Privacy policy

The controller of your personal data is Flows (the "Provider"). For questions about how we handle your data, email us at privacy@rnflows.com.

We process the following categories:

• Account data: name, email, password (hashed), optional profile picture, language.
• Workspace data: name, slug, plan, invited members.
• Usage data: activity logs, audit log of changes, IP addresses, browser identifiers.
• Billing data: handled by Stripe (we do not store card numbers on our servers).
• Application data: the data you upload to your modules. We treat it as Customer Data under the Terms and, where applicable, the DPA.

• Deliver the Service and keep it running.
• Process payments and issue invoices.
• Communicate with you about your account, support and changes to the Service.
• Prevent fraud, abuse and Terms violations.
• Comply with legal obligations (accounting, tax, judicial).
• Improve the product based on aggregated, anonymous metrics.

• Contract performance: to deliver the contracted Service.
• Legitimate interest: for security, fraud prevention and product improvement.
• Consent: for non-essential commercial communications and analytics cookies.
• Legal obligation: for tax records and authority requirements.

We use third parties to operate parts of the Service. Each one acts as a subprocessor under our instructions:

• AWS (application and database hosting, regions us-east-1 and eu-west-1).
• Cloudflare R2 (file storage).
• Stripe (payment processing and billing).
• Resend (transactional email).
• OpenAI (schema inference from spreadsheets and natural language).
• Sentry and PostHog (observability and anonymous usage analytics).

The updated list is published here. We will give reasonable prior notice before adding a new subprocessor.

We keep data while the account is active and for the term required to comply with our legal obligations. After termination, Customer Data is deleted after 30 days; accounting data is kept for the term required by applicable tax law.

Under applicable law (GDPR, LGPD, LFPDPPP, others), you can exercise rights of access, rectification, erasure, objection, restriction and portability. To exercise them, email us at privacy@rnflows.com stating which right you want to exercise.

We respond within 30 calendar days.

Some subprocessors process data outside your country of residence. These transfers use standard contractual clauses or equivalent mechanisms that ensure an adequate level of protection.

We apply reasonable technical and organizational measures to protect your data: encryption in transit and at rest, per-workspace isolation, role-based access control, and audit logs. More detail at /en/security.

We may update this policy to reflect changes in the Service or applicable law. Material changes are notified by email to the workspace owner or via in-product notice.