Privacy

Whose data this is

This page covers two groups: you, the developer or business with a Flow account, and the people who message the agents you run on Flow.

For the people who message your agent, you decide what is collected and why, and Flow processes it on your behalf to deliver, store and show it. Tell them how you use their data in your own privacy notice.

About you

• Your account: your name and email, how you signed in (Google, GitHub or an email link), your workspaces and teammates.
• Your keys: we keep a fingerprint of each API and Flow key, never the key itself, plus its last four characters to tell keys apart.
• Your agents: the code and secrets you deploy to Flow's hosting, their logs, traces and test runs.
• Usage and billing: how many people and messages each app had, your plan, and and payment records from Dodo Payments, which takes your payments.
• Support: what you write to us.

About the people who message your agent

• Who they are on the channel: phone number, Apple ID handle, Telegram user ID or username, WhatsApp number, and the name the channel gives.
• Messages: what they send and what your agent sends back, with photos, files, voice notes and reactions, and in group chats who wrote what.
• Voice note transcripts: the words of a voice note, so your agent can read it.
• Delivery: whether each message was sent, delivered or failed.
• On SMS (pilot): their consent and opt-outs.

What we do with it

We use it to run Flow for you: to deliver messages, show them in your dashboard, count people against your plan, pace lines so they stay healthy, stop abuse, and support you. Insights read your agent's conversations to show where it lets people down; an AI model on Google's Vertex AI grades them.

We don't sell it, we don't rent it to advertisers, and we don't train public AI models on it.

How long we keep it

• Message content and files: your plan's retention, 30 days by default. After it, message content is removed and files are deleted.
• Events and webhook deliveries: 30 days in the event log. Webhooks are retried for up to 3 days.
• Conversation text in the dashboard: 30 days, encrypted, and every read of it is logged.
• Contacts and conversations: the IDs and addresses stay until you delete the contact, so someone who writes again a month later is still the same person to your agent.
• People held past a free-trial limit: their messages are kept 30 days, then deleted.
• iMessage: our iMessage line provider keeps message content for up to six months, longer than Flow does.
• Voice notes: the audio goes to our speech-to-text provider, which deletes it right after the transcript is made. The transcript is kept with the message, for the same time.
• Your account: while it is open.

Deleting it

You can delete one person's data with one API call (DELETE /v0/contacts/{id}). It erases their name and address, the content of every message in their conversations, their files and events, and anything still queued to them. Only IDs, timestamps and the counts that bill and pace your senders are kept.

Flow cannot delete what is on the person's own phone, or what a channel keeps itself.

If someone who messaged your agent asks us for their data, we pass the request to you, since you decide what happens to it. To close your account and delete its data, email us.

Who else handles it

Each receives only what it needs for its part.

• Google Cloud: hosting, database, storage and sign-in, and Vertex AI for grading Insights.
• Our iMessage line provider: carries iMessage, and SMS or RCS when iMessage cannot reach someone. Keeps message content up to six months.
• Meta: carries WhatsApp messages.
• Telegram: carries Telegram messages.
• Soniox: speech-to-text for voice notes. Deletes the audio right after.
• Dodo Payments: billing and payments, as our merchant of record.

Bots made with Flow's earlier bot builder also use the AI models that write their replies and code storage for their instructions. Ask us for the current list of providers.

Where it is stored

Message data is stored in the United States, on Google Cloud. People anywhere can message a Flow line, so their data reaches the US.

This website

The public pages of flow.engineer have no analytics, tracking cookies or third-party scripts. They load their fonts from Google Fonts. The dashboard has no analytics, session recording or third-party scripts either.

Flow's servers report their own errors (what kind of error, and where), never what you or the people messaging your agents type, files or keys.

Flow's earlier bot builder

The next sections cover bots made with Flow's earlier bot builder, which keep their own limits while they still run.

Your answers when you start

What you type into the chat on this site is used to write your bot's first draft, to keep your answers until you sign in, and, when you leave your contact details, to get back to you about it. That means the answers you give, any files you add, the contact details you share, and the transcript itself.

What we don't do with it

We don't sell it, we don't rent it to advertisers, and we don't train public models on it. If you'd rather we deleted it, email samyak@flow.engineer and we will.

Bots you build

Conversations, contacts and orders in a bot you build with Flow are yours, not ours. Flow processes them on your behalf so the bot can do its job, and keeps a log of the actions it takes so you can check them.

Connected apps

When you connect your own app or API to a bot you build on Flow, we store its address, the key or password you give us, and the choices you make for it (for example whether the bot may change things there). The key is encrypted before it is stored, with a data key that is itself kept in a separate key management service. Once it is saved, we never show it again (only the last four characters of a longer key), and disconnecting the app deletes it.

Your bot never holds the key: it is not in the bot's files, its code repository or what its language model sees. The bot's calls to your app go through Flow, which adds the key on the way out, sends them only to the address you connected, and takes the key out of any answer before the bot reads it. Calls that would change something in your app are blocked unless you allow them.

When an app signs you in instead of taking a key, we store the sign-in it gives us (the tokens that let your bot's calls act with the permissions you granted there) and, if you gave us one, your app's client secret, encrypted in the same way and never shown. We renew the sign-in as the app allows. Disconnecting signs Flow out at the app where the app supports that, and deletes the sign-in.

We record each call so you can check what your bot did: which connection, the method, the path, the result, how long it took and its size. We never record what was sent or received, the headers or the query string. These records are deleted after 30 days.

Your customers' chats, files and data

When your customers write to your bot on Telegram or WhatsApp, we keep their messages and the bot's replies (a voice note as its words) so the bot remembers the conversation. By default, chats are deleted after 90 days and we keep at most the latest 200 messages of each chat; if your business needs different limits, ask us and we can change them. The message as Telegram or WhatsApp delivered it to us is kept for 3 days after it reaches the bot, or 14 days if it could not be delivered.

Files, photos and voice notes your customers send are kept, as they were sent, in private storage for 90 days, so you can open them; then they are deleted. What your bot saves while it works (orders, bookings and the like) and the messages it schedules are kept until you delete them.

You can delete everything your bot keeps about one customer at once: what it saved, their scheduled messages, their chat and their files.

Questions

Questions, corrections or deletion requests: samyak@flow.engineer.