This Privacy Policy explains how [Legal entity name] (“Flow Charter”, “we”, “us” or “our”) collects, uses, shares and protects personal information when you visit flowcharter.io, use the Flow Charter editor, or use any related feature, including the AI Assistant (together, the “Service”). It also explains the choices and rights you have. Please read it together with our Terms of Service.
Who we are
The Service is operated by [Legal entity name], [Postal address]. For the purposes of the EU and UK General Data Protection Regulations (“GDPR”) and similar laws, we are the controller of the personal information described in this policy, except where we say otherwise.
You can reach us about anything in this policy at privacy@flowcharter.io.
Information we collect
Information you give us
- Account information. When you create an account we collect your email address and a password. Passwords are stored by our authentication provider in hashed form; we cannot see them. If you sign in with Google, we receive your name, email address, profile picture and Google account identifier from Google.
- Charts you save. When you are signed in, we store the charts in your library: their titles, their contents (shapes, text, connectors, styling and pictures) and a small preview image.
- Assistant inputs. When you use the Assistant, we receive what you send it: images and PDF files, their file names, any instructions or descriptions you type, and, for edit requests, the contents of the chart you are working on. See Files you upload to the Assistant.
- Communications. If you email us or send feedback, we keep the message, your contact details and our reply.
Information collected automatically
- Usage and device information (Google Analytics). Pages and features you use, actions you take (such as starting a chart or exporting one), the site that referred you, your browser, operating system, device type, screen size and language, your approximate location (city or country, derived from your IP address), the date and time of your visit, and random identifiers stored in cookies.
- Interaction and session-replay data (Hotjar). How you move through our pages: clicks, taps, mouse movements, scrolling, the pages you visit, your device and browser, and your approximate country. Hotjar uses this to produce heatmaps and recordings of visits. We configure Hotjar to suppress text you type and to hide the contents of your charts, so they are not captured in recordings.
- Server and security logs. When your browser talks to our servers we record technical information such as your IP address, the request made, the time, and any errors, which we use to run, secure and debug the Service.
Information from third parties
- Google sign-in. If you choose to sign in with Google, Google shares the profile information described above with us, according to your Google account settings.
- Google Search Console. Google provides us with aggregated reports about how flowcharter.io appears in Google Search, such as the search terms that led to it and how often it was shown and clicked. These reports do not identify individual visitors to us.
Information that stays on your device
The board you are working on, and your light or dark theme choice, are saved in your browser’s local storage so your work survives a page reload. We do not receive that board unless you save it to your account or send it to the Assistant. Clearing your browser’s site data deletes it.
How we use information
We use personal information only for the purposes below. Where the GDPR or a similar law applies, the right-hand column shows the legal basis we rely on.
| Purpose | Legal basis |
|---|---|
| Providing the Service: creating and securing your account, saving and syncing your charts, exports, and the features you ask for | Performance of our contract with you |
| Running the Assistant: sending your files and instructions to our AI provider and returning the result | Performance of our contract with you |
| Improving the Service, including keeping Assistant inputs and outputs to evaluate, test, debug and improve its accuracy and to develop new features, which may include training or fine-tuning machine-learning models | Our legitimate interest in making the Service better. You can object at any time (see Your rights) |
| Understanding how the Service is used through Google Analytics and Hotjar, and how people find it through Google Search Console | Your consent, where the law requires it; otherwise our legitimate interest in understanding and improving the Service |
| Sending service messages, such as email confirmation, password resets, security alerts and notices of changes to our terms | Performance of our contract with you; our legitimate interests |
| Sending product news, only if you have agreed to receive it or the law otherwise allows; every such email lets you unsubscribe | Your consent, or our legitimate interests where permitted |
| Keeping the Service safe: preventing fraud, abuse, spam and attacks, and enforcing our Terms | Our legitimate interests; compliance with legal obligations |
| Complying with the law, responding to lawful requests, and establishing, exercising or defending legal claims | Compliance with legal obligations; our legitimate interests |
We do not use your information for automated decision-making that produces legal or similarly significant effects on you, and we do not use it to show you targeted advertising.
Files you upload to the Assistant
The Assistant can turn a photo, screenshot or PDF into an editable chart, or build and edit a chart from a description. You do not need an account to use it. Here is what happens to what you send:
- Processing. Your files, instructions and, for edits, your current chart are sent to our servers and from there to Google’s Gemini API, which Google operates as our service provider, to produce the result.
- Keeping uploads to improve Flow Charter. We may store copies of the files you upload, the instructions you give, and the charts the Assistant produces from them. We may use them to evaluate, test, debug and improve the Assistant and the Service, and to develop new features, which may include training or fine-tuning machine-learning models. Authorised members of our team, and service providers acting for us under confidentiality obligations, may review them for these purposes.
- How long. Uploads kept for these purposes are deleted, or de-identified so they can no longer reasonably be linked to you, within 24 months of being uploaded, unless we need to keep them longer to comply with the law or resolve a dispute.
- What we never do with them. We do not sell your uploads, publish them, or use them to advertise to you.
