This privacy policy explains which personal data we process when you visit our website or use Flowzy Agents, why we do so, how long we keep it and what your rights are. We process as little personal data as possible, and only to provide, improve and protect the Service.
1.Who is responsible
1.1Flowzy FZC, C1 Building B.C.1301232, Ajman Free Zone – C1 Area, Ajman, United Arab Emirates (trade licence 33853) is the controller for the personal data described in this policy, except where we act as processor for business customers (see below). Contact for all privacy matters: support@flowzy.ai.
1.2Flowzy FZC is established outside the European Union. In accordance with Article 27 GDPR we designate a representative in the EU; their contact details will be listed here as soon as the appointment is in place. Until then you can reach us for all privacy questions at support@flowzy.ai.
To be confirmed by counsel: Appointment of an EU representative (Article 27 GDPR) and, if needed, a UK representative (Article 27 UK GDPR) to be arranged and confirmed by counsel.
2.Controller and processor
2.1We are the controller for account data: the data of the people who sign up and of the people they invite to their workspace, billing data, website visits, support, analytics and security.
2.2For the content of a workspace (conversations with AI agents, instructions, files, the work done on the AI agents' computers, messages through connected channels and the personal data of other people contained in all of this), our role depends on how the Service is used. When a business uses the Service, that business is the controller and we are its processor under our Data processing agreement. When you use the Service as a consumer for private purposes, we process that content as controller, only to provide the Service to you.
2.3If your data appears in the content of one of our customers (for example because you received an email from an AI agent) and you have a question about it, please contact that customer first. We forward any request we receive and help where we can.
3.Which data we process
3.1Depending on how you use our website and the Service, we process the following categories:
- Account data: name, email address, language, profile picture, role in the workspace and, if verified, phone number.
- Workspace data: the name of the workspace, what you tell us about yourself and the work you want help with (your AI agents read this as background) and the background knowledge you choose.
- Billing data: whether you buy as an individual or as a business; for business purchases the company name, address and VAT number; plan, invoices, payment status and payment history. Card or bank details are processed by Stripe; we only receive a reference and, for example, the last digits of the card.
- Usage data: login times, settings, credit usage, the AI agents in your workspace and the tasks they carry out (metadata).
- Sign-up source: how you found us (referring website, campaign tags, landing page or referral link), recorded once when you sign up.
- Website analytics: pages visited, referring website, campaign tags, country, device type and browser, measured without cookies (see the section "Cookies and analytics").
- Technical and security data: IP address, browser and device information, a device identifier, keyed hashes of the email address, device, IP address and (where provided) phone number or company number to prevent trial abuse, and logs.
- Communication: emails with our support team, email preferences and unsubscribes.
- Workspace content: conversations with your AI agents (in the app and through connected channels), instructions, files and results, screenshots of task steps, screen recordings and keystrokes made when you show a task (password fields are skipped), memories and skills, the browser profile of each AI agent's computer (including cookies and sessions of websites you log in to on it), logins stored in the encrypted vault, access tokens of connected accounts (such as Google or Microsoft), identifiers of connected channels (such as a Telegram, Slack or Discord user ID) and the personal data of other people contained in all of this.
4.Purposes and legal bases
4.1We process personal data for the following purposes and on the following legal bases (Article 6 GDPR):
| Purpose | Legal basis |
|---|---|
| Creating and managing your account and workspace, providing the Service (including running your AI agents and their computers around the clock and delivering messages through the channels you connect), support | Performance of the contract (Art. 6(1)(b)) |
| Billing, accounting and tax obligations, checking VAT numbers | Legal obligation (Art. 6(1)(c)) and performance of the contract |
| Security, preventing fraud, spam and trial abuse, usage limits | Legitimate interest in protecting the Service, our users and the people AI agents contact (Art. 6(1)(f)) |
| Service emails (login links, approvals, questions from your AI agents, payment notices, credit warnings) | Performance of the contract (Art. 6(1)(b)) |
| Trial reminders, daily and weekly reports | Legitimate interest (Art. 6(1)(f)); you can unsubscribe at any time |
| Referral programme: recording who invited whom and granting bonus credits | Performance of the contract (Art. 6(1)(b)) |
| Website analytics and sign-up source, improving the Service with aggregated statistics | Legitimate interest (Art. 6(1)(f)), or your consent where the law requires it (Art. 6(1)(a)) |
| Establishing, exercising or defending legal claims | Legitimate interest (Art. 6(1)(f)) |
4.2When we process workspace content as a processor, we do so solely on the documented instructions of the business customer, as described in the Data processing agreement.
