Privacy policy

This Privacy Policy explains how Fastflo LLC (“Fastflo”, “we”, “us” or “our”) collects, uses, shares and safeguards personal information. It applies to:

• Visitors to the websites and pages we operate (the “Sites”);

• Prospective and current business customers, their personnel and other business contacts;

• Individuals who interact with our products and services (the “Services”), including integrations with applicant tracking systems (ATS), calendar services and messaging channels such as WhatsApp Business, iMessage and SMS;

• Job applicants who apply to work at Fastflo.

Where Fastflo processes personal data as a processor on behalf of a business customer, for example the data of candidates who apply to a customer’s job through a Fastflo application flow, the customer is the controller and its privacy notice governs. Our role and obligations as a processor are set out in our Data Processing Addendum (“DPA”) and summarized in Section 3 below.

1) Who We Are and How to Contact Us

Controller (for the Sites and our direct business relationships): Fastflo LLC, a Delaware limited liability company, 254 Chapman Road, Suite 208 #24701, Newark, DE 19702, United States.

Data protection contact: privacy@fastflo.ai. Fastflo has appointed a Data Protection Officer, who can be reached at this address.

EU and UK representative: Fastflo has appointed a representative in the European Union and in the United Kingdom pursuant to Article 27 GDPR and Article 27 UK GDPR. The representative can be contacted at privacy@fastflo.ai or by post at the address above, marked “Attention: EU/UK Representative”.

2) Personal Information We Collect

2.1 Information you provide directly

• Business contact details (name, work email, job title, company, phone) when you request a demo, subscribe to updates or contract with us.

• Account and administrator data for the Services (names, emails, roles and permissions, usage preferences).

• Content you submit (support requests, survey responses, feedback).

• Recruitment data for Fastflo roles (CV or resume, cover letter, employment history, qualifications, interview notes).

2.2 Information we receive from your organization or third parties

• ATS data (for example from Workday or another ATS) and scheduling or calendar data transmitted by or for a business customer to enable the Services.

• Google account and Google Calendar data when you sign in with Google or connect your Google Calendar to Fastflo (see Section 13).

• Microsoft account and Outlook calendar data when you sign in with Microsoft or connect your Outlook calendar, used in the same way and under the same limitations as described for Google data in Section 13.

• Messaging identifiers (for example WhatsApp numbers) and conversation metadata supplied or authorized by a customer for recruiting communications.

• Partners and vendors may provide contact details and usage or engagement information.

2.3 Information collected automatically

• Log and device data (IP address, browser type, device identifiers, pages viewed, referring and exit pages, timestamps).

• Usage analytics (feature interactions, performance metrics, crash and diagnostic data).

• Cookies and similar technologies, as described in our Cookie Notice.

We do not intentionally collect sensitive personal data via the Sites. Where the Services process special categories of data at a customer’s direction (for example disability accommodations), this occurs under the DPA and the customer’s lawful basis and notices.

3) Candidate Data We Process on Behalf of Employers

When a candidate applies to a job through a Fastflo application flow, the employer (our customer) decides what information is requested and why. Fastflo processes that information strictly on the employer’s instructions, as its processor. In summary:

• Fastflo captures and organizes the application; it does not evaluate, score, rank or profile candidates, and no hiring or selection decision is made or recommended by Fastflo or by automated means. All decisions are taken by the employer’s recruiters.

• For employers established in the EEA, the UK or Switzerland, candidate data is stored and processed exclusively in Frankfurt, Germany (AWS eu-central-1), and all of our subprocessors for those customers process data exclusively within the EU/EEA. For employers in other regions, candidate data is stored and processed in the United States.

• Candidate data is automatically and permanently deleted from Fastflo 60 days after the candidate’s final status change in the employer’s process, or 60 days after the last activity on the application, unless the employer configures a shorter period. Where the employer has integrated its ATS, the copy held there is governed by the employer’s own retention rules.

• Optional AI features, where the employer has enabled them, are used only to phrase application messages conversationally and to interpret candidates’ free-text replies. They are never used to screen or assess candidates, and candidate data is never used to train any AI model. Employers can have AI features disabled for their organization entirely.

• If you are a candidate and wish to exercise your data protection rights, please contact the employer you applied to; we will support the employer in responding. You may also contact us at privacy@fastflo.ai and we will forward your request.

4) How We Use Personal Information (Purposes and Legal Bases)

We use personal information to:

• Provide and operate the Sites and Services; create and manage accounts; provide integrations (ATS, calendar, messaging channels) and customer support (performance of a contract; legitimate interests).

• Secure the Services, prevent fraud and abuse, troubleshoot and perform diagnostics (legitimate interests; legal obligations).

• Improve and develop the Services, including analytics, research and quality assurance on aggregated or de-identified data (legitimate interests). This does not apply to candidate data processed for customers, or to Google or Microsoft user data, which we use only as described in Sections 3 and 13.

• Communicate with you about product updates, security notices and administrative messages (performance of a contract; legitimate interests).

