Privacy Policy

Last Updated: July 1, 2026

1. Scope

This Privacy Policy explains how Flowacts ("Flowacts," "we," "us," or "our") collects, uses, shares, and protects personal information when you use our websites, AI canvas workspace, applications, support channels, billing pages, and related services that link to this Privacy Policy (collectively, the "Services").

If you do not agree with this Privacy Policy, please do not use the Services.

2. Information We Collect

Account and Profile Information

We collect information you provide when you create or update an account, such as name, email address, password or authentication credentials, organization name, profile settings, and communication preferences. If you sign in through a third-party provider, we receive information that provider makes available, such as your name, email address, and profile identifier.

Billing and Subscription Information

If you purchase a paid plan, our payment processor, currently Stripe, collects payment card and billing details. Flowacts receives limited billing information such as subscription status, plan type, billing cycle, transaction identifiers, invoice information, and payment confirmation. We do not store full payment card numbers.

Workspace Content

Because Flowacts is an AI canvas workspace, we process the content you choose to submit or generate, including prompts, instructions, uploaded files, PDFs, spreadsheets, text, images, project names, pages, nodes, chat history, generated charts, slides, mind maps, flowcharts, timelines, tables, exports, comments, and related metadata ("Customer Content").

Usage, Credit, and Device Information

We automatically collect information about how the Services operate and are used, including tool usage, project and page activity, credit consumption, generation events, collaborator counts, error logs, crash data, browser type, operating system, IP address, approximate location derived from IP address, device identifiers, referral pages, and performance data.

Communications and Support Information

If you contact us, respond to surveys, request support, or communicate with us, we collect the content of those communications and related contact information.

3. How We Use Information

We use personal information to:

• provide, operate, maintain, and secure the Services;
• create accounts, authenticate users, manage sessions, and enforce seat or collaborator limits;
• process prompts, files, and Customer Content to generate requested AI canvas outputs;
• manage subscriptions, billing, invoices, renewals, cancellations, credits, and plan limits;
• enable collaboration, sharing, exports, workspace history, and project organization;
• respond to support requests and send service, security, billing, and policy communications;
• debug errors, prevent fraud, detect abuse, protect against unauthorized access, and preserve system reliability;
• analyze aggregate usage and improve features, routing, performance, and user experience;
• comply with legal obligations and enforce our Terms.

4. AI Processing and Model Training

We process Customer Content through our systems and service providers to provide the Services, including to parse files, route instructions, generate canvas structures, and return Output.

Flowacts does not sell Customer Content and does not use your private workspace content to train public foundation models unless you expressly opt in or direct us to do so. We may use de-identified, aggregated, or telemetry-level information to improve product reliability, measure feature performance, and prevent abuse.

If Customer Content includes personal information about other people, you are responsible for ensuring you have a lawful basis or permission to provide it to the Services.

5. How We Share Information

We may share information with:

• service providers that help us host, secure, operate, analyze, support, and improve the Services, including cloud infrastructure, authentication, AI model processing, analytics, customer support, email delivery, and data storage providers;
• payment processors, including Stripe, to process purchases, renewals, taxes, invoices, disputes, and refunds where applicable;
• workspace collaborators and shared-link viewers according to the permissions you set in the Services;
• third-party integrations that you connect or direct us to use;
• law enforcement, regulators, courts, or other parties when we believe disclosure is required by law or necessary to protect rights, safety, security, or the integrity of the Services;
• counterparties and advisers in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets;
• other parties with your consent or at your direction.

We require service providers to process information for authorized purposes and to protect it using appropriate safeguards.

6. Cookies and Similar Technologies

We use cookies, local storage, pixels, and similar technologies to keep you signed in, remember preferences, secure sessions, measure performance, understand usage, and improve the Services. You can usually adjust browser settings to block or delete cookies, but doing so may limit functionality.

Where required, we will provide additional choices for non-essential cookies or similar technologies.

7. Legal Bases for Processing

For users in the European Economic Area, United Kingdom, Switzerland, and other regions requiring a legal basis, we process personal information based on one or more of the following: performance of a contract, legitimate interests, consent, legal obligations, and vital interests where necessary.

Our legitimate interests include providing secure AI productivity services, preventing abuse, improving product reliability, communicating with users, and operating our business in a responsible way.

8. International Transfers

Flowacts is based in the United States, and information may be processed in the United States and other countries where we or our service providers operate. These countries may have data protection laws different from those in your jurisdiction.

Where required, we use appropriate safeguards for cross-border transfers, such as standard contractual clauses or other lawful transfer mechanisms.

9. Retention

We retain personal information for as long as necessary to provide the Services, maintain your account, comply with legal obligations, resolve disputes, enforce agreements, prevent abuse, and support legitimate business operations.

Customer Content is generally retained while your account or workspace remains active unless you delete it or request deletion, subject to backups, legal requirements, and technical limitations. Backup copies may persist for a limited period before deletion in the ordinary course.

10. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. However, no internet transmission, AI service, or storage system can be guaranteed to be completely secure. You should protect your credentials, manage sharing permissions carefully, and export important work where appropriate.

11. Children

The Services are not intended for children under 18, and we do not knowingly collect personal information from children under 18. If you believe a child has provided personal information to us, contact us at [email protected] and we will take appropriate steps to delete it.

12. Your Privacy Rights

Depending on where you live, you may have rights to request access, correction, deletion, portability, restriction, objection, withdrawal of consent, or appeal of certain privacy decisions. You may also have the right to opt out of certain processing, such as targeted advertising, sale or sharing of personal information, or profiling that produces legal or similarly significant effects.

To exercise privacy rights, contact us at [email protected]. We may need to verify your identity before processing your request. Authorized agents may submit requests where permitted by law and with appropriate proof of authority.

13. United States State Privacy Rights

Residents of certain U.S. states, including California, Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, and Virginia, may have additional rights under state privacy laws.

We do not sell personal information for money. Some analytics or advertising activities may be considered a "sale," "sharing," or targeted advertising under certain state laws. Where required, you may opt out by contacting us at [email protected] or using any privacy controls we make available.

California residents may request information about categories of personal information collected, sources, purposes, disclosures, and retention, and may request access, correction, deletion, and opt-out of sale or sharing where applicable. We will not discriminate against you for exercising privacy rights.

14. Privacy Signals

Some browsers and devices offer opt-out preference signals such as Global Privacy Control. Where required by applicable law and technically feasible, we will honor recognized signals for the browser or device that sends them. You may also contact us directly to exercise privacy choices.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by a revised "Last Updated" date. If changes are material, we may provide additional notice through the Services or by email where appropriate.

16. Contact Us

If you have questions about this Privacy Policy or want to exercise privacy rights, contact us at: [email protected]