4.3We do not sell personal data, we do not use it for advertising and we do not use workspace content to train AI models. We do not take decisions with legal or similarly significant effects about you based solely on automated processing (Article 22 GDPR).
5.How AI is used
5.1Your AI agents use AI models from providers such as Anthropic, OpenAI, Google and Mistral. For each step of a task, the provider receives only the content needed for that step, for example your message, a screenshot of the AI agent's screen or the text of a document. We choose the model per step.
5.2We use these providers through their business APIs. Under their API terms they do not use this data to train their models and keep it only for a limited period for abuse monitoring, unless the law requires otherwise.
5.3Our staff do not read workspace content, except when needed to help you at your request, to investigate security incidents or abuse, or to comply with the law. Such access is limited and logged.
6.Messaging channels
6.1If you connect a messaging channel, such as Telegram, WhatsApp, Slack, Discord or email, we receive the messages and attachments you send to your AI agents through that channel and send their replies back. We store the identifiers we need to recognise you (such as your user ID and display name) and keep the messages as part of your conversations.
6.2The provider of the channel processes these messages as part of its own service, under its own terms and privacy policy. Some providers process data outside the European Economic Area. You can disconnect a channel at any time in the app; we then stop receiving messages through it.
To be confirmed by counsel: Whether channel providers act as sub-processors or as independent services chosen by the customer to be confirmed by counsel.
7.How long we keep data
| Data | Retention period |
|---|---|
| Account data and workspace content | For as long as the workspace is active. After the end of the plan or trial, or when you erase the workspace, it is suspended and everything is permanently deleted after 30 days, including the encryption key of the workspace and the AI agents' computers. |
| Identifiers of a connected channel | Until you disconnect the channel or the workspace is deleted; the messages remain part of your conversations |
| Application and server logs | 7 days |
| Database backups | Automated backups 2 days; weekly encrypted backups 90 days (plus at most 7 days for superseded versions) |
| Error reports (Sentry) | At most 90 days |
| Website analytics | Individual events at most 25 months; aggregated statistics without personal data may be kept longer |
| Invoices and accounting records | As long as tax and accounting law requires (generally up to 7 years) |
| Keyed hashes for trial abuse prevention | Up to 3 years after the trial, also after the workspace is deleted |
| Support emails | Up to 2 years after the last contact |
7.1Deleted data can remain in encrypted backups until those backups expire. Because the encryption key of the workspace is destroyed on deletion, that data can no longer be read. If a backup is ever restored, we delete the affected data again.
To be confirmed by counsel: The retention periods for analytics events, trial abuse hashes, support emails and accounting records are proposals to be confirmed by counsel and the accountant.
8.Who receives data (sub-processors)
8.1We use the following service providers. They only process personal data on our instructions and under a data processing agreement. Messaging channels are only involved when you connect them.
