FlowSpeak – Data Processing Addendum
Effective Date: 14 June 2026
This DPA applies only where a business or organisation uses FlowSpeak as a processor of personal data for which that customer is the controller. If you use FlowSpeak as an individual for your own personal speech coaching, FlowSpeak is the controller of your personal data, and our Privacy Policy — not this DPA — governs that processing.
This Data Processing Addendum (“DPA”) forms part of the Terms & Conditions between:
Beotela OOD, VAT Number BG130389067, Ul. Gurgulyat 33, Sofia, Bulgaria (“FlowSpeak”, “Processor”, “we”, “us”), and
the customer using FlowSpeak (“Customer”, “Controller”).
This DPA applies whenever FlowSpeak processes Personal Data on behalf of the Customer in connection with the Services.
In the event of a conflict between this DPA and the Terms & Conditions, this DPA shall prevail with respect to Personal Data processing.
For purposes of this DPA:
Controller means the entity that determines the purposes and means of processing Personal Data.
Processor means the entity that processes Personal Data on behalf of the Controller.
Personal Data means any information relating to an identified or identifiable natural person.
Processing means any operation performed on Personal Data, including collection, storage, use, disclosure, deletion, transmission, or analysis.
Data Subject means the individual to whom Personal Data relates.
Applicable Data Protection Laws means all applicable privacy and data protection laws, including Regulation (EU) 2016/679 (GDPR).
This DPA applies to Personal Data processed by FlowSpeak on behalf of the Customer when providing the Services.
The Customer acts as Controller.
FlowSpeak acts as Processor.
The Customer is responsible for ensuring that it has a lawful basis for processing and providing Personal Data to FlowSpeak.
FlowSpeak processes Personal Data solely to provide the Services requested by the Customer.
Processing activities may include:
Depending on how the Services are used, FlowSpeak may process:
Because FlowSpeak relates to speech and stuttering, content submitted through the Services may include health-related information that constitutes special category data under Article 9 GDPR. The Customer is responsible for ensuring it has a valid Article 9 condition (such as the Data Subject’s explicit consent) before such data is submitted.
FlowSpeak shall process Personal Data only:
The Terms & Conditions, user configuration settings, API requests, and platform functionality constitute the Customer’s documented instructions.
FlowSpeak shall ensure that authorised individuals, including contractors authorised to process Personal Data:
FlowSpeak shall implement appropriate technical and organisational measures designed to protect Personal Data.
Such measures may include:
FlowSpeak may update security measures from time to time provided the overall level of protection is not materially reduced.
The Customer authorises FlowSpeak to engage sub-processors as necessary to provide the Services.
Current sub-processors may include:
| Provider | Purpose |
|---|---|
| Supabase | Hosting, database, authentication |
| Anthropic | AI processing |
| Resend | Transactional email |
| Stripe | Payment processing (where paid plans are offered) |
FlowSpeak shall ensure that sub-processors are subject to data protection obligations substantially similar to those set forth in this DPA.
FlowSpeak remains responsible for the performance of its sub-processors.
Some sub-processors listed in Section 8 are located outside the European Economic Area, including in the United States. Where Personal Data is transferred to such sub-processors, FlowSpeak relies on Standard Contractual Clauses (SCCs) as the lawful transfer mechanism in accordance with GDPR Article 46. Each sub-processor outside the EEA is required to maintain their own appropriate transfer safeguards. Customers may request information on the specific transfer mechanisms applicable to individual sub-processors.
Taking into account the nature of processing and information available to FlowSpeak, FlowSpeak shall provide reasonable assistance to the Customer regarding:
FlowSpeak may charge reasonable fees for extensive assistance beyond standard support obligations.
If FlowSpeak becomes aware of a confirmed or reasonably suspected Personal Data Breach affecting Customer Personal Data, FlowSpeak shall:
Notify the Customer without undue delay and no later than 48 hours after becoming aware of the breach. Provide, to the extent available at the time of notification: a description of the nature of the breach, the categories and approximate number of Data Subjects affected, the likely consequences, and the measures taken or proposed to address the breach. Take reasonable steps to mitigate adverse effects and prevent recurrence. Cooperate with the Customer regarding any required regulatory notifications.
Where full information is not available within 48 hours, FlowSpeak shall provide an initial notification within that period and follow up with additional detail as it becomes available. Notification of a breach does not constitute an admission of fault or liability by FlowSpeak.
If FlowSpeak receives a request directly from a Data Subject relating to Customer Personal Data, FlowSpeak shall:
The Customer remains responsible for responding to Data Subject requests.
Upon reasonable written request, FlowSpeak shall make available information reasonably necessary to demonstrate compliance with this DPA.
Any audit:
The Customer shall bear its own audit costs.
Upon termination of the Services, FlowSpeak shall, upon request:
FlowSpeak may retain data where required by law, regulatory obligations, or legitimate security and backup requirements.
Any retained data shall remain protected under this DPA.
Each party’s liability under this DPA shall be subject to the limitations of liability contained within the Terms & Conditions, except where prohibited by applicable law.
This DPA shall be governed by the laws of the Republic of Bulgaria.
Any disputes arising under this DPA shall be subject to the exclusive jurisdiction of the competent courts of Sofia, Bulgaria.
For privacy and data processing matters:
Beotela OOD
VAT Number: BG130389067
Ul. Gurgulyat 33
Sofia, Bulgaria
Email: hello@flowspeak.me
Website: https://flowspeak.me