Privacy Policy

1. Who we are

FlowProofs is a web-based platform for building visual explanation models. It is operated by Axelon Tech, based in Mumbai, India.

• Data controller: Axelon Tech
• Contact: privacy@flowproofs.com
• Website: https://flowproofs.com

For GDPR purposes, Axelon Tech is the data controller. We do not currently have a Data Protection Officer (DPO), but all privacy inquiries can be directed to privacy@flowproofs.com and will be responded to within 30 days.

2. Data we collect

Account data (provided by you)

• Email address (required for authentication)
• Full name (optional, for display purposes)
• Profile picture (optional)

Content data (created by you)

• Explanation models: canvases containing variables, formulas, relationships, scenarios, assumptions, decisions and narrative text
• Images you upload into a canvas
• Datasets you upload in the Data tab. In the current version these are held in your own browser and never reach our servers — see Section 8.

Automatically collected data

• IP address
• Browser type and version
• Operating system
• Device type (desktop or mobile)
• Pages visited and features used within FlowProofs
• Referral source (how you found us)
• Timestamps of access

AI interaction data

When you use an AI feature we record the type of request, token count, estimated cost and response time. We do not record the content of your AI requests or the replies beyond what cost tracking needs. This record is kept in your own browser, not on our servers.

Data we do not collect

• Payment card numbers or bank details. We do not process payments today; if we do, they will be handled entirely by a third-party payment processor.
• Passwords. Authentication is handled by Supabase and we never see or store your password.
• Biometric data
• Precise geolocation. We never request GPS access.
• Racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or sexual orientation

3. How we use your data

• Providing the service: storing and rendering your explanation models, processing AI requests, enabling sharing and collaboration
• Authentication and security: verifying your identity, protecting your account, detecting and preventing abuse
• Communication: transactional email such as password resets and account notices. We will never send marketing email without your explicit opt-in.
• AI processing: sending the relevant context to our AI provider (Anthropic) to generate explanations, suggestions and summaries. See Section 5.
• Product improvement: looking at aggregated, anonymised usage patterns. We never read individual user content for this purpose.
• Legal compliance: responding to lawful data access requests from authorities

4. Legal basis for processing

Under GDPR and similar laws, we process your data on the following legal bases.

You may withdraw consent at any time for consent-based processing, without affecting the lawfulness of processing carried out before you withdrew it.

5. AI features and data processing

FlowProofs uses Anthropic’s Claude API for AI-powered features: “Explain Simpler” narration, formula suggestions, meeting summaries and model narrative generation.

What is sent to the AI

The minimum context needed to answer: variable names, their values, the relationships between them, and the question asked.

What is not sent to the AI

• Your email address or account details
• Your uploaded datasets
• Your full canvas data, beyond the variables and relationships in question
• Any other personal information

AI data retention

Anthropic’s commercial API terms state that API inputs and outputs are not used for model training and are retained for a maximum of 30 days for trust and safety purposes. See Anthropic’s privacy policy.

AI output labelling

Every AI-generated output in FlowProofs carries an AI badge. We never present AI-generated content as a data-sourced fact.

6. Data sharing and sub-processors

We share your data only with the service providers needed to operate FlowProofs.

We do not share your data with any other third party. We use no third-party analytics that track individual users, and we embed no advertising or tracking scripts.

The current list is kept at /subprocessors. We will notify registered users by email at least 30 days before adding a new sub-processor, and you may object by writing to privacy@flowproofs.com.

7. International data transfers

FlowProofs is operated from India. Your data is stored in the United States (Supabase, AWS us-east-1) and processed in the United States (Anthropic, Vercel).

Users in the EEA, United Kingdom and Switzerland

Transfers outside the EEA are protected by Standard Contractual Clauses adopted by the European Commission, incorporated into our agreements with sub-processors. Supabase, Anthropic and Vercel all maintain SCCs for international transfers.

Users in countries with data localisation requirements

We store all user data in the United States and do not currently offer regional data residency. If your jurisdiction requires personal data to be held locally — for example under China’s PIPL or Russia’s localisation laws — then using FlowProofs means your data is stored and processed in the United States. We say so plainly so you can make an informed choice.