• Recruit candidates and manage applications for Fastflo roles (legitimate interests; consent where required).

• Comply with laws and regulations and enforce our agreements (legal obligations; legitimate interests).

If we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.

5) How We Share Information

We do not sell personal information. We may share personal information with:

• Service providers and subprocessors who host, store, transmit or otherwise process data for us (for example cloud infrastructure, messaging delivery, email, monitoring and support tooling). They are bound by written contracts to protect your information and use it only on our instructions. Our current list of subprocessors, including the location of processing, is available upon request at privacy@fastflo.ai.

• Business partners involved in providing or integrating the Services (for example ATS providers, calendar providers and messaging platforms) as instructed by you or your organization.

• Professional advisers (legal, accounting, insurance) under confidentiality.

• Authorities where required by law or to protect rights, safety and security.

• Parties to a corporate transaction (merger, acquisition, financing or sale), subject to customary safeguards.

When we act as a processor for a customer, we share data only as permitted by that customer and our DPA.

6) Where We Process Data and International Transfers

Fastflo LLC is established in the United States. Where your data is processed depends on your relationship with us:

• Customers established in the EEA, the UK or Switzerland, and the candidates who apply to them: all Service data, including candidate data, is hosted and processed exclusively in Frankfurt, Germany (AWS eu-central-1), and all subprocessors for those customers process data exclusively within the EU/EEA. Where Fastflo personnel located outside the EU/EEA require limited remote access for support or maintenance, that access is governed by the EU Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), which are incorporated into our DPA.

• Customers established elsewhere: Service data is hosted and processed in the United States unless otherwise agreed.

• Website visitors and business contacts: this information may be processed in the United States and other countries where we or our service providers operate. Where required, we rely on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum or another lawful transfer mechanism.

Details of the safeguards we use are available in our DPA and upon request.

7) Data Retention

We retain personal information for as long as necessary to fulfil the purposes described in this Policy, including to comply with legal, accounting or reporting requirements, resolve disputes and enforce agreements. In particular:

• Candidate data processed for customers: deleted 60 days after final status change or last activity, as described in Section 3, and in any event returned or deleted within 30 days after the end of our agreement with the customer.

• Customer account data: for the duration of the customer relationship; inactive user accounts are automatically deactivated, and account data is deleted at the end of the relationship.

• Business contact and marketing data: until you unsubscribe or ask us to delete it, or until it is no longer needed for the relationship.

• Applicants for Fastflo roles: for the duration of the recruitment process and a reasonable period thereafter, or longer with your consent.

• Google and Microsoft user data: as described in Section 13.

We may retain de-identified or aggregated data for analytics. Encrypted backups are overwritten within our standard backup lifecycle.

8) Security

We operate an information security program aligned with ISO/IEC 27001 (certification expected November 2026). Safeguards include encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256 with managed key rotation), multi-factor authentication and role-based, least-privilege access for our personnel, passwordless single sign-on for customer users, tenant isolation at the database level, logging and monitoring, automated encrypted backups, secure development practices with code review and dependency scanning, annual independent penetration tests, vendor risk management and a documented incident response plan. No method of transmission or storage is completely secure; if we learn of a security incident affecting personal information, we will notify affected parties as required by law. A detailed description of our technical and organizational measures is available to customers upon request.

9) Your Rights and Choices

9.1 EEA, UK and Swiss individuals

Subject to conditions and exceptions under applicable law, you have the right to access, rectify, erase, restrict or object to the processing of your personal data, and to data portability. Where processing is based on consent, you may withdraw consent at any time. You also have the right to lodge a complaint with the data protection supervisory authority of the country in which you live or work or in which the alleged infringement occurred (for example the Austrian Datenschutzbehörde, or the UK Information Commissioner’s Office for UK residents).

9.2 California residents (CCPA/CPRA)

We act as a business for the Sites and our own marketing and HR activities, and as a service provider or contractor when processing data for customers via the Services. Your rights may include: to know and access, correct, delete, opt out of the sale or sharing of personal information, and limit the use of sensitive personal information. We do not sell personal information or share it for cross-context behavioral advertising. To exercise rights, see Section 10.

9.3 Marketing choices and cookies

You can opt out of marketing emails via the unsubscribe link. You can manage cookies via our Cookie Notice and your browser or device settings.

10) How to Exercise Your Rights

Submit requests to privacy@fastflo.ai with your name, email, the nature of your request and your country or state of residence. We may need to verify your identity. Authorized agents may submit requests on your behalf where permitted by law and with appropriate authorization. When we process your information as a processor for a customer, please direct your request to that customer; we will support the customer in responding under our DPA.

11) Children’s Privacy

The Sites and Services are intended for business use and are not directed to children under 16 (or the age defined by local law). Some employers use the Services to recruit for apprenticeships and may accept applications from candidates aged 16 and over, in accordance with the terms of the relevant messaging channel; in those cases the employer is responsible for the lawfulness of the processing. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact privacy@fastflo.ai.

