Privacy Policy

1. Introduction

Flowctory ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our website and services (collectively, the "Service").

This policy describes our data practices and your rights. Section 3 explains the legal bases for processing.

This Privacy Policy should be read alongside our Terms of Service.

2. Information We Collect

2.1 Account Information

When you register for a Flowctory account, we collect and store:

• Email Address: Your email address, used for account identification, service messages and, unless you turn it off, occasional product news and offers
• Password: If you register with email, your password is securely hashed (we never store plaintext passwords)
• Display Name: Your name, either provided by you or obtained from your social login provider (Google)
• Avatar URL: Your profile picture URL, if provided by your social login provider
• Timezone: Your timezone preference for displaying dates and times

You can register and log in using email and password, or through Google OAuth. Google OAuth is used for authentication only; cloud storage accounts are connected separately.

2.4 Media Content

We handle several types of media content through the Service:

• We process uploaded media to provide the Service. Files you keep in your account remain available until you delete them or close your account; temporary uploads are removed when no longer needed.
• Media you save in your library is linked to your account and kept until you delete it or close your account. You can reuse it in supported generation and workflow inputs.
• Generated images, video, audio and text saved in your account are kept until you delete them or close your account.

2.5 Cloud Storage Connections

When you connect a cloud storage provider (Google Drive, Dropbox), we collect and store:

• Email Address: The email address associated with your cloud storage account
• Display Name: Your display name on the cloud storage provider
• Storage Provider: OAuth access and refresh tokens (encrypted) to access your cloud storage on your behalf
• Your folder preferences for file browsing and auto-save destinations

Cloud storage connections are used to import files into Flowctory and optionally auto-save generated content to your preferred cloud folder.

2.6 AI-Generated Content Data

When you generate images, video, audio or text through Flowctory MCP, Labs or Canvas, we collect and process:

• Text prompts and generation parameters you provide
• Images you select from your library or upload for AI processing
• The generated images, video, audio and text that you save in your account
• Flowctory does not use your generation inputs or outputs to train AI models. Third-party processing terms vary with the selected model.

Your prompts, generation settings and selected reference media are shared with third-party AI processing services to fulfill your request. Saved outputs remain in your account until you delete them or close your account.

See Section 5.3 (AI Processing) for third-party processing and retention information.

2.8 Technical and Usage Data

We automatically collect certain technical information when you use the Service:

• IP address
• Browser type and version
• Device information
• Access timestamps
• Error logs and diagnostic data
• Account activity, generation and billing events, and identifiers used for analytics and fraud prevention

We measure visits and account milestones without identifying you. After you accept, we also use identified analytics, session replay and performance measurement. Replay masks form inputs, but visible page text and captured console messages may still contain personal information.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data based on the following legal grounds:

3.1 Contract Performance

Processing is necessary to provide you with the Service, including:

• Creating and managing your Flowctory account
• Uploading and processing your media content
• Connecting your cloud storage accounts (Google Drive, Dropbox) for file import and auto-save
• Connecting third-party services (cloud storage, AI providers) on your behalf
• Generating images, video, audio and text at your request through Flowctory MCP, Labs and Canvas
• Processing payments and managing subscriptions

3.2 Legitimate Interests

We process certain data based on our legitimate interests, including:

• Improving and securing the Service
• Troubleshooting technical issues
• Preventing fraud and abuse

3.3 Legal Obligations

We may process your data when required by law, such as responding to legal requests or complying with applicable regulations.

3.4 Consent

Where required, we will obtain your explicit consent before processing your data. You may withdraw your consent at any time.

4. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Authenticate you and manage your Flowctory account
• Connect third-party services (cloud storage, AI providers) on your behalf
• Upload and process media content you submit
• Generate images, video, audio and text at your request through Flowctory MCP, Labs and Canvas
• Connect your cloud storage accounts for file import and auto-save of generated content
• Process payments and manage your subscription
• Display content generation history and status within the application
• Troubleshoot issues with failed uploads
• Communicate with you about the Service (service announcements, security alerts)
• Detect, prevent, and address technical issues, fraud, or abuse
• Comply with legal obligations

We do not sell your personal information. Campaign attribution and usage measurement are described in Sections 2.8 and 10.

