Privacy policy

1. Who processes your data

Flexibles y Accesorios Gobe, S.L., which sells software under the FlexigoTech brand.

• Tax ID (NIF): B56727993.
• Registered address: Calle Roger de Llúria 54, principal 1.ª B, 08009 Barcelona (Spain).
• Barcelona Commercial Registry, volume 49059, folio 216, section 8, sheet B-606144, entry 1.
• For anything about your data: comercial@flexigobe.com or +34 616 809 504.

We have not appointed a data protection officer because we are not required to (article 37 GDPR and article 34 LOPDGDD).

Atendyo, another product of this same company, has its own policy for its customers and for the businesses it writes to. This policy covers FlexigoTech's use of Atendyo as the chat on its own website.

2. What data we process, why, on what legal basis and for how long

When a retention period ends, we erase or anonymise the data. If a law requires us to keep it longer, we block it: it is set aside and used only to answer courts or public authorities while liability can still be claimed (article 32 LOPDGDD).

2.1 Your account in the customer area

With your account you download your modules, keep your invoices and licences at hand, get notices about new versions of what you bought and manage your privacy.

2.2 Account security

2.3 What you accept and what you consent to

2.4 Purchases in the shop

Stripe processes the payment. We do not see or store your card details.

Orders are stored on our Netcup servers and, while we still use it, in a private GitHub repository.

2.5 Your licence

2.6 Free downloads

2.7 Emails we send you

Account emails come from cuenta@flexigotech.com and shop emails from comercial@flexigotech.com. If you reply, your reply goes to comercial@flexigotech.com. We write to confirm your email, send you a link to see your purchases, recover your password, warn you about security changes in your account, deliver a purchase or a free download, tell you about a new version of your modules, tell you your copy of your data is ready, warn you before deleting an inactive account and confirm we have deleted it.

New-version notices are part of the updates included in your purchase. Each notice has a link to stop receiving them.

Brevo sends these emails on our behalf. While we change email provider, Brevo adds an invisible image that tells it whether you open the email, and routes the links through its server to count clicks. We do not store opens or clicks in our database. We only look at that record in Brevo's dashboard when we need to check that an email reached you (legitimate interest, article 6.1.f GDPR).

2.8 Marketing news

We only write to you about new modules, offers or changes to our services if you tick the news box, when you sign up or later, in the Privacy section of your account.

2.9 If you write to us

The contact forms go through FormSubmit, which forwards them to us by email. If you write to us on WhatsApp, WhatsApp also processes that conversation under its own terms.

2.10 Connector checker and notices from our free modules

This data goes through Netlify, which hosts the website, and reaches us by email through Brevo.

2.11 Support chat on the website

The chat runs on Atendyo, a program of this same company installed on our server at bot.flexigotech.com. The answers are written by an artificial intelligence model. For each answer we use one of these: Mistral AI (France), Groq (United States), Cloudflare Workers AI (United States) or a model installed on our own server, and we pass it the text of the conversation. Do not write passwords, card details or health data in the chat.

2.12 Booking a video call

2.13 Visits to the website and our servers

2.14 Analytics and advertising

Only if you accept them in the cookie notice, and they are two separate permissions. With analytics, Google Analytics 4 and PostHog record the pages you visit, clicks and page performance. With advertising, Google may use your visit for its advertising lists. The details are in the Cookie Policy.

2.15 Invoicing and accounting

We disclose them to the Spanish Tax Agency when the law requires it and to our tax and accounting advisers, who process them on our behalf.

2.16 Your requests and complaints

2.17 Accounts created on flexigotech.com before the customer area

Accounts opened on flexigotech.com/cuenta.html were stored with Supabase, a United States provider. That service no longer works. If you opened an account there, we will move it to the customer area or delete it, and then erase that data from Supabase.

3. Where the data comes from

You give us almost all of it. Stripe gives us the payment result and the billing details you type on its page, and Brevo tells us whether an email was delivered.

4. Who we share your data with

We do not sell personal data or share it for other companies' advertising. We disclose it to public authorities and courts when a law requires it. These providers process it on our behalf (article 28 GDPR), each only for what is shown:

Two other services receive data without a data processing agreement signed with us, because they do not offer one: FormSubmit (formsubmit.co), which receives what you write in the contact forms and forwards it to us by email, and jsDelivr, a file distribution network with servers in many countries that serves the icons on many flexigotech.com pages and sees your IP address. FormSubmit does not publish a privacy policy. If you would rather your enquiry did not go through FormSubmit, write to us directly at comercial@flexigobe.com.

