Privacy Policy

We collect the following categories of information:

• Account data — name, email, and company name you provide at signup
• Form responses — the answers your respondents submit through forms you build, encrypted at rest (AES-256-GCM)
• Usage data — basic technical logs (IP address, browser, timestamps) needed to operate and secure the Service
• WhatsApp data — message content and metadata, only if you connect the WhatsApp integration

We use your information to:

• Operate, maintain, and improve the Service
• Authenticate your account and enforce access permissions
• Send transactional emails (e.g. password resets) — never marketing email without your consent
• Detect and prevent abuse, fraud, or security incidents

We do not sell your data, or the data your respondents submit through your forms, to third parties.

If you use the Form Builder's AI Assistant or the AI Workflow Builder, the text of your prompts (and, for context, your form's current field list or workflow configuration) is sent to our third-party AI provider — currently Google Gemini — to generate a response. Respondent data submitted through your published forms is never sent to the AI provider, and neither is the content of any Google Sheet you've connected (see Section 4) — the AI only ever sees that a Google Sheets step exists in a workflow, never the actual spreadsheet data it reads or writes.

If you connect a Google account to Flowora (to add a Google Sheets step to a workflow), Flowora requests access only to specific Google Sheets files you explicitly select through Google's own file-picker widget, via the narrow drive.file OAuth scope — not blanket access to your Google Drive.

How we use it. Google user data is used only to provide the functionality you requested: reading a selected spreadsheet's column headers and values so you can map them in a workflow, and writing rows to that same spreadsheet when a workflow you built runs. We do not use Google user data for advertising, and we do not sell it.

Sharing and disclosure. Flowora does not sell Google user data and does not share it with advertisers, data brokers, or other third parties for their own marketing purposes. Google user data may pass through infrastructure service providers (see Section 6) strictly as needed to operate the Service on your behalf — for example, our database host storing an encrypted connection token, or our AI provider if and only if you explicitly use an AI feature in a way that references a Google Sheets step (never the sheet's actual contents, per Section 3). These providers are contractually limited to processing data for the services they provide to Flowora.

Limited Use disclosure. Flowora's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data obtained through Google Workspace APIs is never used to train or improve generalized or foundation AI/ML models — it is used only to provide the specific, user-requested functionality described above.

Your control. You authorize this access through Google's own OAuth consent screen, and you can revoke Flowora's access at any time from your Google Account's Security > Third-party access settings, or by removing the connection inside Flowora.

Data is stored on MongoDB Atlas with encryption in transit (TLS) and, for form response answers and connected third-party credentials (e.g. a Google refresh token) specifically, encryption at rest. Access to your account's data is scoped per-tenant — no other customer's account can read or write your data.

We rely on the following third parties to operate the Service:

• MongoDB Atlas — database hosting
• Railway — application hosting
• Google Gemini — AI Assistant / AI Workflow Builder, only when you use those features
• Google Sheets / Drive API — only if you connect the Google Sheets integration, scoped to files you explicitly select
• Slack — only if you connect the Slack integration
• Meta (WhatsApp Business API) — only if you connect the WhatsApp integration

We retain your account data, form responses, and connected-integration credentials for as long as your account (or that specific connection) is active. You can delete individual forms, responses, or connections at any time from within the product. If you close your account, we delete your data within a reasonable period, except where we're required to retain it by law.

Depending on where you're located, you may have the right to access, correct, export, or delete your personal data. Contact us at the email below to exercise these rights.

We may update this Privacy Policy from time to time. If we make material changes, we'll notify you before they take effect.

Questions about this policy or your data? Reach us at floworaone@gmail.com.