Please do not upload documents containing sensitive information, such as health or financial records, government identification numbers, passwords or access credentials, trade secrets, or personal information about other people that you do not have the right to share. If a document is confidential, remove that content before uploading it.
You can object to our keeping your uploads, or ask us to delete ones we have kept, by emailing privacy@flowcharter.io. If you were signed out when you uploaded, tell us the approximate date and time and the file names so we can find them. If we cannot reasonably link an upload to you, we may be unable to locate it. Information that has already been de-identified, or aggregated so that it no longer relates to you, is not personal information, and we may keep using it.
International transfers
We and our service providers may process personal information in the United States and other countries whose data protection laws may differ from those where you live. When we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we rely on an adequacy decision (including the EU–U.S. Data Privacy Framework and its UK and Swiss extensions, where the recipient participates) or on the European Commission’s Standard Contractual Clauses and the UK addendum to them, together with additional safeguards where needed. You can ask us for more information about these safeguards.
How long we keep information
We keep personal information only for as long as we need it for the purposes in this policy, including:
- Account information and saved charts: for as long as your account is open. When you delete a chart, or your account, we delete the related data from our live systems promptly. Copies may remain in encrypted backups for up to 30 days before they are overwritten.
- Assistant uploads kept for improvement: up to 24 months, as described above.
- Google Analytics data: 14 months, after which Google deletes it.
- Hotjar data: up to 365 days.
- Server and security logs: up to 90 days, unless we need them longer to investigate a security incident or abuse.
- Correspondence: for as long as needed to deal with your enquiry and any follow-up.
We may keep information longer where the law requires it, or where we need it to establish, exercise or defend legal claims.
Security
We use administrative, technical and organisational measures designed to protect personal information. They include encryption in transit, access controls that let each account read only its own charts, restricting staff access to those who need it, and keeping secret keys on the server. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a breach that affects your personal information, we will notify you and the authorities where the law requires us to. You are responsible for keeping your password confidential.
Your rights and choices
Depending on where you live, you may have some or all of these rights over your personal information:
- Access. Confirm whether we process your information and get a copy of it.
- Correction. Have inaccurate information corrected.
- Deletion. Have your information deleted.
- Portability. Receive information you gave us in a structured, machine-readable format. You can also export any chart yourself as JSON, PNG or SVG.
- Objection. Object to processing based on our legitimate interests, including keeping your Assistant uploads to improve the Service, and to direct marketing at any time.
- Restriction. Ask us to limit how we use your information while a concern is resolved.
- Withdraw consent. Where we rely on your consent, withdraw it at any time. This does not affect processing that already took place.
- Complain. Lodge a complaint with your local data protection authority. We would appreciate the chance to address your concern first.
To exercise any of these rights, email privacy@flowcharter.io from the address linked to your account, if you have one. We may need to verify your identity before acting on a request, and we will respond within the time the law requires, usually one month. We will not charge you or treat you differently for exercising your rights. If we cannot fully meet a request, for example because the law requires us to keep certain information, we will explain why.
Notice for US state residents
This section applies to residents of California and other US states with comprehensive privacy laws, and supplements the rest of this policy.
Categories of personal information we collect (and have collected in the past 12 months), from the sources and for the purposes described above:
- Identifiers, such as your name, email address, IP address, account ID and cookie identifiers.
- Internet or other electronic network activity, such as pages viewed, features used and interactions with the Service.
- Approximate geolocation, derived from your IP address. We do not collect precise geolocation.
- Audio, electronic, visual or similar information, such as images and documents you upload.
- Account login credentials (sensitive personal information), which we use only to provide and secure your account, not to infer characteristics about you.
- Any other information you choose to include in charts, uploads or messages to us.
We disclose these categories for business purposes to the service providers listed in How we share information. We do not sell or share personal information, as those terms are defined under California law, and we have no actual knowledge of selling or sharing the personal information of anyone under 16.
Your rights. Subject to the law of your state, you may have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to obtain a portable copy; to opt out of its sale, sharing or use for targeted advertising or profiling (which we do not do); and not to be discriminated against for exercising these rights. You may use an authorised agent, who must provide proof of their authority. We will verify requests by matching the information you give us with the information we hold. If we deny your request, you may appeal by replying to our decision. If your appeal is denied, you may contact your state attorney general.
Children
The Service is not directed to children. You must be at least 13 years old to use it, or older where the law of your country requires a higher age to consent to the processing of personal information (16 in some EEA countries). We do not knowingly collect personal information from children below these ages. If you believe a child has given us personal information, contact us and we will delete it.
Third-party sites and services
The Service may link to, or let you sign in with, services we do not control, such as Google. Their own privacy policies govern how they handle your information, and we encourage you to read them, including Google’s Privacy Policy, how Google uses information from sites that use its services, Hotjar’s Privacy Policy and Supabase’s Privacy Policy.
Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top shows when it last changed. If we make a material change, we will tell you before it takes effect, by email if you have an account or by a notice in the Service. Where the law requires your consent to a change, we will ask for it.
Contact us
For questions about this policy, or to exercise your rights, contact:
[Legal entity name][Postal address]
privacy@flowcharter.io