Privacy Policy

1. Who we are

FlowProofs is operated by Axelon Tech (“we”, “us”). For your account data we decide how and why it is used, which makes us its controller (under GDPR) or data fiduciary (under India’s Digital Personal Data Protection Act, 2023). Our legal name, address and registration details are on the company information page.

For data you upload about other people (for example a spreadsheet of customers), you decide what is in it and why, and we process it only to run FlowProofs for you, as your processor. The Data Processing Addendum covers that.

2. What we collect

• Account: your email address, name, password (stored only as a hash by our authentication provider) or the Google account you sign in with, and your settings.
• Agreement and consent record: that you confirmed you are 18 or older and accepted the Terms and this policy, when, and which version; and each analytics choice you make, with the date.
• Your content: files you upload, the data tables made from them, canvases, numbers, formulas, comments, images and version history.
• Connected sources: if you connect a data source (for example Google Sheets, Microsoft Excel on OneDrive or SharePoint, HubSpot, QuickBooks, Stripe, Notion or a Postgres database), the access token or password it needs, encrypted, and the data you choose to import. Section 10 says more about Google and Microsoft.
• AI usage log: for each AI request, what it was for, the model, its size and cost. Not the text of the request or the answer.
• View counts on shared links: that a shared canvas was opened, when, and the referring website. No IP address, no identity of the viewer.
• Product analytics and error reports, described in section 8.
• Contact and walkthrough requests: your name, email address, topic and message. We never ask your age or school.
• Technical and security data: your IP address is used briefly to limit abuse (for example too many password attempts). We do not store it ourselves: it is turned into a code that changes every day and kept only in memory, for at most an hour. Our hosting and sign-in providers keep standard access and sign-in logs (section 4).
• Payments: FlowProofs takes no payments today. When paid plans start, a payment provider will handle card details, and we will never see or store card numbers.

We do not:

• sell or rent personal data, or “share” it for cross-context advertising
• use your uploaded data or canvases to train AI models, or let our AI provider do so
• use advertising cookies, pixels or tags, or run ads
• record your screen, mouse movements or keystrokes: there is no session recording or replay anywhere in FlowProofs
• look at your canvases, unless you ask us to for support, or the law or a security investigation requires it

3. Why we use it, and on what basis

Where we rely on consent, you can withdraw it at any time, as easily as you gave it, and that does not affect what happened before.

4. How long we keep it

These limits are enforced by a job that runs every day. Backups roll over on their own schedule, so deleted data can remain in a backup until it expires; backups are never used to restore one person’s data after they delete it. We do not delete inactive accounts today; if that changes, we will email you at least 48 hours before, as the DPDP Rules require.

5. Who receives it

We use a small number of service providers (sub-processors) to run FlowProofs: Supabase for the database, sign-in and file storage, Vercel for hosting, Anthropic for AI features, Resend for email, PostHog for product analytics, Sentry for error reports and Google Analytics for the public website. Each receives only what its job needs, under that provider’s data processing terms. The full list, with what each receives, where, and a link to each one’s terms, is on the sub-processors page.

We share data with authorities only when the law requires it, and we will tell you if we are allowed to. If FlowProofs or its business is ever sold or merged, your data would move only under this policy, and we would tell you first.

6. International transfers

FlowProofs’ servers run in Singapore; the database and files are kept in the region shown on the sub-processors page; some providers (for example Anthropic, Sentry and Resend) process data in the United States. When data leaves the EU, EEA, UK or Switzerland, the transfer is covered by the provider’s Standard Contractual Clauses (with the UK addendum) or an adequacy decision such as the EU-US Data Privacy Framework. Where Indian law applies, we transfer data only to countries the Government of India has not restricted.

7. Shared canvases

When you share a canvas by link, anyone with the link can see the read-only canvas: the values it shows, not your underlying data, unless you turn on “Allow viewers to see underlying data” for that link. You can turn a link off at any time. Shared links load no analytics tools (no Google Analytics, no PostHog); the owner only sees how many times the link was opened. If a viewer comments without an account, we keep the name they type and the comment, as part of your canvas. Images you place on a canvas are stored at long, unguessable public addresses so they can load for viewers of a shared link; do not put anything in an image that you would not share.

8. Analytics, error reports and your browser's privacy signal

In the app (PostHog): we record named events (for example “a canvas was created”) with counts and settings, so we know what to improve. Never the contents of your canvases or data: no values, labels, formulas, comments or other text, and no session recordings, heatmaps or automatic click capture. You are identified by your account id, not your email. Nothing is sent until you agree, wherever you are, and you can change your choice at any time in Settings → Data and privacy. If you delete your account, your PostHog events, which hold only an account id and counts, expire with the retention period in section 4.

On the public website (Google Analytics): it does not load at all until you accept, wherever you are; after you decline it never loads. It is never used in the app or on shared links. See the cookie policy for every cookie and storage key we use.

Error reports (Sentry): when something breaks, a technical report with the error, the code location, browser and device type, and the page address without its query string. Request bodies, cookies, sign-in tokens, canvas content, values and comments are removed before a report is sent, and reports never include your email address. Reports from your browser follow the same consent rule as analytics; errors on our servers are reported from the servers.