5. How We Share Your Information

We share your information only in the following circumstances:

5.2 Cloud Storage Providers

When you connect a cloud storage service, we share necessary authentication data with the provider to access your files on your behalf:

Google Drive

We use Google Drive APIs to browse your files and optionally save generated content. Google's handling of your data is governed by Google's Privacy Policy.

Dropbox

We use Dropbox APIs to browse your files and optionally save generated content. Dropbox's handling of your data is governed by Dropbox's Privacy Policy.

5.3 AI Processing

When you request AI generation, the prompts, generation settings and reference media needed for that request are shared with third-party processing services according to the selected model.

Use of Content for Training

Flowctory does not use your prompts, reference media or outputs to train AI models. Third-party processing and training terms may differ by model and service; contact support for current information.

Third-Party Processing and Retention

Third-party retention of generation inputs depends on the selected model and its processing terms. Contact support for current information. Content kept in your Flowctory account follows Section 6 (Data Retention).

Where AI Processing Happens

AI providers may process your data in the United States or other jurisdictions outside the EEA. International transfers are governed by appropriate safeguards (Standard Contractual Clauses or equivalent) as described in Section 9 (International Data Transfers).

Generation Safety Checks

Generation requests or outputs may be checked, refused or filtered under applicable safety and acceptable-use policies.

5.4 Service Providers

We use trusted third-party service providers to help operate the Service:

• Payment Processor: We use Stripe to process payments and manage subscriptions. Stripe receives your payment information (card details, billing address) directly. We do not store your full card details. Stripe's handling of your data is governed by Stripe's Privacy Policy.
• Third-party services help process and store the files and generated content you keep in your Flowctory account, as needed to provide the Service.
• Email delivery and support services process your email address, name and message content to deliver account emails and handle feedback or support requests.
• PostHog receives anonymous cookieless visit counts, pseudonymous account milestones and, after you accept, usage events and replay data. Accepted signed-in activity can be associated with your account ID, email, name and account or subscription attributes.

Providers processing data on our behalf must protect it and use it only for the instructed services. Stripe may also process data for its own fraud prevention and legal compliance, as described in its Privacy Policy.

Sharing You Authorize

People you share projects with can access the shared content. Connected AI assistants receive the tool results and media you request; their copies follow their own privacy and retention policies.

5.5 Legal Requirements

We may disclose your information if required to do so by law or in response to valid legal requests by public authorities (e.g., court orders, subpoenas).

5.6 Business Transfers

If Flowctory is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

5.7 No Sale of Personal Data

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

6. Data Retention

Deleting content hides it from normal views and starts platform-file cleanup, which may require retries. It does not erase every creation or billing record, or files already saved to Google Drive, Dropbox or a connected assistant.

7. Your Rights (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR):

7.9 Exercising Your Rights

To exercise any of these rights, please contact us at contact@flowctory.com. We will respond to your request within 30 days.

8. California Privacy Rights (CCPA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA):

8.1 Right to Know

You have the right to request that we disclose:

• The categories of personal information we have collected about you
• The categories of sources from which we collected the information
• The business or commercial purpose for collecting the information
• The categories of third parties with whom we share the information
• The specific pieces of personal information we have collected about you

8.2 Right to Delete

You have the right to request that we delete the personal information we have collected from you, subject to certain exceptions.

8.3 Right to Opt-Out of Sale

You have the right to opt-out of the sale of your personal information. However, Flowctory does not sell personal information.

8.4 Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. We will not deny you goods or services, charge you different prices, or provide you with a different level of service for exercising your rights.

8.5 Exercising Your Rights

To exercise your CCPA rights, please contact us at contact@flowctory.com. We will verify your identity before processing your request.

9. International Data Transfers

Flowctory is based in France (European Union). If you access the Service from outside the EU, please be aware that your information may be transferred to, stored, and processed in the EU.

