Privacy Policy

1. Who this policy is for

The Service is built for businesses, agencies, and developers (“Customers”). The Service is not directed to consumers and is not intended for anyone under 18. Where you use FlowCP on behalf of an organization, this policy applies to your individual personal information; how your organization handles its own end users’ data through FlowCP is addressed in Section 2.

2. Our role: controller and processor

FlowCP plays two different data-protection roles, and your rights differ accordingly:

• Controller — account and platform data. For information about you as an account holder and workspace member (your email, login, workspace, billing, support interactions, and usage of our dashboard), FlowCP is the controller / business and decides how that information is used.
• Processor / service provider — your end users’ data. When you connect an app and publish an MCP server, end users authenticate in their own authorization context and their requests flow through FlowCP to your API. With respect to your end users’ personal information processed through the hosted runtime, FlowCP acts on your behalf under your instructions. You are the controller / business for that data, and our processing of it is governed by our Data Processing Addendum (see Section 12), not by the rest of this policy.

3. Information we collect

Account and workspace information. Email address, password hash, display name, workspace name and slug, role, and legal-consent timestamps when you create or manage an account.

App and server configuration. Workspace-scoped app configuration, source connection details (Generic OpenAPI URL, Bubble app, or Git repository), imported OpenAPI documents, generated MCP tool/skill/prompt/widget/resource metadata, verification state, and publish state.

Authorization configuration. If you configure OAuth, we store your provider configuration (client ID, encrypted client secret, authorize and token URLs, scopes, redirect URI) and end-user connection metadata. We do not store end-user access or refresh tokens — see Section 8.

Shared-credential secrets. If you publish a server using a shared-credential auth mode instead of per-user OAuth (api_key or bearer), we store the key or token you provide, encrypted at rest. The none mode stores no credential. These modes run without per-user authorization context and are an explicit, opt-in choice for APIs that don’t support per-user OAuth.

Billing information. When you subscribe to a paid plan, payments are processed by Stripe. We do not collect or store full payment card numbers; Stripe handles card data under its own terms. We store billing metadata such as your plan, subscription status, billing period, Stripe customer identifier, and usage counts used for metering and overage.

AI chat and prompt content. If you enable the embeddable AI chat widget or use the Playground, message content and prompts are sent to a third-party large-language-model provider (OpenRouter) to generate responses. See Section 10.

Support and feedback. Information you submit through support requests or the in-product feedback tool (including an optional rating and category).

Usage and device information. Operational and technical metadata generated when you use the dashboard and API — for example, log and event data, approximate location derived from IP, and browser/device information. We use strictly-necessary, first-party cookies for authentication and session management; for product analytics we use Plausible, which is cookieless and does not collect personal data (see Section 6).

Tool execution / audit logs. When a tool runs on a hosted server, we record sanitized execution metadata (server, tool name, latency, status code, error code, MCP client information, and an LLM-model hint when available). These logs identify an end user only by a truncated SHA-256 connection hash — never by a raw token, request body, response body, or other personally identifiable information. See Section 13.

4. How we use information

We use information to: provide and operate the Service (import specs, generate tools, host runtime endpoints, enforce workspace isolation, process OAuth authorization, meter usage, and process payments); secure the Service and prevent abuse; debug, maintain, and improve reliability; provide support; and communicate with you about service changes, security matters, and your account.

5. Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on the following bases:

• Performance of a contract — to provide the Service you sign up for and process billing.
• Legitimate interests — to secure the Service, prevent abuse, debug, and improve reliability, balanced against your rights.
• Legal obligation — to comply with applicable law (e.g., tax and accounting).
• Consent — where required, for example certain cookies or marketing communications; you may withdraw consent at any time.

6. Cookies and tracking

We use a minimal set of strictly-necessary, first-party cookies for authentication and to keep you signed in. These are required for the dashboard to function.

For product analytics we use Plausible Analytics, a privacy-focused, cookieless analytics service hosted in the European Union. Plausible does not use cookies or persistent identifiers, does not collect personal data or store IP addresses, and does not track visitors across sites or devices — it measures aggregate site usage only. We do not use cookies or similar technologies for advertising, profiling, or cross-context behavioral tracking.

