Privacy Policy
Version 2026-10-01
Highlighted passages (12) are waiting for an owner decision or legal review and are not final. Everything else describes how Flowyn works today.
1. Who we are
This policy covers flowyn.dev, the dashboard at app.flowyn.dev and the API at api.flowyn.dev. The controller of the personal data described here is Pending owner decision: legal name, registration number and registered address of the company that operates Flowyn.
Contact for privacy questions and requests: support@flowyn.dev Pending owner decision: confirm whether a dedicated, monitored privacy@flowyn.dev mailbox will be used instead.
Pending legal review: decide whether an EU or UK representative (GDPR article 27) or a data protection officer is required, and add their contact details
2. Two roles
Flowyn is a controller for data about the people who visit the website, sign up, use the dashboard, buy a plan or contact us. That is what this policy describes.
Flowyn is a processor for personal data that customers put into their workspaces (for example personal data inside a file, an event payload or a job request). The customer decides what that data is and why it is processed; the Data Processing Addendum governs it. If your data is in a Flowyn customer's workspace, contact that customer first.
3. What we collect and why
| Data | Where it comes from | Why | Legal basis (where GDPR or UK GDPR applies) |
|---|---|---|---|
| Name, email address, email verification status, Clerk user id | You, through Clerk sign-up and sign-in | Create and secure your account; show who did what in a workspace; contact you about the service | Contract |
| Workspace name, membership and role | You and your workspace owner, through Clerk organizations | Control who can access a workspace | Contract |
| Onboarding progress (chosen path, start and completion times) | Your use of the dashboard | Show the right setup steps | Legitimate interests in a working product |
| Legal acceptance record: user id, workspace, document versions, time, context, network address and browser user agent | Your acceptance of the Terms | Show which terms you agreed to and when | Legitimate interests in proving the agreement; legal obligations |
| Billing records: Dodo Payments customer, subscription and payment ids, amount, currency, billing email, plan | Dodo Payments webhooks | Grant plan entitlements, keep financial records | Contract; legal obligations |
| API request records: request id, method, path, status, duration, workspace and environment, error ids and codes | Your requests to the API and dashboard | Run, secure and debug the service; enforce limits | Legitimate interests in operating a secure service |
| Rate-limit counters derived from an API key or network address (stored only as a short hash, for at least a minute) | Your requests | Protect the service from overload and abuse | Legitimate interests in security |
| Support and feedback messages: email, message, page, environment, request or error id, app version | Forms on flowyn.dev and in the dashboard, sent through Formspree | Answer you and fix problems | Legitimate interests; contract for customers |
| Page-view analytics (only if you allow Analytics) | Vercel Web Analytics in your browser | Understand which pages are used | Consent |
| Error reports from the dashboard, with query strings, cookies and request headers removed (only if you allow Diagnostics) | Sentry in your browser | Find and fix errors in the dashboard | Consent |
| Server error reports with personal data removed | Flowyn's API and worker, and the dashboard's Next.js server and edge runtime | Find and fix errors | Legitimate interests in a working service |
We do not sell personal data, share it for cross-context behavioural advertising, or use it to build advertising profiles. We do not use your personal data or Customer Data to train machine learning models.
4. Cookies and similar technologies
Strictly necessary cookies keep you signed in. Analytics and diagnostics only run if you allow them, and you can change your choice at any time from Cookie settings. The Cookie Policy lists every cookie and storage item.
5. Who receives personal data
We use service providers (subprocessors) that process personal data for us under contract. The current list, with what each one does and where, is on the Subprocessors page.
- Clerk: sign-in, sessions, organizations and memberships.
- Supabase: the database and file storage that hold account, workspace and billing records.
- Railway: hosts the Flowyn API and worker.
- Upstash: short-lived caching of your name, email and role (about one minute) and rate-limit counters.
- Vercel: hosts flowyn.dev and app.flowyn.dev; provides analytics if you allow it.
- Sentry: error reports from Flowyn's servers (the API, the worker and the dashboard's Next.js server and edge runtime), and browser error reports from the dashboard if you allow Diagnostics.
- Formspree: delivers support, contact and feedback form messages to us.
Dodo Payments acts as merchant of record for paid plans. It collects your payment details and is an independent controller for them under its own privacy policy. We send it your name, email and workspace id when you start checkout.
Destinations you configure (your servers, Slack, Discord, Linear, GitHub, an AI provider you test) receive what you tell Flowyn to send them. They are your choice, not Flowyn's subprocessors.
We may disclose personal data if required by law, to protect rights and safety, or as part of a merger or acquisition, subject to this policy.
6. International transfers
Flowyn's providers operate in several countries. The Flowyn API and worker run in Railway's Singapore region. The database region, and the regions of other providers, are listed on the Subprocessors page. Where personal data from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) in our providers' data processing agreements. Pending legal review: confirm transfer mechanism for each provider and whether a transfer risk assessment is needed
7. How long we keep data
| Data | How long |
|---|---|
| Account profile (name, email) | While your account exists. Flowyn does not yet offer self-serve account deletion; ask us and we will delete it. Clerk keeps sign-in data under its own terms until the account is deleted there. |
| Workspace content | Until the workspace is deleted. Completed files, jobs and events cannot yet be deleted one by one; ask us if you need a specific record removed. Successful and cancelled attempt history and schedule occurrences are removed after your plan's history window (Starter 3 days, Production 14 days, Capacity 30 days, or a shorter window you set). Agent telemetry expires after 30 days. Incomplete uploads expire after 24 hours. |
| Legal acceptance records | Kept after workspace deletion as evidence of the agreement. Pending owner decision: set a retention period, for example the limitation period for contract claims |
| Billing records | Kept after workspace deletion for accounting and tax. Pending owner decision: set the period required by the applicable tax law |
| Server error records | Not yet deleted automatically. Pending owner decision: set a retention period |
| Server logs | Kept by Railway under its log retention for our plan. Pending owner decision: confirm Railway log retention |
| Cached account data and rate-limit counters | About one minute for cached data; rate-limit counters expire automatically. |
| Support messages | In Formspree and the support mailbox until we delete them. Pending owner decision: set a retention period |
| Analytics | Vercel discards the visitor hash after 24 hours and keeps aggregated page views. |
| Browser diagnostics | Under Sentry's retention for our plan. Pending owner decision: confirm Sentry retention |
| Backups | Deleted data may remain in our database provider's backups until those backups expire. Pending owner decision: confirm Supabase backup and point-in-time-recovery settings and retention for the production project |
8. Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of your personal data, to receive it in a portable format, to withdraw consent at any time, and to complain to a data protection authority. California residents have rights to know, delete, correct and opt out of sale or sharing; Flowyn does not sell or share personal data.
Send requests to support@flowyn.dev Pending owner decision: confirm whether a dedicated, monitored privacy@flowyn.dev mailbox will be used instead. We will verify that the request comes from the account holder, usually by replying to the account email, and answer within the time the law requires (one month under GDPR, extendable in some cases). You can correct your name in the dashboard and change your cookie choices at any time from Cookie settings.
If you withdraw consent for analytics or diagnostics, those tools stop in your browser and their browser storage is cleared. Data already sent before the withdrawal is handled under the providers' retention.
9. Security
We protect personal data with the measures described on the Security page, including encrypted connections, hashing of API keys and encryption of stored credentials. No system is perfectly secure; if a breach affects your personal data we will notify you and the authorities as the law requires.
10. Children
Flowyn is a developer service for adults. It is not directed to children and we do not knowingly collect children's personal data.
11. Changes
We will post changes here with a new version date and, for material changes, notify account holders before they take effect.