12) Third-Party Links and Services

The Sites may link to third-party websites and services. Their privacy practices are governed by their own policies. Where you use messaging or social platforms (for example WhatsApp Business) or third-party ATS integrations, your use is also subject to those providers’ terms and policies.

13) Google API Services and Google User Data

This section applies when you connect a Google account to Fastflo, for example to sign in with Google or to connect your Google Calendar for interview scheduling. It supplements the rest of this Policy and, in the event of any conflict regarding Google user data, this section controls.

13.1 What we access

With your permission, granted through Google’s consent screen, Fastflo requests access to basic profile information (your name, email address and profile picture) when you sign in with Google, and to your Google Calendar, including the ability to view events on your calendars and to create, update and cancel calendar events, via the Google Calendar API.

13.2 How we use it

We use this access solely to provide Fastflo’s sign-in and interview scheduling features. Profile information is used to create, authenticate and support your Fastflo account. Calendar access is used to check whether a given time slot is busy or free so that interview times offered to candidates do not conflict with your existing commitments, and to create, update or cancel the interview events scheduled through Fastflo. We do not read, analyze or store the contents of calendar events unrelated to interviews scheduled through Fastflo. We do not use Google user data for advertising or marketing, we do not sell it, and we do not use it to develop, improve or train generalized artificial intelligence or machine learning models.

13.3 How we store and protect it

Google user data, including OAuth access credentials, is stored in our secure cloud infrastructure in the region applicable to your organization (Section 6) and protected using the safeguards described in Section 8. Access is restricted to the systems and personnel that need it to operate and support the scheduling and sign-in features.

13.4 How we share it

We do not sell Google user data and we do not transfer it to third parties, except: (a) to the service providers that host and operate the Fastflo platform on our behalf, under contractual confidentiality and data protection obligations; (b) as necessary to comply with applicable law or legal process; (c) to protect against fraud, abuse or security risks; or (d) as part of a corporate transaction as described in Section 5, subject to this section’s limitations.

13.5 Limited Use disclosure

Fastflo’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

13.6 Retention and deletion

We retain Google Calendar data only while your Google Calendar remains connected to Fastflo. If you disconnect your Google Calendar, or your Fastflo account is closed, we delete the stored Google user data associated with that connection, including OAuth credentials and cached availability data, within 30 days. Details of interviews scheduled through Fastflo (such as the time, participants and status of an interview) form part of the recruiting records of the organization using Fastflo and are retained in accordance with Section 7 and our agreement with that organization.

13.7 Your controls

You can disconnect your Google Calendar at any time from your Fastflo settings. You can also revoke Fastflo’s access to your Google account at any time via your Google Account permissions page at https://myaccount.google.com/permissions. To request access to or deletion of your Google user data, email privacy@fastflo.ai.

13.8 Use of artificial intelligence

Where a customer has enabled optional AI features, Fastflo uses large language models provided by Anthropic, accessed through Anthropic’s commercial API, solely to phrase candidate messages conversationally and to interpret candidates’ replies on channels such as WhatsApp and iMessage. Google user data is not used in this functionality. Google Calendar data (including availability, event details and attendee information) and Google account profile data are processed exclusively by Fastflo’s own server-side application logic and are never included in prompts sent to, or otherwise shared with, Anthropic or any other artificial intelligence or machine learning provider. Anthropic does not use inputs or outputs submitted through its commercial API to train its models. Fastflo does not use Google user data to create, train or improve any machine learning or artificial intelligence model, whether our own or a third party’s, and we do not operate any self-hosted or offline AI models that process Google user data.

14) Changes to This Policy

We may update this Policy from time to time. The “Last updated” date at the top of this page reflects the latest changes. Material changes will be announced via the Sites or by direct notice where appropriate. Your continued use of the Sites or Services after an update indicates acceptance.

15) Additional Regional Disclosures

We may provide additional notices for specific regions (for example Brazil, Canada or Australia). Where these apply, they supplement this Policy.

16) Definitions

Personal information or personal data means information that identifies or relates to an identifiable individual. Process(ing) means any operation performed on personal information. Controller or business, and processor or service provider or contractor, have the meanings given in applicable data protection laws.

17) Notice at Collection for California Residents

Categories of personal information collected: identifiers (for example name, email, IP address); commercial information (for example subscription history); internet or technical activity (for example logs, analytics); professional or employment-related information (for example job title); inferences drawn from the foregoing; and for HR applicants, the categories disclosed in Section 2.1.

Sources: you; your organization; our service providers and partners; cookies and trackers; public sources.

Purposes: as described in Section 4.

Disclosure for business purposes: we disclose the above categories to service providers and contractors and, where applicable, business partners, as outlined in Section 5. We do not sell or share personal information for cross-context behavioral advertising.

Retention: see Section 7.

Sensitive personal information: we do not use or disclose sensitive personal information for purposes requiring a right to limit under the CPRA.

Contact

Questions about this Policy? Email privacy@fastflo.ai or write to Fastflo LLC, 254 Chapman Road, Suite 208 #24701, Newark, DE 19702, United States.

‍