Privacy Policy

Bot protection (Cloudflare Turnstile)

Information we collect

We collect the following categories of information:

• Account information — your name and email address, and the workspaces you belong to. Sign-in is passwordless (a one-time link by email), so we do not store passwords.
• Workspace content — the procedures, documents, recordings, transcripts, images, comments and settings you and your team create in the service.
• Usage and technical data — pages and documents viewed, feature usage, approximate location derived from IP address, browser and device type, and log data used to operate, secure and improve the service.
• Payment information — handled by our payment processor. We receive subscription status and limited billing details, but we never see or store full card numbers (see “Payments” below).
• Lead information — where a workspace turns on email capture, the name and email a visitor submits on that workspace’s public pages (see “Email capture” below).
• Referral information — if you arrive through someone’s referral link, which referral code (and campaign tag) you followed and when, so we can credit the referrer if you sign up (see “Cookies” below). Referrers see only aggregated counts of clicks and signups from their links, never who signed up; a narrowly shared campaign link can still let them infer that someone did.
• Referral partner information — if you join our Referral Program, your link, campaign tags, the counts and earnings tied to them, and when you accepted the program terms. If you are an influencer partner, the tax form and payment details we need to pay you are exchanged and kept outside the service: we record only whether a tax form is on file and when we paid you.

How we use information

• To provide, maintain and secure the service and your account.
• To transcribe recordings and generate, edit and answer questions about your documents.
• To process payments, manage subscriptions and prevent fraud and abuse.
• To communicate with you about the service, including transactional and account emails.
• To measure and improve performance, reliability and product decisions.
• To comply with legal obligations and enforce our terms.

AI processing

AI is a core part of Flowformance. When you record or upload a procedure, or use features such as drafting, editing (“Assist”) or asking questions (“Ask”), the relevant content — including audio, screenshots from your recordings, transcripts, document text and your prompts — is sent to AI providers so we can produce the result. We currently use Anthropic for language-model features and Cloudflare’s speech-to-text for transcription, and we may add or change AI providers over time (see “Service providers”).

Requests to our language-model provider pass through Cloudflare AI Gateway, which routes them. We send every request with the gateway’s payload logging turned off, so its log of each request, which we use for monitoring and troubleshooting, records details such as the model, timing and size but not the content. Log entries for requests made before payload logging was turned off may include their content; those are kept until we delete them, and they are not removed when a workspace is deleted. AI providers may retain request data for a limited period under their own terms (for example, for abuse monitoring).

We do not permit our AI providers to use your content to train their models, to the extent those providers offer that control; our use of Anthropic is through its business API, which is not used to train its models on your data by default. AI output can be inaccurate, incomplete or out of date — you are responsible for reviewing AI-generated content before relying on it, and it is not professional advice.

Email capture (lead forms)

A workspace can choose to turn on email capture on its public help portal or public videos. When enabled, a visitor is asked for their name and email before viewing the gated content. We collect and store that information on behalf of, and at the direction of, the workspace that enabled it — that workspace is responsible for the data as its controller, and we act as its processor.

• If you submitted your details to a workspace’s public page and want them accessed, corrected or deleted, please contact that workspace directly; we will assist them in responding.
• Workspaces that use email capture must have a lawful basis to collect and contact those leads and must comply with applicable privacy and anti-spam laws. This is also covered in our Terms of Service.

Payments

Subscription payments are processed by Stripe. When you subscribe, Stripe collects and processes your payment details under its own terms and privacy policy. We receive confirmation of your plan and status and limited, non-sensitive billing metadata; we do not receive or store your full card number. When a workspace is permanently deleted, we delete its Stripe customer profile and saved payment method; Stripe keeps the transaction records (such as invoices and charges) that it is legally required to retain.

Analytics and advertising

Our website may use Google Analytics to understand how it is used, and advertising services (including Google advertising products) to promote Flowformance and measure our campaigns. When enabled, these providers may set cookies or similar technologies and process usage and device data under their own policies. We may add, remove or replace analytics and advertising providers over time.

Service providers and subprocessors

We rely on trusted third parties to run Flowformance. These currently include:

• Cloudflare — hosting, storage, content delivery, video hosting and playback (Stream), AI transcription and AI request routing (AI Gateway), email delivery and bot protection (Turnstile).
• Anthropic — AI language-model processing.
• Stripe — payment processing.
• Google — web fonts (Google Fonts, loaded by our pages, which shares your IP address and browser details with Google), and website analytics and advertising where enabled.

We may engage additional or replacement service providers at any time as the service evolves. We require our providers to protect the information they process for us and to use it only to provide services to us.

Cookies and your choices

We use cookies and similar technologies that are necessary to sign you in and keep the service secure, and — as described above — for analytics and advertising. Analytics and advertising cookies load only after you accept them: we show a cookie banner and, until you choose, non-essential storage stays disabled (via Google Consent Mode). You can change your choice at any time by clearing the Flowformance cookies in your browser, and you can control cookies through your browser settings; blocking necessary cookies may prevent you from signing in.

Referral cookie. When a visitor in the United States follows a referral link by clicking or opening it, we set a first-party cookie, ff_ref, that remembers the referral code, campaign tag and time of that first click for 60 days, so the referrer can be credited if the visitor signs up. It is set only for visitors in the United States, never for automatic redirects or embedded pages, and it is cleared once you confirm your email address to sign up. To count unique clicks without storing your IP address, we keep a one-way hash of it, made with a random value that changes every day; the hash is discarded within 26 hours and is never saved with your account.

Data retention

We keep your information for as long as your account or workspace is active and as needed to provide the service, then for a reasonable period afterward to comply with legal obligations, resolve disputes and enforce our agreements. Some data is deleted on a shorter, fixed schedule:

• failed recordings are deleted after 21 days;
• documents you delete are removed from the app straight away, and erased for good, with their version history, 30 days after deletion; images they used are erased when the workspace is deleted, because an image can be shared between documents (copies in backups and in older AI Gateway request logs follow the entries below);
• operational database backups are kept for 30 days, so a copy of deleted content can remain in them for up to 30 days after it is erased;
• application logs (Workers Logs) and queued background jobs expire within 7 days;
• AI Gateway request logs record request details, not content; older entries that include their content are kept until we delete them and are not removed when a workspace is deleted;
• the working record of each recording’s processing, including its transcript and draft, is kept for up to 30 days after processing finishes;
• after a subscription ends, the workspace is kept for 60 days and then deleted, as described in our Terms of Service.

Security and backups

We use reasonable technical and organizational measures to protect your information, including encryption in transit, role-based access controls, and an access check on every request for private images, with short-lived signed playback tokens for newly uploaded private videos. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for keeping your own backups of important content — see “Your data and backups” in our Terms of Service.

Your choices and rights

Depending on where you live, you may have rights to access, correct, delete or export your personal information, or to object to or restrict certain processing. You can update your profile in the app; workspace admins can export the workspace’s documents; and documents you delete are removed from the app straight away and erased for good 30 days later. To make a request about your personal information, including erasure, email us at legal@flowformance.com. We will not discriminate against you for exercising these rights.

Children

Flowformance is a workplace tool intended for adults. It is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

International users and data location

Flowformance is operated from the United States, and our providers may process and store data in the United States and other countries. If you use the service from outside the United States, you understand that your information may be transferred to and processed in the United States, where data-protection laws may differ from those in your country.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide additional notice where required. Your continued use of the service after an update means you accept the revised policy.

Contact

Questions about this policy or your information? Email us at legal@flowformance.com. Flowformance is operated by Balanced Company, based in Texas, United States.