Privacy Policy

1. Information we collect

We collect the following categories of information:

• Account information — when you sign in through a single sign-on provider (such as Google or GitHub) or an email magic link, we receive your name, email address, profile image, and provider identifier. We do not handle or store any password for Flowy.
• Content and inputs — the prompts and instructions you write, files and media you upload, brand assets and website URLs you submit for brand-kit extraction, your canvas and timeline data, comments, and the AI-generated media (“Outputs”) you produce on the Service.
• Workspace and collaboration data — workspaces, projects, member roles, invitations, sharing settings, presence and activity (such as live cursors), and community templates you publish or remix.
• Billing information — your plan, credit balance and usage, and transaction records. Payments are processed by Stripe; we receive confirmation and limited details (such as the last four digits and card type) but we do not collect or store full payment-card numbers.
• Usage, device, and log data — how you interact with the Service, feature usage and analytics events, credit consumption, IP address, browser and device type, and diagnostic logs.
• Cookies and similar technologies — used to keep you signed in, remember preferences, secure the Service, and understand usage (see “Cookies” below).
• Communications — messages you send us, support requests, and your email and notification preferences.

2. How we use your information

We use personal information to:

• Provide, operate, and maintain the Service, including authenticating you, running generations, saving your work, and enabling collaboration and sharing.
• Process your prompts and inputs through AI model providers to generate the Outputs you request.
• Process payments, manage plans and credits, and prevent payment fraud.
• Secure the Service, detect and prevent abuse and violations of our Terms, and protect our users and the public.
• Improve, troubleshoot, and develop new features and models. Where we use your content to improve our products and models, we use de-identified or aggregated data wherever practicable, and you can contact us to ask about opting out.
• Communicate with you about the Service — including transactional messages (such as sign-in links, invitations, and account notices) and, where permitted, product updates and marketing you can opt out of.
• Comply with legal obligations and enforce our agreements.

3. AI generation and your prompts

Generating media on Flowy relies on AI models, some operated by third-party providers. When you run a generation, the relevant inputs — which may include your prompts, uploaded or connected media, and reference material such as brand assets — are transmitted to and processed by these providers (for example, FAL, Replicate, and Anthropic) to produce your Outputs.

These providers process your inputs to deliver the requested results and under their own terms and privacy policies. We work to limit what is shared to what is needed to fulfill your request. Please do not submit sensitive personal information, confidential material, or content you do not have the right to use as part of a prompt or upload.

4. Legal bases for processing (EEA/UK users)

If you are in the European Economic Area or the United Kingdom, we process your personal information on the following legal bases: to perform our contract with you (to provide the Service you request); for our legitimate interests (such as securing, improving, and promoting the Service), balanced against your rights; with your consent (for example, certain cookies or marketing, which you can withdraw at any time); and to comply with our legal obligations.

5. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only as described here:

• Service providers and subprocessors — companies that help us run the Service, including AI model and infrastructure providers (such as FAL, Replicate, and Anthropic), cloud hosting and storage providers, our payment processor (Stripe), analytics tools, and email/communication providers. They may process personal information only on our instructions and under appropriate confidentiality and data-protection obligations.
• Collaborators and people you share with — when you invite others to a workspace, share a project, or collaborate, your shared content and certain activity become visible to them.
• The public — content you choose to make public, such as a community template you publish, is visible to and may be used or remixed by others.
• Legal and safety — when we believe disclosure is reasonably necessary to comply with law or legal process, enforce our Terms, or protect the rights, safety, and security of our users, the public, or Flowy.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy continuing to govern your information.
• With your consent — for any other purpose disclosed to you at the time.

6. Cookies and similar technologies

We use strictly necessary cookies to sign you in and keep the Service secure, and we use functional and analytics technologies to remember preferences and understand how the Service is used. You can control non-essential cookies through your browser settings and, where offered, our cookie controls; disabling some cookies may affect how the Service works.

7. Data retention

We keep personal information for as long as your account is active and as needed to provide the Service, and afterward for as long as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. When you delete content or close your account, we delete or de-identify the associated personal information within a reasonable period, except for content you shared publicly or with others who retain it, limited copies retained in backups, and information we are required or permitted to keep by law.

8. Data security

We use technical and organizational measures designed to protect personal information, including access controls and encryption in transit. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. Please help protect your account by securing the email and identity providers you use to sign in to Flowy.

9. International data transfers

Flowy operates globally, and your information may be processed in the United States, India, and other countries where we or our service providers operate. These countries may have data-protection laws that differ from those in your country. Where required, we rely on appropriate safeguards — such as the European Commission's Standard Contractual Clauses — for international transfers of personal information.

10. Your privacy rights

Depending on where you live, you may have some or all of the following rights regarding your personal information: to access it; to correct it; to delete it; to receive a portable copy; to object to or restrict certain processing; and to withdraw consent where processing is based on consent.

If you are in California, you have rights under the CCPA/CPRA, including the right to know, delete, and correct your personal information, and the right not to be discriminated against for exercising your rights. We do not sell or share personal information as those terms are defined under California law.

If you are in India, you have rights under the Digital Personal Data Protection Act, 2023, including the right to access, correct, and erase your personal data, the right to grievance redressal, and the right to nominate another person to exercise your rights. You may contact our privacy team at privacy@tryflowy.ai for grievance redressal.

To exercise any of these rights, email us at privacy@tryflowy.ai. We will respond within the timeframes required by applicable law and may need to verify your identity first. You also have the right to lodge a complaint with your local data-protection authority.

11. Children's privacy

The Service is intended for users who are at least 18 years old and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, please contact us at privacy@tryflowy.ai and we will take appropriate steps to delete it.

12. Third-party links and services

The Service may link to or integrate third-party websites and services that we do not control. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review their policies.

13. Changes to this Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you through the Service or by email. Your continued use of the Service after the changes take effect means you accept the updated Policy.

14. Contact us

Flowy is operated by Flamingos Technologies Inc., which is the controller of your personal information. For privacy questions, requests, or grievances, email our privacy team at privacy@tryflowy.ai, or contact us generally at contact@tryflowy.ai.