When we transfer personal data outside the EEA, we ensure appropriate safeguards are in place, such as:

• Transfers to countries with an EU adequacy decision
• Standard Contractual Clauses approved by the European Commission
• Other legally recognized transfer mechanisms

AI generation may involve processing your prompts and reference media outside your country. The safeguards described in this section apply to international transfers.

Cloud storage, AI processing, analytics, email and payment services may transfer data internationally under their own privacy policies. Browser analytics uses PostHog’s US service.

10. Cookies and Browser Storage

We use cookies and browser storage for sign-in, account connections, language preferences, analytics, session replay and performance measurement.

10.1 Cookie Overview

Cookies and browser storage support your session, temporary account connections, language preferences and usage measurement. Their purposes and lifetimes depend on the function described below.

10.2 Session Cookies

Session cookies keep you signed in and support account access. These cookies:

• Maintain your account session without storing your password in the cookie
• For the session or configured sign-in period

10.3 OAuth Flow Cookies

When you connect an external account, temporary cookies support the connection and your authorization. These cookies:

• Help complete the connection with the account you authorized

10.4 Analytics and Performance

PostHog — Without a choice, we count visits and product steps anonymously: no cookies or browser storage, no account or cross-day identity and no session replay. PostHog derives a daily-rotating hash that cannot be linked across days, and we use these counts only to measure and improve Flowctory. For accounts, we also record a few milestones (signup, generation success or failure, trial start or cancellation, checkout and purchase) under a pseudonymous key that is never linked to your name, email, browsing or a person profile. Choosing Reject or sending a Global Privacy Control signal stops both. Accept adds identified usage analytics, session replay and performance measurement. Essential security and payment processing continue.

10.5 Security and Promotion Eligibility

A first-party security cookie can last up to one year. Its hashed identifier helps prevent repeated promotional claims; blocking it can affect eligibility.

10.6 Signup Attribution

A first-party cookie and browser storage retain landing-page and campaign attribution for up to seven days to measure signup sources.

10.7 Referral Links

When you open a Flowctory referral link (flowctory.com/r/...), we keep the referral code so the person who shared it can be credited if you create an account. If you accept cookies, the code is stored in a first-party cookie named flowctory_ref for up to 30 days. Otherwise nothing is stored and the code applies only if you sign up during the same visit. The cookie contains only the code, is not used for advertising or analytics, and is deleted once your account has been checked for a referral or when you withdraw consent.

10.8 Cookie Preferences

You can accept, reject or withdraw optional analytics on this Privacy page. Rejecting also stops anonymous visit counts and account milestones. We remember accepted and rejected choices for up to six months in this browser and, when signed in, your account. After expiry or a material change in purposes, recipients or scope, we ask again. Withdrawal stops new optional collection and clears optional browser analytics storage; it does not erase records already held by providers. Essential service processing continues. Browser settings can also clear cookies and may sign you out or interrupt connections.

11. Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction:

• Encryption in Transit: All communications use HTTPS/TLS encryption
• Encryption at Rest: We apply appropriate measures to protect stored personal information
• Secure Authentication: OAuth tokens are securely stored and managed
• Access Controls: Limited access to personal data on a need-to-know basis. Flowctory personnel do not access data obtained through Google API Services except when: (a) you have provided explicit consent to view specific data, (b) it is necessary for security purposes such as investigating abuse or security incidents, or (c) we are required to do so by applicable law
• Regular Updates: Infrastructure and dependencies are regularly updated

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately.

12. Children's Privacy

The Service is not intended for children under the age of 16 in the European Union or 13 in other jurisdictions. We do not knowingly collect personal information from children under these ages.

If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at contact@flowctory.com. If we become aware that we have collected personal information from a child without verification of parental consent, we will take steps to delete that information.

13. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. When we make changes:

• We will update the "Last updated" date at the top of this policy
• For material changes, we will provide notice through the Service or via email
• We will obtain your consent where required by applicable law

We encourage you to review this Privacy Policy periodically to stay informed about our data practices.

14. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: