Privacy Notice

This Privacy Notice explains how personal data is processed in connection with the LilliFlow website and application. LilliFlow is operated from the Philippines. The primary application server is located in Austria, European Union.

1. Controller / Personal Information Controller

Volker Schepler
Lillime Lab
Los Banos, Laguna
Philippines
Email: info@lilliflow.com

2. Personal data we may process

Depending on the feature used, personal data may include account information such as name and email address; authentication and security data; technical request and server-log information; support communications; usage and billing-related records; and content submitted by users within research proposal workflows.

Users should avoid including unnecessary personal data or sensitive personal information in research content submitted to LilliFlow.

3. Purposes of processing

Personal data may be processed to create and administer accounts, authenticate users, provide and maintain the service, deliver security codes and service communications, prevent abuse and protect system security, provide support, administer subscriptions or billing when enabled, improve reliability, and comply with legal obligations.

4. Legal bases

Where the GDPR applies, processing may be based on performance of a contract or steps requested before entering a contract, compliance with legal obligations, legitimate interests such as service security and abuse prevention, and consent where appropriate. Under the Philippine Data Privacy Act, processing is carried out under applicable lawful criteria and the principles of transparency, legitimate purpose and proportionality.

5. AI-assisted processing

Some LilliFlow functions use external artificial-intelligence services. Content submitted to an AI-assisted function may therefore be transmitted to the AI service provider to generate the requested result. LilliFlow currently uses OpenAI services for selected AI functions. Users should not submit unnecessary personal or sensitive information to AI-assisted workflows.

6. Hosting and service providers

The primary LilliFlow application infrastructure is hosted on a server located in Austria, European Union, using infrastructure provided by netcup. Service providers may process limited personal data on behalf of LilliFlow when necessary to provide hosting, infrastructure, communications, security, artificial-intelligence or other operational functions.

7. International access and transfers

LilliFlow is operated from the Philippines while its primary server is located in Austria. Administrative access from the Philippines may therefore involve cross-border access to personal data. External service providers, including AI providers, may also process data in other jurisdictions.

Where the GDPR applies, international transfers will be handled using transfer mechanisms and safeguards required by applicable law. Where the Philippine Data Privacy Act applies, LilliFlow remains accountable for personal data processed internationally and will use appropriate contractual or other safeguards.

8. Authentication and security data

LilliFlow may process login events, security events, session information and one-time security codes to protect accounts and the service. Related security records may be retained where necessary for security, audit, fraud prevention or legal purposes.

9. Server logs

When the website or application is accessed, the server may process technical information necessary to deliver and secure the service, including request time, requested resource, browser or client information, network information and security-related events.

10. Cookies

LilliFlow may use cookies or equivalent browser storage necessary for authentication, session management, security and core application functions. The current public informational website does not intentionally use advertising or behavioural tracking cookies.

11. Retention

Personal data is retained only for as long as reasonably necessary for the purpose for which it was collected, to provide the service, maintain security, resolve disputes and comply with legal obligations. Where a fixed period is not specified, retention is determined by the type of record, purpose, contractual requirements and legal obligations.

12. Data sharing and recipients

Personal data may be disclosed to service providers acting on behalf of LilliFlow where necessary to provide the service, and to public authorities where required by law. LilliFlow does not sell personal data to advertisers.

13. Your privacy rights

Depending on applicable law, rights may include being informed about processing, access, correction, objection, erasure or blocking, restriction, portability where applicable, withdrawal of consent where processing is based on consent, and the right to complain to a competent data protection authority.

Individuals protected by the Philippine Data Privacy Act may lodge a complaint with the National Privacy Commission. Individuals protected by the GDPR may lodge a complaint with the competent supervisory authority in the European Economic Area.

14. Automated processing

LilliFlow uses AI-assisted and automated functions to support proposal development and system operation. Unless explicitly stated for a particular feature, these tools are not intended to make solely automated decisions that produce legal effects or similarly significant effects concerning an individual.

15. Security

LilliFlow uses technical and organisational measures intended to protect personal data against unauthorised access, alteration, disclosure or loss. No internet-connected service can provide an absolute guarantee of security.

16. EU representative

LilliFlow is operated outside the European Union. Before public services are offered to individuals in the European Union in circumstances requiring a representative under Article 27 GDPR, the required representative information will be added to this Privacy Notice.

17. Changes to this notice

This notice may be updated when LilliFlow introduces new functions, service providers, payment services or processing activities, or when legal requirements change.

18. Privacy contact

Questions or requests concerning personal data may be sent to info@lilliflow.com.

Last updated: 29 August 2026