Privacy Policy

We collect the following categories of information:

• Account data — name, email, and company name you provide at signup
• Form responses — the answers your respondents submit through forms you build, encrypted at rest (AES-256-GCM)
• Usage data — basic technical logs (IP address, browser, timestamps) needed to operate and secure the Service
• WhatsApp data — message content and metadata, only if you connect the WhatsApp integration

We use your information to:

• Operate, maintain, and improve the Service
• Authenticate your account and enforce access permissions
• Send transactional emails (e.g. password resets) — never marketing email without your consent
• Detect and prevent abuse, fraud, or security incidents

We do not sell your data, or the data your respondents submit through your forms, to third parties.

If you use the Form Builder's AI Assistant or the AI Workflow Builder, the text of your prompts (and, for context, your form's current field list or workflow configuration) is sent to our third-party AI provider — currently Google Gemini — to generate a response. Respondent data submitted through your published forms is never sent to the AI provider, and neither is the content of any Google Sheet you've connected (see Section 4) — the AI only ever sees that a Google Sheets step exists in a workflow, never the actual spreadsheet data it reads or writes.

If you connect a Google account to Flowora, the access requested depends on the feature you are using, and is always the narrowest scope that feature needs:

• Google Sheets steps in a workflow — the drive.file scope, which only grants access to the specific spreadsheet files you pick through Google's own file-picker widget. Not blanket Drive access.
• Export a form to Google Forms — the forms.body scope, used solely to create one new Google Form in your account and add the questions from the Flowora form you chose to export. Flowora never lists, reads, or modifies any other Google Form in your account.

How we use it. Google user data is used only to provide the functionality you requested: reading a selected spreadsheet's column headers and values so you can map them in a workflow, writing rows to that spreadsheet when a workflow you built runs, and — when you click “Export to Google Forms” — creating a single new Google Form from your Flowora form. We do not use Google user data for advertising, and we do not sell it.

Sharing and disclosure. Flowora does not sell Google user data and does not share it with advertisers, data brokers, or other third parties for their own marketing purposes. Google user data may pass through infrastructure service providers (see Section 6) strictly as needed to operate the Service on your behalf — for example, our database host storing an encrypted connection token, or our AI provider if and only if you explicitly use an AI feature in a way that references a Google Sheets step (never the sheet's actual contents, per Section 3). The form content you export to Google Forms is data you already created in Flowora; it is sent to Google's Forms API only to build the form you asked for. These providers are contractually limited to processing data for the services they provide to Flowora.

Limited Use disclosure. Flowora's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data obtained through Google Workspace APIs is never used to train or improve generalized or foundation AI/ML models — it is used only to provide the specific, user-requested functionality described above.

Your control. You authorize this access through Google's own OAuth consent screen, and you can revoke Flowora's access at any time from your Google Account's Security > Third-party access settings, or by removing the connection inside Flowora.

Data is stored on MongoDB Atlas with encryption in transit (TLS) and, for form response answers and connected third-party credentials (e.g. a Google refresh token) specifically, encryption at rest. Access to your account's data is scoped per-tenant — no other customer's account can read or write your data.

On our public marketing and sign-up pages only — never inside the logged-in product at /app — we use a small number of third-party measurement tools:

• Google Analytics 4 — aggregate traffic and page-view statistics.
• Google Ads and OpenAI Ads — conversion measurement. If you reach Flowora from one of our ads and then complete signup, a “signup” event is sent to that ad platform so we can tell which campaigns work. The event contains no name, email, or form data — the platform matches it to your ad click using its own cookie or click identifier.

These scripts load only on our production website and set their own cookies. We do not use them to track what you do inside the product, and we never send them your form responses or any respondent data. You can opt out with browser Do-Not-Track / ad-blocking tools, via Google Ads Settings, or through your OpenAI account's ad settings — blocking them has no effect on how the product works.

We rely on the following third parties to operate the Service:

• MongoDB Atlas — database hosting
• Railway — application hosting
• Google Gemini — AI Assistant / AI Workflow Builder, only when you use those features
• Google Sheets / Drive API — only if you connect the Google Sheets integration, scoped to files you explicitly select
• Slack — only if you connect the Slack integration
• Meta (WhatsApp Business API) — only if you connect the WhatsApp integration
• Sentry — error monitoring for our web and API services (crash reports, which may include a page URL and your account identifier)
• Google Analytics, Google Ads, OpenAI Ads — traffic and ad-conversion measurement on our public marketing pages (see Section 6)

We retain your account data, form responses, and connected-integration credentials for as long as your account (or that specific connection) is active. You can delete individual forms, responses, or connections at any time from within the product. If you close your account, we delete your data within a reasonable period, except where we're required to retain it by law.

Depending on where you're located, you may have the right to access, correct, export, or delete your personal data. Contact us at the email below to exercise these rights.

We may update this Privacy Policy from time to time. If we make material changes, we'll notify you before they take effect.

Questions about this policy or your data? Reach us at info@floworaone.com.