Privacy notice
Last updated 30 October 2026
This notice covers the StrongFlow remote monitoring platform (this website, its emails and the gateways that connect machines to it), as required by the EU General Data Protection Regulation (GDPR).
Who is responsible
StrongFlow Oy, business ID 2024125-8
Autoilijankatu 1, 20780 Kaarina, Finland
Privacy questions and requests: anton.viljanen@strongflow.fi
What we store about you
- Your account: email address, password (stored only as a one-way hash, never readable), language, colour theme, when the account was made and when you last used it, whether you have confirmed your email address. With two-factor login, its secret (encrypted) and your recovery codes (as hashes).
- Workspaces and machines: the workspaces you belong to and your role in them, the machines you have access to and the names you give them, invitations sent to your address.
- What you set up: page layouts, your own formulas, cards, charts and KPI tiles, saved Trends views, which machines' alarm emails and reports you get. When you share a layout as a link, a copy of the layout (not any machine data) is kept for 90 days for those who open the link.
- What you do with machines: the commands you send (setting, old and new value, time) and the alarms you acknowledge (with your note). These are stored with your email address.
- Security log: logins and failed logins, and every change you make (machines, workspaces, settings), with the time and your IP address.
- Server logs: the web server and the application log requests (IP address, the address asked for, the browser, the time) to keep the service running and to investigate misuse.
Most of this you give us yourself. If a workspace Owner or Admin invited you, or one of our administrators made your account, your email address (and the workspace and role) came from them.
An email address and a password are needed for an account: without them the service can't be used. Everything else is optional.
The platform also stores the machines' own measurements and alarms. They describe the machines; we don't use them to follow anyone's work.
Cookies and storage in your browser
We don't use analytics, advertising, tracking or third-party services in the site, so it asks for no cookie consent: it stores only what is needed for the service you use, or what you chose yourself.
| What | Why | How long |
|---|---|---|
| Login session (cookie) | Keeps you logged in | Until you log out, at most 30 days |
| Login security (2 cookies) | Protect the login form against forged requests, and remember the page to return to | Until you close the browser |
| Language and theme (cookies) | The language and colours you chose, also before you log in | 1 year |
| "Getting started" hidden (cookie) | Remembers that you hid the list | 1 year |
| Alarm history filter (cookie) | The period and filter you chose in a machine's alarm history | 1 year |
| Light or dark mode (browser storage) | The mode you chose | Until you change it or clear the browser's data |
| A machine's latest values (browser storage) | Shows its numbers at once while the live connection starts | Until you clear the browser's data |
You can delete them in your browser's settings at any time; you then have to log in and choose your settings again.
Why, and on what basis
| Purpose | Legal basis |
|---|---|
| Providing the service: your account, machine access, alarm emails and reports | The contract with you (GDPR art. 6(1)(b)). When you use the platform for your employer or another company that is our customer: our and our customer's legitimate interest in providing the service they ordered (art. 6(1)(f)) |
| Security: preventing misuse, investigating problems, showing who changed what on a machine | Legitimate interest (art. 6(1)(f)): keeping the machines and the platform safe |
| Emails about your account (confirmation, password reset, security notices) | The contract, and legitimate interest in keeping your account safe |
We make no automated decisions about you.
Who sees it
- People in your workspaces: every member sees the members' email addresses and roles; Owners and Admins also see the workspace's activity (without IP addresses). Everyone who can see a machine sees who sent its commands and acknowledged its alarms.
- Our platform administrators, for support and maintenance.
- Email delivery: emails are sent through Resend (Resend, Inc., USA), which receives your email address and the email's content and processes them on our behalf. The transfer to the USA is based on Resend's certification under the EU–US Data Privacy Framework, and its data processing agreement also includes the European Commission's standard contractual clauses (resend.com/legal/dpa).
The platform itself runs on our own server in Finland. Its backups are also stored in Microsoft's Azure cloud service, encrypted with a key Microsoft doesn't have, so it can't read them.
We don't sell or hand over your data to anyone else, unless the law requires it.
How long we keep it
| Data | Kept |
|---|---|
| Your account and settings | Until you delete the account (or it is deleted at the end of the contract) |
| Layouts you shared as a link | 90 days, or until you delete the account |
| Security log | 365 days |
| Server logs | Web server 14 days, application about 2 months |
| Commands you sent, alarms you acknowledged | With the machine's history: alarms 3 years, commands as long as the machine is on the platform |
| Machine measurements | Raw values 3 years, summaries for the machine's lifetime |
| Backups (encrypted) | Up to 12 months, then overwritten. A deleted account stays in older backups until then; if we ever restore one, we delete the account again |
Your rights
- See and download your data: Settings → Your data → Download my data gives you everything stored about you as a file (also for moving it elsewhere).
- Correct it: change your settings yourself, or ask us.
- Delete it: Settings → Your data → Delete my account. Commands and acknowledgements stay in the machines' history and the security log keeps its entries for its 365 days, as above; you can ask us to remove more.
- Object or restrict: you can object to processing based on legitimate interest, or ask us to restrict it, at anton.viljanen@strongflow.fi.
We answer requests within a month. If you think we handle your data wrongly, you can complain to the Data Protection Ombudsman of Finland (tietosuoja.fi).
How we protect it
Connections are encrypted (HTTPS, and TLS with a certificate for every gateway). Passwords and recovery codes are stored as hashes, two-factor secrets encrypted. Access to machines is checked on every request, logins are rate-limited, and backups are encrypted with a key that is not kept on the server.
Changes
When this notice changes, the date at the top changes too. We tell you by email about changes that affect you.