Privacy Policy

The controller for personal data handled by Flowtiq is its operator.

Flowtiq is operated by FLOWTIQ DOT AI LLC, a Wyoming limited liability company registered at 75 E 3rd St, Sheridan, WY 82801, USA. Write to us at contact@flowtiq.ai; it is a working mailbox read by the people who run Flowtiq.

We have not appointed a Data Protection Officer. We are not a public authority, we do not monitor people on a large scale, and we do not process special-category data, so the conditions in Article 37 that would require one do not apply. If that changes we will name one here. We are established in the United States and have no establishment in the EU or the UK. If the GDPR or the UK GDPR requires us to appoint a representative there under Article 27, we will name that representative here.

This policy covers flowtiq.ai and the Flowtiq application. It does not cover Google, LinkedIn, Meta, Stripe or Link, who each publish their own policy.

Your account. The name, work email, and company name you enter at sign-up, or the name, email address, and profile picture Google returns if you sign in with Google. Your password is hashed by Supabase Auth and we never see it. We also store your role in the workspace (owner, admin, or member), whether you have finished onboarding, your notification preferences, and your AI writing preferences, which include a tone, a length, a language, a sign-off and any free-text rules you set.

What you create in the app. Tasks and their comments, contacts, deals, pipelines and boards, CRM activity notes, projects, invoices and their line items, email templates, social posts, meetings, time entries and their notes, and notifications.

Files you upload. Avatars, company logos, social post images, task attachments, and CRM files. Avatars, company logos and social post images are held in public storage, which means anyone holding the file's URL can open it without signing in. Social images have to work this way because LinkedIn and Meta fetch the image themselves when a post is published. Task attachments and CRM files are private and require an authenticated request.

From a connected Gmail account. For your recent messages: sender, recipients, subject, timestamp, folder, read and starred state, a snippet, and the full message body, in both plain text and HTML. These are copied into your workspace so the email hub works without calling Gmail on every screen.

Google Limited Use. Flowtiq's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail and Calendar data is used only to provide the email hub, the calendar, and the AI features listed in section 4 when you run them. It is shared only in these cases:

• With OpenAI's GPT-6 Luna model, through the Lovable AI gateway, for the AI feature you run, and only the data section 4 lists for it. Neither keeps it after answering, and neither uses it to train or improve AI models.
• With our hosting processors in section 5, to store it and serve it to you.
• With your workspace, when you choose to share it: for example by turning an email into a task or a deal, or by sending an email from Flowtiq to a contact, which logs it on that contact's timeline.
• With your workspace, as a reply note: when a contact in your workspace replies to an email you sent from Flowtiq, a note reading "Replied:" and the subject is added to that contact's timeline, where the other members of your workspace can see who replied and the subject.

It is never used for advertising, never sold, and never used to train AI models. It is read by a human only with your explicit consent, for security investigations, or where the law requires it.

Actions in your Gmail and Calendar. Flowtiq acts in your Google account only for features you use: it sends the emails you write or approve in Flowtiq from your address; moves a message to Gmail's trash, or restores it, when you do that in Flowtiq; marks replies to emails you sent from Flowtiq with the label "Flowtiq/Replied" and a star; and creates, updates or cancels Google Calendar events when you do that to a meeting in Flowtiq, which can make Google email the guests.

Removing access and deleting Google data. Disconnect Google in Settings → Connected accounts. When you disconnect Google, we revoke Flowtiq's access at Google and delete the Gmail messages we synced or sent through it, and every meeting linked to your Google Calendar: the events we imported and the meetings you created in Flowtiq and added to Google Calendar. Meetings you never added to Google Calendar stay. You can also remove Flowtiq's access at myaccount.google.com/permissions. Deleting your account or the workspace also revokes our access at Google first, then deletes the stored tokens and the data with them.

From a connected Google Calendar. Event titles, descriptions, start and end times, location or meeting link, the guest list (attendee email addresses, excluding meeting rooms and your own address), and the identifiers needed to keep both sides in step. When you create, edit or cancel a meeting in Flowtiq, we make the same change in your Google Calendar, and Google emails the guests.

From a connected LinkedIn or Meta account. The account or Page identifier and display name, and the engagement figures those platforms return for posts you published through Flowtiq.

Your brand profile. If you use brand analysis, the business details you enter plus a summary derived from the text of the website you asked us to look at.