Global Privacy Control: if your browser sends the Global Privacy Control signal, we treat it as your choice to decline analytics, everywhere, without asking. The choice dialog says so, and you can still opt in yourself if you want to. Change your choice at any time from Your privacy choices in the website footer, or Settings → Data and privacy in the app.

We do not record your screen, mouse movements or keystrokes. No session replay, no heatmaps, no chat widgets and no advertising pixels are used anywhere in FlowProofs.

9. AI features

AI features send the names, values and text the feature needs to Anthropic, only when you use one. Under Anthropic’s commercial terms, that data is not used to train their models, and we do not train models on it either. You can turn AI features off for your account in Settings → Data and privacy; nothing is then sent. Text written by AI is labelled “AI-generated” wherever it appears. The AI use page has the details.

10. Data from Google and Microsoft

When you connect Google (Sheets, Drive or Analytics) or Microsoft (Excel on OneDrive or SharePoint, through Microsoft Graph):

• we read only what is needed to import the files, sheets or reports you choose, and we never change or delete anything in your account
• we use that data only to show it in FlowProofs and run the features you use with it
• we never use it for advertising, never sell it, and never use it to train AI models, ours or anyone else’s
• no person at FlowProofs reads it, unless you ask us to (for support), it is needed for security (for example investigating abuse), or the law requires it
• you can disconnect at any time from Connections in the app, and remove FlowProofs’ access from your Google account or Microsoft account. Disconnecting deletes the stored token

The same rules apply to every other service you connect.

11. Emails

We send account emails you need (sign-up confirmation, password resets, your data export, account deletion notices) and up to three getting-started emails in your first two weeks. Every getting-started email has a one-click unsubscribe link and our postal address, and unsubscribing takes effect at once. We send no marketing or newsletter emails; if we ever do, we will ask first, with a separate box that is never ticked for you.

12. Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you, and a summary of what we do with it and who receives it
• correct it, complete it or update it
• erase it
• export it in a machine-readable format (portability)
• object to, or ask us to restrict, how we use it
• withdraw consent wherever we rely on it, as easily as you gave it
• nominate someone to use your rights for you if you die or cannot (DPDP Act, section 14)
• raise a grievance with our Grievance Officer, and get an answer within 30 days
• complain to a data protection authority: in India, the Data Protection Board of India, after first raising it with us; in the EU, EEA or UK, your local supervisory authority (in the UK, the ICO)
• not be treated differently for using any of these rights

13. How to use your rights

• In Settings → Data and privacy: download everything as a ZIP, delete your account, change your analytics choice, or turn AI features off. All self-serve, and they take effect at once.
• On the website: “Your privacy choices” in the footer changes your analytics choice.
• In any getting-started email: one click unsubscribes you from the rest.
• By email: write to privacy@flowproofs.com for anything else, to nominate someone, or if you cannot sign in. We may ask you to confirm it is you, usually by replying from your account’s email address.

We acknowledge every request within 24 hours and resolve it within 30 days. If a request is complex we will tell you why and how long it will take, within those 30 days. There is no charge.

14. Your US privacy rights

If you live in California or another US state with a privacy law (for example Colorado, Connecticut, Virginia, Texas or Oregon), this section applies to you too.

• What we collect, in the categories those laws use: identifiers (name, email, account id), customer records you upload, internet activity within FlowProofs (named feature events, if analytics is on), and approximate location from your IP address for the consent rule. We build no profiles or inferences about you, and collect no sensitive personal information beyond your account sign-in.
• Sources and purposes: from you and the services you connect, for the purposes in section 3.
• We do not sell personal data, and we do not share it for cross-context behavioural advertising. We run no ads and use no advertising cookies. There is therefore nothing to opt out of, but Global Privacy Control is honoured anyway (section 8).
• Your rights: to know, access, correct and delete your personal data, to port it, and to limit use of sensitive data, without being treated differently for asking.
• How to ask: Settings → Data and privacy, or privacy@flowproofs.com. An authorised agent can ask for you with your signed permission. We will confirm it is you before acting. If we refuse, you can appeal by replying to our answer; we decide appeals within 45 days.

15. Children

FlowProofs is for adults (18+). You must be 18 or older to create an account, and you confirm it when you sign up. The service is not directed at children and we do not knowingly collect personal data from anyone under 18. If we learn that an account belongs to someone under 18, we delete it and its data. If you believe a child has given us personal data, write to privacy@flowproofs.com.

16. Security and data breaches

Data is encrypted in transit (TLS) and at rest by our providers, every account’s data is kept apart by row-level security, and access is limited to what each task needs. Details are on the security page. Report a vulnerability to security@flowproofs.com.

If a breach affects your personal data, we will tell you without delay: what happened, what it means for you, what we are doing and what you can do. We report it to the authorities the law names, including India’s Data Protection Board and CERT-In and, where GDPR applies, the supervisory authority within 72 hours.

17. Changes to this policy

If we change this policy in a way that matters, we will email account holders at least 30 days before the change takes effect, show a notice in the app, and update the date at the top. Smaller wording changes only update the date. Your agreement record notes which version you accepted.

18. Contact, Grievance Officer and complaints