Privacy Notice — Flow IT BV / Ask Eve AI
Version: 1.0 Last updated: 21 September 2026 Language: English (translation of the Dutch source text)
1. Who we are
This privacy notice is issued by Flow IT BV, trading as Ask Eve AI. It covers Ask Eve AI only. Other activities of Flow IT BV fall outside its scope.
- Registered office: Toekomststraat 62, 9800 Deinze, Belgium
- Company number: BE 0877.273.542
- Email for privacy matters: privacy@askeveai.com
- Website: https://askeveai.com
We have not appointed a Data Protection Officer, as we are not legally required to do so. You can raise any question with us at the address above.
2. What this notice covers
This notice describes how we handle personal data where we decide why and how it is processed. That applies to:
- visitors to askeveai.com;
- people who contact us or leave their details with us;
- users with an account on the Ask Eve AI platform;
- contacts at our customers, partners and suppliers;
- job applicants.
When this notice does not apply
Our customers use the Ask Eve AI platform to communicate with their own visitors and customers, for instance through a chat assistant on their website. For those conversations, our customer decides why and how the data is processed. We act as a processor there and follow their instructions only.
If you have spoken to a chat assistant on another company's website and want to know what happens to your data, please contact that company. We are not permitted to access, change or delete that data on our own initiative. If you are not sure who to approach, email us and we will point you in the right direction.
3. What we process, and why
3.1 Visitors to our website
| Data | IP address, browser type and settings, pages visited, date and time, referring website, device information |
| Why | to keep the website working, protect it against misuse and attacks, and understand which pages are being read |
| Legal basis | legitimate interest in a working and secure website (Art. 6(1)(f) GDPR) |
| Retention | log files 90 days; security logs 2 years |
Visitor statistics. We use Plausible Analytics, a European service that sets no cookies and does not track individual visitors. Plausible collects aggregate figures only: how many people visited a page, where they came from and what type of device they used. No profile is built about you, and you cannot be recognised across visits or across websites.
3.2 When you contact us or leave your details
Through our chat assistant, a contact form, a QR code, a trade show or directly by email.
| Data | name, email address, telephone number, organisation and role; the content of the conversation or of the questionnaire we go through together; publicly available business information we link to it |
| Why | to answer your question, contact you about Ask Eve AI, prepare that conversation properly and tailor our services to what you need |
| Legal basis | legitimate interest in following up a request for contact that you made yourself (Art. 6(1)(f) GDPR) |
| Retention | up to 36 months after our last contact, or sooner if you ask us |
Information from public sources. To prepare a conversation properly, we supplement your details with publicly available information: professional profiles such as LinkedIn, your organisation's website, and public registers such as the Belgian Crossroads Bank for Enterprises. We tell you this at our first contact with you at the latest. You can object to it.
What we do not do. We do not sell or rent your data, and we do not pass it on to third parties for their own marketing.
3.3 Newsletter and commercial messages
| Data | name, email address, and whether and when you gave consent |
| Why | to send you news, invitations and offers about Ask Eve AI |
| Legal basis | your consent (Art. 6(1)(a) GDPR and Art. XII.13 of the Belgian Code of Economic Law) |
| Retention | until you unsubscribe; we keep the record of your unsubscription for a further 3 years |
You can unsubscribe at any time through the link at the bottom of every message, or by emailing privacy@askeveai.com. Unsubscribing has no effect on any other contact we have with you.
3.4 Users with a platform account
| Data | name, email address, hashed password, roles and permissions, sign-in times, IP address at sign-in |
| Why | to give you access to the platform, secure the account, prevent misuse and establish who made which change |
| Legal basis | performance of the contract with the organisation you work for (Art. 6(1)(b)), and legitimate interest in security (Art. 6(1)(f)) |
| Retention | for as long as the account exists. On termination the account is disabled rather than deleted, so that change logs remain verifiable. Sign-in data is then removed; the user identifier in the logs is kept for the period set out in 3.6 |
3.5 Contacts at customers, partners and suppliers
| Data | name, role, business email address and telephone number, correspondence |
| Why | to carry out and manage the working relationship |
| Legal basis | performance of the contract, or legitimate interest in a workable business relationship |
| Retention | duration of the relationship, plus 5 years |
3.6 Invoicing and accounting
| Data | organisation details, VAT number, address, invoices, payment details, usage data underpinning the invoice |
| Why | to invoice and to meet our accounting and tax obligations |
| Legal basis | performance of the contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Retention | 7 years, as required by Belgian accounting law |
3.7 Job applicants
| Data | CV, covering letter, contact details, interview notes |
| Why | to assess your application |
| Legal basis | steps prior to entering into a contract (Art. 6(1)(b)); for retention in a talent pool: your consent |
| Retention | 6 months after the procedure closes, or 2 years in the talent pool if you consented to that |
4. Cookies
Our chat assistant uses one cookie, evie_base. It is set by our own website, serves solely to make a conversation with the assistant work technically, and expires after roughly an hour. No consent is required for a cookie that is strictly necessary to deliver a service you have asked for, which is why we show you no cookie banner.