Connection credentials. The OAuth access and refresh tokens for each account you connect, and the short-lived values used to protect the connect flow against forgery. Tokens are encrypted before they are stored. An API key you create for our own HTTP API is stored only as an irreversible hash — we keep a short prefix so you can tell your keys apart, and nothing else. We never ask you to paste in a key of your own.

Product analytics. We measure our own product, first-party, into our own database. Two records: a feature-usage event holding your user id, your workspace id, one of ten fixed event names, the page path, and small counters; and a page-performance sample holding your workspace id, a speed measurement, the page path, and whether the screen was mobile or desktop. Neither record carries the query string, because our page addresses can contain record ids. The performance sample carries no user id and no browser fingerprint. Neither table can be read back from the application at all.

Security audit trail. Sign-in and permission events that matter for security: who did what, to whom, when, and whether it succeeded. Where an event involves email we record only the recipient's domain, never the full address and never the message. Owners and admins of a workspace can read their own workspace's trail; members cannot.

AI usage counters. Which feature was used, by whom, and when, so allowances can be enforced. No prompt and no output is stored.

Account email. A log of the account emails we send you (confirmation, invitation, magic link, password reset) recording the recipient, which template, and whether it was delivered, but not the message body. If an address bounces or unsubscribes we add it to a suppression list so we stop mailing it.

Technical records. Our hosting and database providers log requests, including IP address, user agent, timestamps, and error details, which we use for security, abuse prevention, and debugging. Application error diagnostics stay first-party today: they record the error, the page path, and no request bodies, workspace records, or query strings. If we ever route them to an outside error-tracking service we will list it in section 5 before turning it on.

Billing. When paid subscriptions open, they will be sold through Link, Stripe's merchant-of-record service. Link takes the payment on its hosted checkout and acts as an independent controller of the payment under its own privacy policy: it receives the workspace owner's email, name, billing address and payment details. We keep the subscription's status, plan and renewal date, and never receive or store card numbers.

We run no advertising trackers, no third-party analytics, and no cross-site profiling, and we do not buy or sell personal data.

• To run the workspace you signed up for, including syncing and sending mail, syncing your calendar, publishing posts, and producing invoices. Performance of a contract, GDPR Article 6(1)(b).
• To reach your mail, calendar, or social account. Your consent, given at the provider's own screen and withdrawn by disconnecting the account, Article 6(1)(a).
• To keep the service secure, prevent abuse, enforce plan limits, debug faults, measure which features are used and how fast pages load, and improve reliability. Our legitimate interests, Article 6(1)(f). We have weighed this against your interests, which is why the analytics records carry no message content, no record ids, and no browser fingerprint.
• To keep a security audit trail and a mail suppression list. Our legitimate interests in a defensible security record and in not mailing people who asked us to stop, Article 6(1)(f).
• To take payment and keep the records tax law requires. Contract and legal obligation, Article 6(1)(b) and (c).
• To send you product email you asked for. Consent, withdrawable at any time.

We do not make automated decisions that have a legal effect on you.

Sixteen features are AI-generated. They send data only when you use them, and only the data listed here. Everything goes to OpenAI's GPT-6 Luna model through the Lovable AI gateway.

• Dashboard assistant: your workspace roster with each member's name and role, your open tasks with priorities, due dates and assignees, your open deals with values and expected close dates, your contact count, hours logged across the team in the last 14 days, your recent notification titles, and the last 20 turns of your conversation. Unpaid invoices with client names and totals are included only if you are an owner or admin. Meetings are limited to your own calendar, never a colleague's. If you ask it about your email, it can search your own mailbox — sender, recipients, subject and a short preview — and read the body of a message you ask about. It cannot reach any other member's mail.
• CRM assistant and deal coach: the contact or deal you have open, including name, job title, company, email, phone, tags and notes, the pipeline stage names, linked open tasks, and the recent activity history on that record.
• Contact enrichment: that contact's full record, including email, phone, industry, country, lifecycle stage and notes, plus their linked deals, open tasks and recent activity entries.
• Follow-up email drafting: the contact's details and notes, their active deals, meetings held and next booked, and excerpts of up to six real emails exchanged with them, in both directions, along with your own name and email address as the sender.
• Email triage and reply drafting: the message you have open, including its sender, all recipients, subject and a large portion of the body, the matched contact's details, and for a reply, short excerpts of earlier messages in the same thread.
• Invoice review: the invoice, including the client's name and email address, its line items and amounts, and your payment history with that client from earlier invoices.
• Receivables review: your unpaid invoices with client names, amounts, and how late each one is.
• Daily brief: your overdue and due tasks, unpaid invoices with client names and totals, quiet deals, your unread email count, and today's meetings including their attendee email addresses.
• Meeting preparation and recap: the meeting title, agenda, and attendee list, the matched contact's details and notes, their deals and unpaid invoices, short excerpts of recent email with those attendees, and for a recap, the notes you typed.
• Timesheet drafting: your own time entries with dates, projects, hours, linked tasks and short excerpts of your entry notes.
• Task capture: the text you paste in, plus your team members' names and your contacts' names and companies, so the result can be assigned and linked correctly.
• Brand analysis: Flowtiq fetches the website address you give it, identifying itself as FlowtiqBot, and sends the beginning of that page's text along with anything you typed. It will not fetch private or internal network addresses.
• Social post generation: your prompt, the networks you chose, and your brand profile. No contact or CRM data.

Two commitments hold across all of them: your data is not used to train AI models (we pay for the platform plan that guarantees this), and we build no models of our own from your content. When we log an AI request for debugging we record its shape and any error, never the content sent or returned. AI output is generated, not verified, so check it before you act on it.

The specific OpenAI model behind a feature can change. Nothing above changes when it does.

Supabase

Postgres database, authentication, and file storage for the avatars, company logos and post images you upload. Provisioned for us through Lovable Cloud.

Cloudflare

Hosting and the edge network that serves the app and its server functions.

Lovable

The platform Flowtiq is built and hosted on. Three separate roles: the gateway that routes every AI request, the broker that handles Google sign-in, and the sender of account email such as your sign-up confirmation, workspace invitations, magic links and password resets.

OpenAI

Runs the model behind every AI feature, reached through the Lovable gateway rather than directly. We use GPT-6 Luna; which specific OpenAI model powers a given feature can change.

Google (Gmail, Calendar)

Only if you connect a Google account. Mail and calendar data flows both ways, and outbound mail is sent from your own address.

LinkedIn

Only if you connect it, to publish posts on your behalf.

Meta (Facebook, Instagram)

Only if you connect it, to list your Pages, read their engagement figures, and publish posts.

Stripe (Link)

From the date paid subscriptions open, subscriptions are sold through Link, Stripe's merchant-of-record service, which takes the payment, collects sales tax and VAT, and hosts the billing portal. As the seller of the payment it is an independent controller of the workspace owner's email, name, billing address and payment details. It receives no data from us today, and we never receive card details.

Providers that appear in our code but are not reachable from the app, and therefore receive nothing, are deliberately left off this list. We will add a processor here before it starts receiving data, not after.

Our Supabase database and file storage are hosted in Ireland (AWS eu-west-1), so the records you create sit inside the EEA at rest. We are working through countersigned data processing agreements with each processor above ahead of paid launch.

We also disclose data where the law compels us, and we will tell you when that happens unless we are forbidden from doing so.

The database and file storage that hold your workspace are in Ireland, so your records live inside the EEA at rest. Some processing still happens outside it: the app is served from a global edge network, the AI gateway and the models behind it are United States based, and so is the service that sends your account email. Those transfers rely on the European Commission's standard contractual clauses, the UK international data transfer addendum where relevant, and equivalent safeguards in each processor's own data protection terms.

Where a processor offers a choice of region we record the choice and state it in section 5.

While your workspace is active we keep the records you create so the app works. There is no automatic expiry on your own content: contacts, deals, synced mail and its bodies, invoices, meetings, time entries and uploaded files stay until you delete them or delete the workspace. Disconnecting an account deletes its stored tokens. When you disconnect Google, we also revoke Flowtiq's access at Google and delete the Gmail messages we synced or sent through it, and every meeting linked to your Google Calendar: the events we imported and the meetings you created in Flowtiq and added to Google Calendar. Meetings you never added to Google Calendar stay.

The records we age out on a schedule:

• connect-flow security values: one hour;
• page-performance samples: 60 days;
• AI usage counters: 90 days;
• feature-usage events: 180 days;
• security audit trail: 400 days.

Request logs are the one window we do not set ourselves. Our hosting and database providers decide how long they keep them, and because our infrastructure is provisioned for us the figure follows their plan rather than a choice of ours. It is short, days to a few weeks rather than months, and it rolls off automatically. We use those logs only for security, abuse prevention and debugging. If you need the exact current number for a due diligence questionnaire, ask us and we will confirm it in writing rather than leave you to guess from a published plan table.

