Privacy Policy

1. Who We Are

Flowki Labs ("Flowki Labs", "we", "us", "our") is an AI-powered process automation platform operated by Flowki Labs. Our service is available at flowkinexus.com.

For GDPR purposes, Flowki Labs is the data controller of your personal data. For questions about this policy, see Section 14.

2. What We Collect

2.1 Account Data

• Email address — required to create an account and log in
• Name — optional, used for display and team features
• Password — stored as a one-way cryptographic hash (never in plain text)
• Account timestamps — when your account was created and last updated

2.2 Process & Automation Data

• Process definitions you create (names, descriptions, step configurations)
• Process execution history (run status, timing, step outputs)
• Workflow data generated during automations (e.g., extracted invoice fields)

2.3 Integration Data

When you connect third-party services (Google, Slack), we store encrypted OAuth tokens to act on your behalf. We store only what's necessary and delete tokens immediately on disconnect.

2.4 Usage & Analytics Data

• Pages visited, features used, actions taken within the app
• IP address, browser type, and device information (for security and performance)
• Error logs and performance metrics

2.5 Waitlist Data

If you submit your email on our waitlist, we store that email and the source of submission.

2.6 Consent Records

We log cookie consent decisions (accept/reject) with timestamp and anonymized IP to maintain compliance records.

3. How We Use Your Data

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), UK, or Switzerland, we rely on the following lawful bases under GDPR Article 6:

• Performance of a contract (Art. 6(1)(b)): We process your account data, process definitions, and integration tokens to deliver the service you signed up for.
• Legitimate interest (Art. 6(1)(f)): We process usage analytics and security logs to maintain, improve, and protect our service. We have conducted balancing tests to ensure this doesn't override your rights.
• Consent (Art. 6(1)(a)): We only send marketing emails and set non-essential cookies if you've explicitly opted in. You can withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): We may process data when required by applicable law.

5. Data Sharing & Sub-processors

We do not sell, rent, or trade your personal data. We share it only with the following sub-processors to operate our service:

We may disclose data if required by law, court order, or to protect the safety of users or the public.

6. International Data Transfers

Flowki Labs is operated from the United States. If you are located in the EEA, UK, Switzerland, or another region with data transfer restrictions, your data will be transferred to and processed in the United States.

We rely on the following transfer mechanisms:

• Standard Contractual Clauses (SCCs): Where required, we use EU Standard Contractual Clauses with our sub-processors.
• Adequacy decisions: Where the EU Commission has issued an adequacy decision for a recipient country.

By using Flowki Labs, you acknowledge that your data may be transferred to the US. You may withdraw consent at any time by deleting your account.

7. Data Retention

When you delete your account, all data listed above is permanently deleted within 30 days, except for consent records retained for legal compliance and anonymized aggregate analytics that cannot be tied back to you.

8. Your GDPR Rights (EEA / UK Users)

If you are in the EEA, UK, or Switzerland, you have the following rights:

• Access (Art. 15): Request a copy of your personal data. Use the Download My Data button in Settings.
• Rectification (Art. 16): Correct inaccurate data. Update your name in Settings.
• Erasure / Right to be Forgotten (Art. 17): Delete your account and all data. Use the Delete Account button in Settings.
• Portability (Art. 20): Export your data in machine-readable JSON format via Settings → Download My Data.
• Object (Art. 21): Object to processing based on legitimate interest. Contact us to opt out.
• Restrict processing (Art. 18): Request we limit how we use your data. Contact us.
• Withdraw consent: Where processing is based on consent (marketing emails, cookies), you can withdraw at any time without affecting past processing.
• Lodge a complaint: You have the right to lodge a complaint with your local data protection authority (e.g., the UK ICO or the relevant EU DPA).

9. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) give you specific rights.

Categories of Personal Information We Collect

Do We Sell or Share Personal Information?

No. Flowki Labs does not sell personal information. We do not share personal information with third parties for cross-context behavioral advertising.

However, if you would like to formally opt out of any future sale or sharing of your personal information, use the link below:

Do Not Sell or Share My Personal Information →

Your California Rights

• Right to Know: Request disclosure of what personal information we've collected, the sources, purposes, and who we share it with. You may request this up to twice per 12-month period.
• Right to Delete: Request deletion of your personal information (subject to limited exceptions). Use Settings → Delete Account.
• Right to Correct: Request correction of inaccurate personal information. Update in Settings.
• Right to Opt-Out: Opt out of the sale/sharing of personal information (see above — we don't sell).
• Right to Limit Use of Sensitive PI: We don't collect sensitive personal information as defined by CPRA.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise California rights, email privacy@flowkilabs.com or use the self-service options in Settings. We respond within 45 days (extendable to 90 days with notice).

10. Cookies & Tracking

Essential Cookies

We set one essential cookie: your authentication token stored in localStorage under the key lc_token. This is required to keep you logged in. It cannot be disabled without breaking the service.

Analytics

With your consent, we use Polsia Analytics (a first-party, privacy-focused analytics tool) to count page visits and track feature usage. This sets a polsia_vid identifier in localStorage. No data is shared with third-party advertising networks.

Managing Cookies

When you first visit, a cookie consent banner gives you the choice to accept or reject non-essential analytics. You can change your preference at any time in Settings → Privacy Preferences.

You can also clear cookies and localStorage through your browser settings. Note that clearing lc_token will log you out.

11. Security

• Passwords are hashed using scrypt with a unique salt per user — never stored in plain text.
• OAuth tokens are encrypted at rest using AES-256-GCM before database storage.
• All data is transmitted over HTTPS/TLS.
• Database access is restricted to the application server via private network.
• JWT tokens expire after 30 days and are invalidated on logout.

Despite these measures, no system is 100% secure. If you discover a security vulnerability, please email security@flowkilabs.com.

12. Children's Privacy

Flowki Labs is not directed to children under 16 (or 13 in the US). We do not knowingly collect personal information from children. If you believe a child has provided us personal information, please contact us and we will delete it promptly.

13. Policy Changes

We may update this policy from time to time. Material changes will be communicated via email (if you have an account) or a notice on our website at least 14 days before taking effect. The "last updated" date at the top of this page reflects the most recent version.

Continued use of Flowki Labs after the effective date constitutes acceptance of the updated policy.

14. Contact Us