Users in India

Under the DPDP Act 2023 we process your data as a Data Fiduciary. Transfers outside India are made in accordance with the applicable rules and the central government’s notifications on restricted territories.

8. Data retention

When you delete your account we remove your profile, canvases, folders, comments, share-link view events and uploaded images. The deletion runs immediately and is irreversible; residual copies in encrypted infrastructure backups are overwritten within 30 days.

9. Your rights

All users, worldwide

• Access: request a copy of your data (Settings → Export my data)
• Correction: update your profile information at any time
• Deletion: delete your account and its data (Settings → Delete my account)
• Objection: object to processing based on legitimate interest

Additional rights under GDPR (EU/EEA and UK)

• Data portability: receive your data in a structured, machine-readable format (JSON export)
• Restriction: request that we restrict processing
• Withdrawal of consent: withdraw consent at any time
• Complaint: lodge a complaint with your local supervisory authority. A list of EU authorities is at edpb.europa.eu.

Additional rights under CCPA/CPRA (California and other US states)

• Right to know what personal information we collect and how we use it, which this policy describes
• Right to delete your personal information (Settings → Delete my account)
• Right to opt out of sale. We do not sell personal information, so there is nothing to opt out of.
• Right to non-discrimination for exercising your privacy rights
• Categories collected: identifiers (email, name), internet activity (usage data), and content you create
• Categories sold or shared: none. We do not sell or share personal information for cross-context behavioural advertising.

Additional rights under India’s DPDP Act

• Correction and erasure of your personal data
• Grievance redressal: contact our grievance officer at privacy@flowproofs.com
• Nomination: nominate another person to exercise your rights in the event of death or incapacity

Additional rights under Brazil’s LGPD

• Confirmation of whether we process your data
• Access, correction, anonymisation, blocking or deletion, on request
• Information about the entities we share data with (Section 6)

To exercise any of these rights, email privacy@flowproofs.com or use the self-service options in Settings. We respond within 30 days, or sooner where your local law requires it.

10. Children’s privacy

FlowProofs is not intended for anyone under 16, or under the minimum age of digital consent in your jurisdiction if that is higher. We do not knowingly collect personal data from children. If you believe a child has created an account, write to privacy@flowproofs.com and we will delete it.

11. Cookies and local storage

The full detail is in our Cookie Policy. In short: we set essential authentication cookies only; we use no advertising, tracking or analytics cookies; and we use your browser’s local storage to hold your variables, datasets and preferences, which never leave your browser.

12. Data security

• All data in transit is encrypted with TLS 1.2 or later
• Data at rest in Supabase is encrypted
• Row Level Security means a user can only reach their own rows
• API keys and secrets live in environment variables, never in source code
• AI endpoints are rate limited and size capped to prevent abuse
• File uploads are validated for type and size, and stored under generated names
• Security headers are set on every response, including Content-Security-Policy, HSTS and X-Frame-Options
• Dependencies are audited for known vulnerabilities

13. Data breach notification

If a personal data breach is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours as GDPR requires, or within the period your local law sets. We will notify affected users without undue delay. The notice will say what happened, which data was affected, the likely consequences and what we have done about it.

14. Changes to this policy

We may update this policy as our practices or the law change. For material changes we will update the date at the top, email registered users at least 30 days before the change takes effect, and show a notice in the app. Continuing to use FlowProofs after the effective date means you accept the updated policy.

15. Region-specific disclosures

European Economic Area and United Kingdom

Our legal bases are in Section 4 and our transfer safeguards in Section 7. You may complain to your local data protection authority.

California and other US states with privacy laws

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use sensitive personal information beyond what providing the service requires. Your rights are set out in Section 9.

India

We are a Data Fiduciary under the DPDP Act 2023. Our grievance officer is reachable at privacy@flowproofs.com and we respond within the period the applicable rules prescribe.

Brazil

Our processing rests on the legal grounds in Section 4, read against LGPD. You may contact us, or the ANPD (Autoridade Nacional de Proteção de Dados), about your rights.

Other jurisdictions

If your country has requirements this policy does not address, write to privacy@flowproofs.com and we will work with you.

16. Contact

• Email: privacy@flowproofs.com
• Entity: Axelon Tech, Mumbai, India
• Response time: within 30 days, or sooner where your local law requires it