Flow Privacy Policy

Version: 2026-10-09 · Effective date: October 9, 2026 · Last updated: October 9, 2026

1. Introduction

This Privacy Policy explains how Flow Labs LLC (“Flow,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you use our websites at theflowtool.com and tryflow.theflowtool.com, our web application at app.theflowtool.com, and related services (collectively, the “Services”).

Accounts are created by signing up for a paid plan, or by invitation from an administrator of an organization already using Flow. If you requested access through our waitlist, we hold your email address until we invite you or you ask us to remove it.

By using the Services, you acknowledge that your personal information will be handled as described in this Policy. If you do not agree with this Policy, please do not use the Services.

Who is responsible for your data. For personal information we collect from visitors to our website, from people who join our waitlist, and from individuals who create Flow accounts, Flow Labs LLC is the “data controller” (or equivalent term under applicable law).

A note for business customers. If you use Flow through an account provided by your employer, an agency, or another organization, that organization controls the content and data processed in its workspace. We process that data on the organization’s behalf as a “data processor” or “service provider” under our Data Processing Agreement. In that case, the organization’s own privacy policy governs, and requests about that data should be directed to the organization. Section 12 explains this in more detail.

2. Information We Collect

2.1 Information you provide to us

Account information. Name, email address, password, username, profile photo, and preferences you set. Sign-up and login are handled by our authentication provider, Supabase. Your password is stored only in hashed form; we never store it in readable form.
Waitlist information. If you request access through our website, we collect your email address and any other details you choose to submit.
User Content. Files, documents, projects, tasks, deliverables, messages, comments, form responses, invoices, and any other content you or your organization create, upload, or store in Flow (“User Content”). User Content may include personal information, depending on what you choose to put in it.
Communications. Information you provide when you contact support, respond to surveys, or communicate with us, including the contents of those messages.

Payment and billing information. Our payment processor, Stripe, Inc., collects your payment card details, billing address, and transaction information when you subscribe. We never store full payment card numbers on our systems. We receive only limited information such as card type, last four digits, expiration date, billing address, and the status of your subscription and invoices.

Note that Flow contains an invoicing feature that organizations use to bill *their own* clients. Any payment card details, billing addresses, or financial figures entered there are User Content belonging to that organization — we process them on the organization’s behalf as described in Section 12 and do not use them for our own purposes.

2.2 Information we collect automatically

Usage data. Pages viewed, features used, buttons clicked, actions taken, time spent, and referring pages. We use PostHog and Google Analytics, provided by Google LLC, to collect and analyze this data so we can understand website and feature usage, measure marketing performance, and improve the Services.
Device and connection data. IP address, browser type and version, operating system, device identifiers, screen resolution, language settings, and approximate location (city/region) derived from IP address.
Cookies and similar technologies. We use cookies, local storage, pixels, and similar technologies for authentication, security, preferences, analytics, and advertising. See our Cookie Policy and Section 6 below.
Log data. Server logs including access times, error reports, and diagnostic data.

How we limit what analytics can see. Because Flow workspaces contain our customers’ confidential business information, we have configured our analytics deliberately:

We do not use session replay. Flow does not record video or reconstructions of your screen, and session recording is disabled at the code level.
We strip the visible text of the elements you interact with before events are sent, so a client name, project title, message, or dollar figure on screen cannot travel to our analytics provider. We keep the element type and selector, so we can still see *that* a button was clicked, not *what it said*.
We apply our provider’s personal-data masking to automatically captured events.
We route analytics through our own domain (p.theflowtool.com) so that requests are not blocked by tracking blockers. This is a technical relay to our analytics provider; it does not change what data is collected or who receives it.

2.3 Information from third parties

Your organization. If your account was created by your employer, an agency, or another organization, we receive information about you (such as your name and email address) from that organization.

2.4 Sensitive information

We do not intentionally collect sensitive personal information (such as government identifiers, financial account numbers, health information, precise geolocation, or biometric data), and we do not ask for it.

Flow’s document, file-upload, and form-builder features will technically accept whatever you put into them. Please do not store sensitive personal information in Flow unless it is genuinely necessary for your work. In particular, do not use Flow to store government identification numbers, health records, or full payment card numbers. Where you do include sensitive information in User Content, we process it only to provide the Services and only on your organization’s instructions.

2.5 If you choose not to provide information

Some information is required to use the Services — without an email address and password we cannot create your account. Other information (such as a profile photo) is optional, and declining to provide it will not affect your use of the Services.

3. How We Use Personal Information

We use personal information to:

Provide the Services — create and manage accounts, authenticate users, store and display User Content, and provide customer support.
Improve and develop the Services — analyze usage to understand how features are used, debug and fix issues, and develop new features.
Communicate with you — send transactional messages (security alerts, service announcements, notifications you have enabled) and, with your consent where required, product updates and marketing communications. You can opt out of non-essential email at any time in Settings → Notifications.
Advertise and market Flow — use website activity, device and online identifiers, and contact information to measure advertising, create advertising audiences, and show tailored advertisements for Flow. We do not use User Content for advertising.
Protect the Services and our users — detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms & Conditions.
Comply with legal obligations — including tax, accounting, and regulatory requirements, and to respond to lawful requests from public authorities.

We do not use your User Content to train artificial-intelligence or machine-learning models. Flow does not currently offer AI features. If we introduce them, we will update this Policy and give you notice and a meaningful choice before your User Content is used in any new way.

Legal bases. Where applicable law requires a legal basis for processing (for example, Brazil’s LGPD or other laws modeled on the GDPR), we rely on the following:

Purpose

Legal basis

Providing the Services, account management

Performance of a contract

Service improvement, analytics, fraud prevention

Legitimate interests

Product-update and marketing communications; non-essential cookies

Consent

Tax, accounting, legal compliance

Legal obligation

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may object to processing based on legitimate interests (see Section 9).

4. Automated Decision-Making

We do not use your personal information to make automated decisions that produce legal or similarly significant effects about you (such as decisions about lending, housing, employment, or insurance).

5. How We Share Personal Information

We do not sell personal information. We share personal information only as described below:

Service providers (subprocessors). Companies that help us operate the Services:

Subprocessor

Purpose

Location

Vercel Inc.

Application hosting and serverless functions

United States

Supabase, Inc.

Database, authentication, and session management

United States

PostHog, Inc.

Product analytics (US Cloud)

United States

Google LLC

Business email (Google Workspace); website analytics and advertising measurement (Google Analytics)

United States

Stripe, Inc.

Payment processing — not yet active; will process payments once paid plans launch

United States

Cloudflare, Inc.

File storage and delivery; hosting for tryflow.theflowtool.com

United States

They may access personal information only to perform services for us and are bound by contractual confidentiality and data-protection obligations. A current list of subprocessors is maintained at theflowtool.com/subprocessors, and we will provide notice before adding a new one.

Advertising and measurement partners. We use advertising and measurement partners to measure campaigns, create advertising audiences, and show tailored ads for Flow. This includes the Meta Pixel, provided by Meta Platforms, Inc., which operates on theflowtool.com, on the sign-in and sign-up pages of app.theflowtool.com, and on tryflow.theflowtool.com. It never runs inside a real Flow workspace, so it never receives User Content. The Meta Pixel may collect or receive information about your visits and interactions, including online identifiers, device information, IP address, and website activity. We use this information to measure the effectiveness of our marketing, create and match advertising audiences, and deliver or optimize Flow advertisements on Meta’s platforms and elsewhere. We also use Google Analytics, provided by Google LLC, for website analytics and marketing measurement. Where required by law, we obtain consent before enabling the Meta Pixel, Google Analytics advertising features, or other advertising technologies. You may manage advertising cookies through Cookie Settings, and we honor applicable opt-out preference signals as described in Section 6. We may disclose this information to Meta, Google, and other advertising partners for cross-context behavioral advertising. We do not sell personal information or use User Content for advertising.
Your organization. If you use Flow under an organizational account, your organization’s administrators can access your account information and the User Content in that workspace.
Other users. Content you share or collaborate on within Flow is visible to the people you share it with, according to the permissions your organization sets.
Legal and safety. We may disclose information if required by law, subpoena, or legal process, or where we believe disclosure is necessary to protect the rights, property, or safety of Flow, our users, or the public.
Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy’s commitments.
With your direction or consent. For example, if you connect a third-party integration to your Flow account in the future.

6. Cookies, Analytics, and Your Choices

We use essential cookies (required for login, security, and core functionality) and, with your consent where required, non-essential cookies for analytics and advertising. Advertising and retargeting cookies help us measure campaigns, create advertising audiences, and show tailored ads for Flow. You can manage these choices as described below.

Product analytics (PostHog). We use PostHog to measure feature usage — events such as pages viewed, buttons clicked, and features activated, along with device information and IP-derived approximate location. PostHog sets a cookie and local-storage entry to recognize returning users. As described in Section 2.2, we strip the visible text of interacted elements and apply personal-data masking, and we do not use session replay. Analytics do not run until you have accepted analytics cookies.

Your choices:

Cookie preferences. You can accept or decline analytics and advertising cookies via the banner presented on your first visit, and change your choice at any time via the Cookie Settings link in our website footer or in Settings → Legal & Privacy inside the application. Your choice applies across theflowtool.com, app.theflowtool.com, and tryflow.theflowtool.com.
Global Privacy Control (GPC). We honor a GPC browser signal as a request to opt out of the sharing of personal information for cross-context behavioral advertising and as a decline of non-essential cookies.
Browser controls. Most browsers let you block or delete cookies; blocking essential cookies will prevent you from logging in.

7. Data Retention

We retain personal information for as long as your account is active or as needed to provide the Services, and afterwards as necessary to comply with legal obligations, resolve disputes, and enforce agreements.

8. Data Security

We use administrative, technical, and physical safeguards designed to protect personal information, including:

Encryption in transit (TLS) and at rest.
Row-level security in our database, so that each organization’s data is isolated and cannot be read by another organization.
Private file storage — uploaded files are held in a private storage bucket and served only through an authenticated request tied to your session; stored files are not publicly addressable.
Access controls and logging on administrative access.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affecting your personal information occurs, we will notify you and regulators as required by applicable law.

Keep your own copies. No software is immune from defects or data loss. As described in our Terms & Conditions, you should maintain independent backup copies of anything you cannot afford to lose.

9. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights regarding your personal information:

Access / know — obtain confirmation that we process your information and receive a copy of it.
Correction — have inaccurate information corrected.
Deletion — have your information deleted, subject to legal exceptions.
Portability — receive your information in a portable, machine-readable format.
Restrict or object — to certain processing, including direct marketing, where applicable law provides this right.
Withdraw consent — at any time, where processing is based on consent, without affecting prior processing.
Non-discrimination — we will not deny you services, charge different prices, or provide a different level of service because you exercised your privacy rights.

How to exercise your rights. Email us at support@theflowtool.com or use the in-app Settings → Legal & Privacy controls, which allow you to download a copy of your data and delete your account directly. We may need to verify your identity before fulfilling a request (typically by confirming control of the email address on the account). We will respond within the timeframe required by applicable law (generally 30–45 days, extendable where permitted).

Authorized agents. Where permitted by law, you may designate an authorized agent to make requests on your behalf; we may require proof of authorization and verification of your identity.

Appeals. If we decline your request, you may appeal by replying to our decision or emailing support@theflowtool.com with the subject “Privacy Appeal.” If your appeal is unsuccessful, you may contact your state attorney general or other applicable regulator.

If your account belongs to an organization, we may redirect your request to that organization, since it is the controller of workspace data.

10. Region-Specific Disclosures

10.1 California (CCPA/CPRA)

In the preceding 12 months, we have collected the following categories of personal information (as defined in Cal. Civ. Code § 1798.140): identifiers (name, email, username, IP address); internet or network activity (usage data, device data); geolocation data (approximate, from IP address); audio/visual information (profile photos and content you upload); professional information (job title, company, and role within a workspace); and inferences (feature preferences). Sources, purposes, and recipients are as described in Sections 2, 3, and 5.

We have not collected payment or financial-account information about our own users in the preceding 12 months, because we do not currently charge for the Services. When paid plans launch, customer records (billing information) and commercial information (transaction history) will be added to the categories above.

We do not sell personal information. We may share identifiers, internet or network activity, device information, and approximate geolocation with advertising partners for cross-context behavioral advertising, as the CCPA defines that term. California residents may opt out of this sharing through Cookie Settings or by enabling a Global Privacy Control signal. We do not use or disclose sensitive personal information for purposes other than those permitted by § 7027(m) of the CCPA regulations.

California residents may exercise the rights in Section 9, including through an authorized agent, and will not be discriminated against for doing so. We honor Global Privacy Control signals.

10.2 EEA, United Kingdom, and Switzerland

The Services are not offered to, or directed at, individuals located in the European Economic Area, the United Kingdom, or Switzerland, and we do not knowingly process the personal data of individuals located there. Our Terms & Conditions make this an eligibility requirement. If you are located in one of these regions, please do not create an account. Should we make the Services available in these regions in the future, we will update this Policy with the disclosures required by the GDPR and UK GDPR (including legal bases, transfer safeguards, and representative details) before doing so.

10.3 Other US states

Residents of Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states with comprehensive privacy laws have the rights described in Section 9 to the extent provided by their state’s law, including the right to appeal a refused request.

10.4 Other regions

If you access the Services from other jurisdictions (e.g., Canada (PIPEDA), Brazil (LGPD), Australia (Privacy Act)), we handle your personal information as described in this Policy and honor rights available to you under applicable local law. Contact us at support@theflowtool.com to exercise them.

11. International Data Transfers

We are based in the United States, and your personal information is processed and stored in the United States by the service providers listed in Section 5. If you access the Services from outside the United States, you understand that your information will be transferred to and processed in the United States, which may have data-protection laws different from those in your country.

Where applicable law requires safeguards for such transfers, we rely on appropriate measures, including standard contractual clauses and equivalent contractual data-protection commitments with our service providers. You may request more information about these safeguards by contacting us.

12. Flow as a Processor (Business Customers)

Flow is built for agencies and teams who use it to manage work for their own clients. When an organization signs up for Flow and its users store User Content in the organization’s workspace, the organization is the controller of that data and we act as its processor.

In that role we: process User Content only per the organization’s instructions and our Data Processing Agreement; maintain a list of subprocessors at theflowtool.com/subprocessors and provide notice of changes; assist the organization with data subject requests and security obligations; and delete or return User Content at the end of the engagement, per the DPA.

If you are a client invited into an agency’s Flow workspace, the agency — not Flow — decides what information about you is stored, who can see it, and how long it is kept. To exercise privacy rights over that data, contact the agency directly. We will assist them in responding to you.

13. Children’s Privacy

The Services are intended for business use and are not directed to children. You must be at least 18 years old to create a Flow account, as required by our Terms & Conditions. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, contact us at support@theflowtool.com and we will delete it.

14. Third-Party Links and Integrations

The Services may link to third-party websites. Flow does not currently offer third-party integrations; if we add them, connecting one will be your choice and that third party’s privacy policy — not this one — will govern its handling of your data. Review those policies before connecting anything.

15. Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a revised “Last updated” date and version number. For material changes, we will provide reasonable advance notice — by email and by an in-app notice — before the changes take effect, and where the change expands how we use your data we will ask you to accept the updated Policy. Prior versions are archived at stable URLs and are also available on request at support@theflowtool.com.

16. Contact Us

Flow Labs LLC

13620 Weinstein Court

Centreville, VA 20120

United States

Email: support@theflowtool.com