We set no tracking cookies, advertising cookies or other cookies that follow your behaviour. Our visitor statistics (Plausible) work without cookies.
Fonts. The fonts on our website are served from our own servers. Your browser makes no connection to Google or any other external party for them.
5. Who we share data with
We use service providers who process data on our behalf. We have a data processing agreement with each of them.
| Service provider | For what | Location |
|---|---|---|
| Scaleway SAS | hosting, databases, storage, email delivery | France |
| Mistral AI | language model that processes conversations | France; compute infrastructure partly via Google Cloud in the Netherlands and Belgium |
| BunnyWay d.o.o. (Bunny.net) | content delivery, firewall, protection against attacks | Slovenia |
| Billit | invoicing and payments | Belgium |
| Plausible Analytics | cookieless visitor statistics | European Union |
| Proton AG | business email | Switzerland |
Switzerland has been recognised by the European Commission as providing an adequate level of protection. No additional safeguard is required for transfers there.
Our internal development environment runs on a Gitea instance we manage ourselves, on our own infrastructure. No external service provider is involved.
We may also share data with our accountant, our legal advisers, or with public authorities where the law requires it.
6. Where your data is held
Your data is processed and stored within the European Union. We choose our service providers deliberately on this basis, and we use only our suppliers' European endpoints.
We want to be entirely transparent about one point. Mistral AI, which supplies our language model, uses Google Cloud for part of its compute infrastructure, in data centres in the Netherlands and Belgium. Your data remains physically within the EU. Because Google is a US company, US authorities could in exceptional cases have a legal route to request access. We consider that risk limited, but we do not conceal it, and we are actively pursuing ways to remove this dependency.
Where one of our service providers makes limited use of a party outside the European Union for a specific supporting function, this takes place under the European Commission's standard contractual clauses (Art. 46 GDPR) or another legally recognised transfer mechanism.
7. How we protect your data
We take appropriate technical and organisational measures, including:
- encryption of all connections (TLS 1.2 or higher) and of stored data;
- strict separation of data between our customers, with a dedicated database schema and dedicated storage per customer;
- two-factor authentication on all critical systems;
- access on a need-to-know basis only, with activity logging;
- a firewall and attack protection in front of all our traffic;
- daily encrypted backups across multiple locations;
- separate environments for development, testing and production.
No system is entirely impenetrable. If you notice anything suspicious, or believe you have found a vulnerability, please let us know at privacy@askeveai.com.
8. Artificial intelligence
Our platform uses language models to hold conversations and summarise information. We want to be clear about what that means:
- You are talking to an AI assistant, not to a member of staff. We say so at the start of every conversation. Feel free to ask for a person.
- We do not use your data to train AI models. Not to train or fine-tune our own models, and we do not permit our service providers to do so either. At Mistral, the use of our data for model training is switched off.
- We do sometimes read conversations back to find and fix faults. If the assistant answers incorrectly or something goes wrong, we look at what happened and adjust how it works. This is done by people, on a limited scale, and only to keep the service working as it should.
- An AI assistant makes no decisions about you that produce legal effects or similarly significantly affect you. Where we use AI to organise or summarise a lead, a person decides what happens next.
- An AI assistant can get things wrong. Treat what it says as information, not as a binding commitment on our part.
9. Your rights
You have the right to:
- request access to the data we hold about you;
- have data corrected if it is inaccurate;
- have data erased;
- have processing restricted;
- receive your data in a readable file format (portability);
- object to processing that rests on our legitimate interest, including the supplementing of your data from public sources;
- withdraw your consent where processing rests on it. This does not affect anything that happened beforehand.
Email privacy@askeveai.com. We respond within one month. If your request is complex, we will tell you within that month that we need more time. We may ask you to confirm your identity before releasing any data.
If you are not satisfied with how we handle your request, you can lodge a complaint with:
Belgian Data Protection Authority Drukpersstraat 35, 1000 Brussels, Belgium contact@apd-gba.be — https://www.gegevensbeschermingsautoriteit.be
10. Minors
Our services are aimed at organisations and their staff, not at children. We do not knowingly collect data about people under 16. If you believe this has happened, let us know and we will delete it.
11. Changes
We may update this notice when our services change. The date at the top shows when we last did so. Where a change materially affects your rights, we will inform you directly.
Version 1.0 — 21 September 2026