7. How we share information and our subprocessors

We do not sell personal information. We share information only with service providers (“subprocessors”) that help us operate the Service, and only for that purpose. Our subprocessors are contractually required to protect personal information and use it solely to provide their services to us.

Current subprocessors:

We keep a current list at flowcp.ai/subprocessors and will provide reasonable advance notice of material changes to Customers who have a Data Processing Addendum with us.

We may also disclose information if required by law, to protect rights and safety, to investigate abuse, or in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections.

8. End-user OAuth tokens and secrets

OAuth client secrets and workspace secrets are encrypted at rest using AES-256-GCM. End-user access tokens and refresh tokens for your connected APIs are never stored by FlowCP — the MCP client (such as Claude or Cursor) holds them and presents them on each tool call. If a token expires, FlowCP propagates the resulting 401 back to the MCP client so it can re-authorize. Servers using a shared-credential auth mode (Section 3) deliberately forgo this per-user context and instead use the encrypted credential you configured.

One exception: if you connect an optional Git integration, that integration’s own refresh token is stored encrypted at rest using AES-256-GCM so we can keep the connection active on your behalf.

We redact sensitive headers, request bodies, and secret values from application logs. We do not intentionally log raw authorization credentials.

9. Security

We use technical and organizational safeguards intended to protect information, including AES-256-GCM encryption of secrets at rest, signed and HTTP-only session cookies, OAuth CSRF protection, fail-closed authorization behavior, and workspace-scoped data access. No system can be guaranteed completely secure. If we become aware of a personal-data breach affecting your information, we will notify affected parties without undue delay and as required by applicable law.

10. AI features and third-party model providers

The embeddable AI chat widget and the Playground use a third-party large-language-model provider (OpenRouter) to generate responses. When these features are used, message content and prompts are transmitted to that provider for inference. End users interacting with the chat widget are interacting with an automated AI system. Do not submit information through these features that you are not authorized to disclose to a third-party model provider.

11. International data transfers

We and our subprocessors may process information in countries other than your own. Where we transfer personal information out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum), or another lawful transfer mechanism.

12. Data Processing Addendum (Customers)

Where FlowCP processes your end users’ personal information on your behalf (Section 2), that processing is governed by our Data Processing Addendum (DPA), which forms part of our agreement with you and addresses processing instructions, confidentiality, security, subprocessing, data-subject requests, and international transfers. Our DPA is available to Customers on request — contact us at the email address in Section 18.

13. Retention and deletion

We retain account, workspace, app, import, and tool information while your workspace is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements.

Tool execution and audit logs are retained for 30 days and then deleted. These logs identify an end user only by a truncated SHA-256 connection hash — never by a raw token or identity — and never include access tokens, request or response bodies, or personally identifiable information beyond that hash.

You can request deletion of account or workspace data by contacting us; we will honor verified requests subject to our legal obligations.

14. Your privacy rights — EEA/UK

Subject to applicable law, you may have the right to access, correct, delete, restrict, or object to processing of your personal information; to data portability; and to withdraw consent. You also have the right to lodge a complaint with your supervisory authority. To exercise these rights, contact us using the details in Section 18.

15. Your privacy rights — California (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use and disclose it; to request deletion or correction; and to opt out of the “sale” or “sharing” of personal information. We do not sell or share personal information as those terms are defined under the CCPA/CPRA: we use no cross-context behavioral advertising and our analytics provider (Plausible) does not profile, advertise, or monetize data. We do not discriminate against you for exercising your rights. To exercise these rights, contact us using the details in Section 18; we will verify your request before responding.

The categories of personal information we collect are described in Section 3 (identifiers, account credentials, commercial/billing information, internet and usage activity, and approximate geolocation). We collect these from you and from your use of the Service, and disclose them to the subprocessors listed in Section 7 for the business purposes in Section 4.

16. Your privacy rights — other US states

Residents of other US states with comprehensive privacy laws may have similar rights to access, correct, delete, and obtain a copy of their personal information, and to opt out of targeted advertising, the sale of personal information, and certain profiling. Contact us as described in Section 18 to exercise these rights.

17. Children

The Service is not directed to children and is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

18. Changes to this policy and how to contact us

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date and provide notice through the Service or other reasonable means.

Questions, requests, or complaints about this policy can be sent to hello@flowcp.ai.