law requires it, we notify affected individuals without undue delay.

8. International transfers

Our infrastructure and our subprocessors' infrastructure are located in the United States. If you access our Services from outside the United States, your personal information will be transferred to, stored in, and processed in the United States.

Where a customer is subject to the GDPR or the UK GDPR, flowscope processes that customer's workforce personal data under the customer agreement, which incorporates the EU Standard Contractual Clauses and, for UK data, the UK Addendum as the transfer mechanism. For the personal data described in this policy (website visitors, leads, and account contacts), transfers to our service providers rest on the provider's EU-US Data Privacy Framework certification or on the EU Standard Contractual Clauses. You can request a copy of the safeguards at legal@flowscope.com.

Our representative in the European Union under Article 27 GDPR is Instant EU GDPR Representative Ltd, Office 2, 12A Lower Main Street, Lucan, Co. Dublin, K78 X5P8, Ireland (contact@gdprlocal.com, +353 1 554 9700). Individuals in the EEA may contact the representative on all matters related to our processing of their personal data, in addition to or instead of contacting us, including through its request page at geoadvisorinc.gdprlocal.com/eu.

9. Your privacy rights

Depending on where you live, you may have some or all of the following rights:

• Access: ask what personal information we hold about you.
• Correction: ask us to correct inaccurate information.
• Deletion: ask us to delete your personal information.
• Portability: receive a copy of your information in a structured, commonly used, machine-readable format.
• Restriction or objection: ask us to stop or limit certain uses of your personal information.
• Withdrawal of consent: where processing is based on consent, withdraw it at any time.
• Complaint: lodge a complaint with a supervisory authority. For data subjects in Spain this is the AEPD; for the UK, the ICO.
• Non-discrimination: exercise these rights without being penalized for doing so.

To exercise any of these rights, email legal@flowscope.com. We verify your identity before we respond. We respond within the time the applicable law requires: one month under the GDPR, 45 days under the CCPA. If your data was captured by the flowscope extension or agent, your employer is the controller. We forward your request to your employer and direct you to them.

California residents. Under the California Consumer Privacy Act and the California Privacy Rights Act, you have the rights listed above, plus the right to know the specific categories of personal information we have collected, the sources, the purposes, and the categories of third parties with whom we have shared it. The categories we collect are: identifiers (name, email, IP address, online identifiers); internet or other electronic network activity information (captured workflow events on employer-approved applications; website traffic); professional or employment-related information (company, role, work email); and inferences drawn from the above (derived workflow models). We do not sell personal information. Sharing for cross-context behavioral advertising is limited to the LinkedIn Insight Tag on our website, which loads only after you accept cookies; to opt out, choose Decline in the cookie banner or change your choice with the button in Section 10.

10. Cookies and tracking technologies

We use cookies and similar technologies for authentication, security, site functionality, analytics, and advertising. Google Analytics 4 sets first-party cookies for usage analytics. Where we use a B2B visitor identification service (see Section 2.4), it may also set first-party cookies. The LinkedIn Insight Tag (LinkedIn Corporation) sets LinkedIn cookies for advertising measurement and retargeting.

Analytics, visitor-identification and advertising cookies load only after you accept them in the cookie banner. To change your choice, use the button below.

We do not respond to “Do Not Track” browser signals.

11. Children

The Services are intended for users who are at least 18 years old and who are using the Services in a business, employment, or similar professional context. We do not knowingly collect personal information from anyone under 18. If you believe we hold personal information from a person under 18, contact us at legal@flowscope.com.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent change. For material changes, we will provide reasonable notice through the website or by direct communication where appropriate.

13. Contact us

GEO Advisor, Inc. (d/b/a flowscope) c/o Legalinc Corporate Services Inc. 131 Continental Drive, Suite 305 Newark, DE 19713 United States

Email: legal@flowscope.com

Our registered agent is authorized to accept service of process on our behalf.