Privacy Policy

1. Data we collect

• Account data: name, email, password hash (never the password itself), Google profile basics if you sign in with Google, time zone, and session records (IP address, device/browser) for security.
• Content you create: drafts, platform versions, hashtags, links, brand-voice settings and sample posts you provide, media you upload.
• Documents you upload: the file (for example a certificate or letter), its extracted text and the facts you review and confirm.
• Connected social accounts: account ID, name, username, profile picture, granted permissions, and encrypted access/refresh tokens. From the platforms we read only what your granted permissions allow: profile basics, the IDs and links of posts we publish for you, and post metrics where available.
• Usage and logs: feature usage counts (for plan limits), publishing outcomes, audit logs of sensitive actions, and technical logs. Logs exclude tokens, passwords and document text.

2. How we use it

• To provide the service: authenticate you, generate and edit drafts, extract facts from documents, publish and schedule posts, show analytics and notifications.
• To keep it secure and reliable: prevent abuse, enforce limits, debug failures, and keep audit trails.
• To communicate with you about your account (verification, password resets, important changes).

We do not sell personal data, use it for advertising, or use your content or documents to train AI models.

3. AI processing

AI features run only when you use them. The text you submit (ideas, drafts, sample posts) is sent to Groq and/or Google Gemini. Documents you upload, after you consent, are processed by Google Gemini only, and are never re-routed to another provider. These providers process the data under their own API terms to return results to us.

4. Social platform data

Data received from LinkedIn, Instagram (Meta) and X APIs is used only to provide features you request: publishing, showing connection status, and showing post performance. It is not shared with other users outside your workspace, not sold, and not used to build profiles. Tokens are encrypted at rest (AES-256-GCM) and never sent to your browser. You can disconnect at any time; disconnecting deletes the stored tokens immediately.

5. Processors and sharing

We share data only with service providers who process it on our behalf to run FLOWT:

• Hosting, database, queue and file storage providers used by the operator of this instance;
• AI providers: Groq and Google (Gemini API);
• Email delivery: Resend (if enabled);
• The social platforms you choose to publish to (LinkedIn, Meta/Instagram, X), which receive the content you publish.

We may disclose data if required by law or to protect rights and safety.

6. Retention

• Uploaded document files are deleted automatically after your workspace's retention period (30 days by default, adjustable in Settings). Facts you confirmed are kept until you delete the document.
• Content, media and publishing history are kept until you delete them or your account.
• Social tokens are kept while an account is connected and deleted on disconnect.
• Security and audit logs are kept for as long as needed for security and legal obligations.

7. Your rights and choices

• Access and export: download your workspace data as JSON in Settings.
• Deletion: delete documents, media and posts individually, or delete your whole account in Settings → Account & security.
• Disconnect social accounts on the Accounts page or in each platform's app settings.
• Depending on where you live (for example under the GDPR or similar laws) you may also have rights to rectification, restriction, objection and to complain to a supervisory authority. Contact us at support@flowt.layerflow.dev.

To request deletion of data received from Instagram, see Data deletion instructions.

8. Cookies

We use only essential cookies: your sign-in session and your selected workspace. We do not use advertising or third-party tracking cookies.

9. Security

Encryption in transit (HTTPS) and of social tokens at rest, private file storage with short-lived signed links, workspace isolation, role-based access, rate limiting and audit logs. No system is perfectly secure; we will notify you of breaches as required by law.

10. Children

FLOWT is not intended for children under 16, and we do not knowingly collect their data.

11. Changes and contact

We will post updates here and notify you of material changes. Contact: support@flowt.layerflow.dev.