The controller of personal data is Flowbity sp. z o.o., registered office at os. Jana III Sobieskiego 40/2N, 60-688 Poznań, Poland, entered in the register of entrepreneurs kept by the Sąd Rejonowy Poznań - Nowe Miasto i Wilda w Poznaniu, VIII Wydział Gospodarczy Krajowego Rejestru Sądowego (District Court Poznań - Nowe Miasto and Wilda in Poznań, 8th Commercial Division of the National Court Register) under KRS 0001225616; VAT ID (NIP) 9721376119, REGON 544047871, share capital PLN 5,000.00.
Data-protection contact: admin@flowbity.com. Service: https://servavio.com.
The service does not retrieve orders or buyers' data from marketplaces.
The data comes from the person it concerns or, for an invited employee, from the administrator of the company account who gave their e-mail address.
We send no marketing messages and do not profile users.
The full list of providers with locations: Sub-processors. In short:
Backups and the photo archive are kept on the Service Provider's own device in Poland. To external part catalogues (including eBay and part manufacturers' catalogues) we send part numbers only, without user data.
Vertex AI / Gemini runs on Google Cloud's global endpoint, so data may be processed outside the EEA, including in the USA. The transfer is safeguarded by Standard Contractual Clauses (SCC) incorporated into the Cloud Data Processing Addendum (Article 46 GDPR). Under Google Cloud's terms customer data is not used to train Google's models; for requests that use Google Search, Google stores the request and the answer for up to 30 days.
Resend processes e-mail addresses and the content of the messages sent in the USA, on the basis of Standard Contractual Clauses (SCC) and the EU-US Data Privacy Framework. Other data is processed in the EEA.
| Data | How long |
|---|---|
| Account, content and settings | Until the account is deleted, and then for 30 more days during which the account can be restored. After that the data is permanently deleted. |
| Photo files on the server | Removed from the server 48 hours after the offer is published (the photos are then on the marketplace), and photos of parts never published after 14 days. The archive copy of photos stays until the account is permanently deleted. |
| Database backups | Expire by rotation; the oldest copy is no more than 12 months old. |
| Account activity log | 365 days. |
| Server logs | 30 days. |
| Contact form requests | 12 months from sending; if an account is then created, as account data. |
| Invoices and accounting documents | 5 years from the end of the year in which the tax obligation arose (tax and accounting law). This duty prevails over an erasure request. |
| Data needed to defend against claims | Until the limitation period for claims expires. |
Please send requests to admin@flowbity.com. We reply within one month. If your data was entered into the service by the company you work for or with, we pass the request to that company as the controller.
You have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.
Providing an e-mail address, a password and a company name is voluntary but necessary to create an account. Invoicing data is required by law when we issue an invoice.
The service automatically prepares proposals about parts and offers (reading numbers, category, parameters, matching vehicles, description). They concern goods, not people. We take no decisions about anyone based solely on automated processing that would produce legal or similarly significant effects (Article 22 GDPR), and we do not profile.
If you received an invitation to a company account, your e-mail address was given to us by that account's administrator. We process it to send the invitation and let you work on the company account (Article 6(1)(f) GDPR). The account administrator sees your e-mail address, your role and the actions you perform on the company account. You have the rights described in section 9.
The site uses no analytics or advertising cookies and embeds no tools of external advertising providers. In browser storage (localStorage) we keep only data necessary for the service to work: sign-in session tokens, the selected company, the interface language and the fact that the browser-storage notice was acknowledged. The session token is sent only to our API, and signing out removes the tokens. Such storage is strictly necessary and needs no consent (Article 5(3) of Directive 2002/58/EC).
We measure visits with Umami installed on our own server (umami.flowbity.com, the same hosting provider as the application). Umami uses no cookies or browser storage, does not track you across sites and passes no data to third parties. We record the page address, the referring page, browser and device type, the country derived from the IP address and events such as clicking the sign-up button or sending the contact form. The IP address is used only to compute a daily, anonymous hash that tells visits apart and is not stored. The legal basis is our legitimate interest in measuring how the site is used (Article 6(1)(f) GDPR); we do not profile and do not link the statistics to a user account. This section was last updated on 6 October 2026.
Each version of the Policy has a number and a date. We give notice of a material change by e-mail or by a message in the service and ask you to confirm at sign-in that you have read the new version.