| Provider | Purpose | Where data is processed | Safeguards |
|---|---|---|---|
| OVHcloudOVH SAS, Roubaix, France | Hosting, database, file storage, the AI agents' computers and backups | EU (Gravelines, France) | EU provider; DPA |
| AnthropicAnthropic, PBC, San Francisco, USA | AI models (processing of task content) | United States | DPA + Standard Contractual Clauses; no training on API data |
| OpenAIOpenAI, L.L.C., San Francisco, USA | AI models (processing of task content) | United States | DPA + Standard Contractual Clauses; no training on API data |
| Google (Gemini API)Google LLC, Mountain View, USA / Google Cloud EMEA Ltd, Dublin, Ireland | AI models (processing of task content) | United States and EU | DPA + Standard Contractual Clauses; no training on paid API data |
| Mistral AIMistral AI SAS, Paris, France | AI models (processing of task content) | EU (France) | EU provider; DPA; no training on API data |
| StripeStripe, Inc. and affiliates | Payments, subscriptions and invoices | EU and United States | DPA + Standard Contractual Clauses / Data Privacy Framework |
| ResendResend, Inc., San Francisco, USA | Sending emails (service emails and, if you use it, the email channel) | EU (Ireland, eu-west-1) | DPA + Standard Contractual Clauses (US company) |
| SentryFunctional Software, Inc., San Francisco, USA | Error monitoring | EU data region (Germany) | DPA + Standard Contractual Clauses (US company) |
| TelegramTelegram Messenger Inc. and affiliates | Telegram channel, only if you connect it | Outside the EEA | Telegram's terms and privacy policy; transfer safeguards to be confirmed |
| WhatsApp (Meta)Meta Platforms Ireland Ltd., Dublin, Ireland / WhatsApp LLC | WhatsApp channel, only if you connect it | EU and United States | Meta's business and data processing terms; Standard Contractual Clauses |
| SlackSlack Technologies, LLC and affiliates (Salesforce) | Slack channel, only if you connect it | United States (or your Slack workspace's data region) | DPA + Standard Contractual Clauses / Data Privacy Framework |
| DiscordDiscord Inc., San Francisco, USA | Discord channel, only if you connect it | United States | Discord's terms and privacy policy; Standard Contractual Clauses |
8.2If you choose to log in with Google or Microsoft, or to connect a mailbox, calendar or other account, those providers process data under their own terms. Websites and services that your AI agents use on your behalf receive the data your AI agents send to them. We may also disclose data where we are legally required to do so.
8.3We announce changes to this list in advance, as described in the Data processing agreement.
9.International transfers
9.1We store data in the European Union, in the OVHcloud data centre in Gravelines (France).
9.2Some processing takes place outside the European Economic Area: by AI model providers in the United States, by service providers that may access data for support, by the messaging channels you connect, and by Flowzy FZC itself, which manages the Service from the United Arab Emirates. For these transfers we rely on the European Commission's Standard Contractual Clauses (SCC), where applicable on the EU-US Data Privacy Framework or another adequacy decision, and on additional measures such as encryption in transit and at rest and strict access control.
9.3You can request a copy of the relevant safeguards at support@flowzy.ai.
10.Security
10.1We protect personal data with appropriate technical and organisational measures, including:
- encryption in transit (TLS) and at rest, with a separate encryption key per workspace;
- separation of workspaces at database level, and isolated computers for your AI agents that can reach the internet but not our internal systems or other workspaces;
- logins for third-party websites stored in an encrypted vault;
- approval before important actions of your AI agents;
- access to production data only for authorised staff, on a need-to-know basis, with logging;
- regular backups, tested restores and short log retention.
11.Your rights
11.1Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, to data portability and to withdraw your consent at any time where processing is based on consent. People in other countries, such as the United Kingdom, Switzerland or some US states, have similar rights under their own law; we honour them in the same way.
11.2Many of these rights can be exercised directly in the app (profile, settings, download of all data, erasing the workspace). For everything else, email support@flowzy.ai. We answer within one month. We may ask you to verify your identity.
11.3You also have the right to lodge a complaint with a supervisory authority, in particular in the country where you live or work. In Belgium this is the Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, https://www.dataprotectionauthority.be. We would appreciate it if you contact us first, so we can try to help.
12.Children
12.1The Service is not intended for children. You must be at least 18 years old to create an account. If you believe that a child has given us personal data, let us know at support@flowzy.ai and we will delete it.
14.Data processing agreement
14.1For business customers, our Data processing agreement applies to workspace content. It is published on this website and forms part of our Terms of service. A signed copy is available on request at support@flowzy.ai.
15.Changes
15.1We may update this policy. The date at the top shows the latest version. We inform workspace owners of material changes by email in advance.