Suppressed email addresses are kept indefinitely and on purpose: the only way to reliably never mail an address again is to remember it.

When you delete a workspace or your account from Settings, we first revoke Flowtiq's access at Google, then the deletion happens immediately. If we close a workspace for another reason we keep its data for 30 days so it can be restored on request, then delete it. We keep records we are required to keep for tax and accounting, and the security audit trail survives deletion for its 400 days, because a security record that a deletion can erase is not a security record.

• Workspace records are scoped to an organisation and isolated by Postgres row-level security, so one workspace cannot read another's data.
• OAuth access and refresh tokens are encrypted with AES-256-GCM before they are written to the database, under an encryption key that lives only in server-side configuration. API keys you create for our HTTP API are not encrypted but hashed with SHA-256, so even we cannot read one back.
• Traffic is served over HTTPS. Passwords are hashed by Supabase Auth.
• Privileged operations run only in server-side code. The browser never holds a service-level key.
• We ask connected providers for the narrowest access that makes the feature work.

The Security page describes these measures in detail, and is explicit about what we do not yet claim.

No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant regulator as the law requires.

If you are in the UK or EEA you can ask us for a copy of your data, correct it, delete it, restrict or object to how we use it, or have it sent to another provider, and you can withdraw consent at any time.

Three of those you can exercise yourself, immediately: Settings has a control to delete your account, and an owner can delete the whole workspace or download it as a zip of CSV files. The download includes the owner's own emails and social posts, never other members'. Contacts and time entries can also be exported to CSV, and an invoice to PDF, from the pages they live on. For anything else, email contact@flowtiq.ai and we will answer within one month.

You can also complain to the data protection authority in the country where you live or work, or where you believe your data was mishandled. Because we have no establishment in the EU, there is no single lead supervisory authority for Flowtiq; any of them can hear your complaint.

Comparable rights apply under other privacy laws. Tell us which one you are relying on and we will honour it.

The contacts, emails, and invoices you bring into Flowtiq usually describe other people. For that data you are the controller and we act as your processor: we handle it on your instructions and only to run the service. You need your own lawful basis for holding it, and requests from those people come to you first.

The terms on which we do that are in our Data Processing Agreement, which you can read and rely on without asking us for a copy.

Flowtiq sets no advertising cookies and no analytics cookies, and loads no third-party tracking script. There is no cookie banner because there is nothing here that needs your consent. The full itemised list, including the browser storage below, is on the Cookie Policy page.

One cookie. When you start connecting an outside account we set a single short-lived cookie that ties that connection attempt to the browser that began it. It holds a random value, is unreadable to JavaScript, expires after 15 minutes, and exists to stop someone else's connection attempt from attaching their mailbox to your account.

In local storage, which survives closing the browser: your signed-in session, held here by Supabase Auth rather than in a cookie, along with whether you asked to be remembered and when you signed in; your light or dark theme choice; and small interface preferences such as the CRM layout you last used and whether a panel was collapsed.

In session storage, which is cleared when you close the tab: a marker used when you choose not to be remembered; on the public site, how you arrived, meaning any campaign parameters in the link you followed, the page you landed on, and the time, kept so we can tell which pages bring people in; and AI results already generated for a record, cached so that reopening it does not spend another AI action. That cache can contain text derived from your workspace, which is why it lives in session storage and not on disk.

Clearing your browser storage signs you out and resets those preferences. Connecting a Google, LinkedIn, or Meta account sends you to that provider, where their own cookies apply.

Flowtiq is a business tool, sold to businesses and not directed at children. You must be at least 18 to hold an account, and you confirm that when you sign up. We do not knowingly collect personal data from anyone under 18, and we run no advertising, no profiling and no tracking that would make a child's data valuable to us in the first place.

If we learn that an account belongs to someone under 18 we close it and delete the data. If you are a parent or guardian and believe a child has given us personal data, email contact@flowtiq.ai and we will delete it without asking you to prove anything first.

Separately: the contacts you import are your responsibility, and Flowtiq is not the place to keep records about children.

We will update this policy as the product changes. Material changes get notice by email or in the app, and the date at the top always shows the version in force.

Privacy questions, requests, and corrections go to contact@flowtiq.ai. The commercial terms are in the Terms of Service.