5. Transfers outside the European Economic Area

Some of the providers in the table in section 4 process data in the United States. Each transfer has to rely on a GDPR safeguard: the adequacy decision on the EU-US Data Privacy Framework of 10 July 2023 (article 45 GDPR), if the provider is certified, or the European Commission's standard contractual clauses (article 46.2.c GDPR). Stripe (Stripe, LLC) and Cloudflare are certified under the Framework. Groq is not, and its safeguard is the standard contractual clauses. For Netlify, GitHub, Calendly, Google, GoDaddy, ImprovMX, PostHog and Supabase we are checking which of the two safeguards applies to each. If you want to know or would like a copy, ask us.

6. Automated decisions

We do not take decisions based solely on automated processing that have legal effects on you or affect you in a similar way (article 22 GDPR). The chat answers automatically, but it does not decide anything about you. The fraud checks Stripe applies to payments are Stripe's own.

7. Your rights

You can ask us for access to your data, its rectification or erasure, object to our processing it, ask us to restrict its use and take it with you in a machine-readable format (articles 15 to 22 GDPR). If you gave us your consent, you can withdraw it at any time, without affecting what we did before (article 7.3 GDPR).

In your account, in the Privacy section, you can download a copy of your data (a JSON file downloaded through a link that is valid for 7 days and only opens with your session signed in), turn the news on or off and delete the account. For anything else, or if you have no account, write to comercial@flexigobe.com or by post to the address in section 1. Any other channel you use to ask us is also valid.

We will not ask for your ID card. If you write from the email of your account or your purchase, that is enough for us. Only if we have reasonable doubts about who you are will we ask for the minimum detail that lets us check (article 12.6 GDPR).

We answer within one month at most. If the request is complex or we receive many, we can extend that by two more months, and we would tell you within the first month (article 12.3 GDPR). Exercising your rights is free.

Some data cannot be erased while its legal retention period lasts, such as invoices. In that case we block it and tell you which data and until when. If you ask us to erase an order or download that is in the GitHub repository, we remove it from the log, but it may remain in the repository's history while we still use it; we will tell you what remains and until when.

If you think we have not handled your rights properly, you can complain to the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid, www.aepd.es).

8. Security

• All connections to the website, the shop, the customer area and the chat are encrypted (HTTPS).
• Our servers are in Germany. The customer area has its own database, separate from those of our other products.
• For passwords we store only a hash (Argon2). They must have at least 12 characters and cannot be among the most common ones.
• Any account can turn on two-step verification, with an authenticator app and recovery codes. It is mandatory for staff who administer the area.
• We limit sign-in, password recovery and sign-up attempts.
• We email you when your password, your email or your two-step verification changes.
• We make a daily backup of the customer area database, and the copy that leaves the server is encrypted.
• What we erase also disappears from the backups within 30 days at most.

If we suffered a security breach, we would notify the Spanish Data Protection Agency within 72 hours when the law requires it, and the people affected if it poses a high risk to them (articles 33 and 34 GDPR).

9. Minors

The website and the shop are aimed at businesses and professionals, not at children under 14 (article 7 LOPDGDD). You must be of legal age to open an account or buy.

10. Data we process on behalf of our customers

Our modules and connectors run inside each customer's Odoo. The data they handle (orders, invoices, customers) belongs to the customer, who is its controller, and stays in their installation. When a connector passes data through one of our servers, or when we provide support with access to a customer's Odoo, we process it on their behalf, only for that purpose and under the data processing agreement we sign with them (article 28 GDPR). If you are a customer of one of our customers, ask that company for your rights; if you write to us, we will pass your request on to them.

The authorisation that connects our connector to the seller's Amazon account goes through our Odoo instance on Odoo.sh.

For data our connector obtains from the Amazon Selling Partner API, we also commit to:

• using it only to manage and fulfil the seller's orders;
• not keeping buyers' personal data longer than needed to fulfil the orders and meet legal obligations;
• encrypting it in transit and at rest and limiting access to those who need it;
• reporting any security incident affecting Amazon data to security@amazon.com within 24 hours of detecting it, and to the Spanish Data Protection Agency within 72 hours where applicable (article 33 GDPR);
• not sharing it with unauthorised third parties.

11. Changes to this policy

Each version has a number and a date, and previous versions remain available in the customer area. If a change affects how we use your data, we will tell you by email or in your account before it applies.

Approved on 30 September 2026 by the sole director of Flexibles y Accesorios Gobe, S.L.