Privacy Policy

1. Scope and Controller

Flow Information Systems LLC (“Flow,” “Company,” “we,” “our,” or “us”) is responsible for the personal information described in this Privacy Policy, except where we process information solely on behalf of a business customer under that customer’s instructions. This Privacy Policy applies to our websites, applications, hosted services, APIs, developer tools, communications, Flow Judgment Protocol services, and Agentic Services (collectively, the “Service”).

“Flow Judgment Protocol” or “FJP” means Flow’s specifications, schemas, software, APIs, hosted services, and related technologies for exchanging structured evidence, judgments, confidence, recommendations, actions, and related information. “Agentic Services” means features that allow software agents or automated workflows (“Agents”) to access information, communicate, invoke tools, interact with other Agents or systems, recommend actions, or take actions subject to configured permissions.

This Privacy Policy does not apply to third-party products, websites, Agents, model providers, connectors, or services that maintain their own privacy policies, except to the extent we receive personal information from them and process it as described here.

2. Roles in Business and Enterprise Accounts

When an organization provides you access to the Service, that organization may be the controller or business responsible for personal information submitted through its account, and Flow may act as its processor or service provider. The organization may control account access, permissions, connected systems, Agent configurations, retention, exports, and deletion. Its privacy notice and agreement with you may govern its processing of your information.

Where a data processing addendum, enterprise agreement, business associate agreement, order form, or other written agreement applies, that agreement controls to the extent it conflicts with this Privacy Policy.

3. Personal Information We Collect

The information we collect depends on the features you use, your account configuration, the systems you connect, and the actions you instruct the Service or an Agent to perform.

3.1 Account, identity, and professional information

• Name, email address, username, authentication information, and account identifiers.
• Company, job title, role, professional interests, biography, and business contact information.
• Timezone, language, region, preferences, subscription plan, and organization membership.
• Account recovery, verification, invitation, referral, and administrator information.

3.2 User Content, prompts, and outputs

• Prompts, questions, instructions, uploaded files, notes, messages, feedback, and support communications.
• Companies, industries, people, portfolios, projects, goals, risks, decisions, and subjects you ask Flow to monitor or analyze.
• Analyses, summaries, judgments, recommendations, confidence assessments, rankings, alerts, actions, and other outputs generated through the Service.
• Corrections, ratings, “more like this” or “less like this” signals, approvals, rejections, and other interactions used to personalize or evaluate the Service.

3.3 FJP and Agentic Services information

• Agent names, identifiers, descriptions, capabilities, endpoints, public keys, protocol versions, and discovery metadata.
• Agent instructions, policies, goals, memory, context, tool selections, permission scopes, approval rules, spending limits, and safety settings.
• FJP messages, evidence packages, confidence values, judgments, recommended actions, counterfactuals, falsifiers, and protocol metadata.
• Agent-to-Agent requests, responses, offers, negotiations, routing information, delivery records, and counterparty identifiers.
• Tool calls, API requests, action attempts, approvals, denials, execution results, errors, retries, and audit logs.

3.4 Connected services and credentials

If you connect an email account, calendar, cloud drive, communications platform, database, CRM, payment service, developer platform, model provider, or other third-party system, we may receive information that the connection permits us to access. Depending on the integration, this may include account identifiers, messages, files, events, contacts, records, metadata, permissions, and content.

We may process access tokens, API keys, credentials, webhook secrets, or similar authentication material needed to maintain the connection. We use such material to provide the requested integration, secure the Service, and comply with your instructions. Third-party providers may independently collect information about your use of their services.

3.5 Transactions, subscriptions, and agentic payments

• Subscription plan, billing status, invoices, transaction identifiers, payment status, refunds, chargebacks, and tax information.
• Purchase requests, quotes, counterparties, transaction instructions, approval records, spending controls, receipts, and fulfillment information.
• Limited payment-method information made available by payment processors, such as card brand, expiration date, billing address, and last four digits. Flow generally does not receive complete payment-card numbers.

3.6 Usage, device, network, and telemetry information

• IP address, approximate location derived from IP, browser, device type, operating system, language, referring URL, and advertising or browser identifiers.
• Pages and features viewed, searches, clicks, session information, timestamps, performance metrics, interaction patterns, ad or campaign interactions, conversion events, and pixel or cookie identifiers such as Meta's _fbp or _fbc where present.
• API endpoints used, request and response metadata, token and compute usage, rate-limit events, model routing, latency, and error information.
• Security events, authentication records, suspected abuse, malware or prompt-injection indicators, and diagnostic logs.

3.7 Information from third parties and public sources

We may receive information from organization administrators, integration providers, payment processors, identity and security vendors, analytics providers, data licensors, business partners, referral sources, public websites, public records, news sources, advertising and marketing platforms such as Meta Platforms, Inc., and other lawful sources. We may combine this information with information collected through the Service.

3.8 Sensitive personal information

Depending on how you use the Service, User Content or connected systems may contain sensitive personal information, including account credentials, financial information, precise location, private communications, government identifiers, or information concerning health, race or ethnicity, religion, union membership, political views, sexual orientation, or other protected characteristics. Do not provide sensitive personal information unless it is necessary for an authorized use and you have the legal right to do so.

Unless separately disclosed, we use sensitive personal information only as reasonably necessary to provide user-requested functionality, authenticate users, maintain security, prevent fraud, process authorized transactions, comply with law, and perform other permitted business purposes. We do not use sensitive personal information to infer characteristics about individuals for advertising.

4. How We Use Personal Information

We may use personal information to:

• Provide, operate, maintain, authenticate, support, and improve the Service.
• Create and manage accounts, subscriptions, organizations, permissions, and connected services.
• Generate personalized intelligence, briefings, analyses, judgments, recommendations, alerts, and other outputs.
• Operate FJP, route protocol messages, validate schemas, maintain interoperability, and provide developer services.
• Execute or facilitate authorized Agent actions, tool calls, communications, workflows, and transactions.
• Transmit information to recipients, systems, counterparties, and Agents selected or authorized by you.
• Process payments, subscriptions, taxes, credits, refunds, disputes, and account balances.
• Provide customer support, respond to requests, and communicate service or account information.
• Personalize features, remember preferences, measure effectiveness, and understand how the Service is used.
• Test, evaluate, debug, secure, monitor, and improve models, prompts, retrieval systems, algorithms, and product features.
• Detect and prevent fraud, abuse, unauthorized access, security incidents, malicious Agents, prompt injection, and violations of our Terms.
• Enforce agreements, protect rights and safety, resolve disputes, comply with legal obligations, and respond to lawful requests.
• Create aggregated or de-identified information for analytics, research, benchmarking, and service improvement.
• Send marketing communications where permitted by law and manage communication preferences.
• Measure advertising and campaign performance, attribute conversions, create or measure audiences, and, where permitted by law and your choices, personalize, retarget, or deliver advertising through platforms such as Meta.

5. AI, FJP, Profiling, and Automated Processing

The Service uses automated systems, including machine learning models, retrieval systems, rules, scoring methods, and Agents, to analyze information, personalize content, rank signals, estimate relevance or confidence, identify risks and opportunities, recommend actions, and perform user-authorized tasks. These activities may involve profiling under some privacy laws.

Inputs and relevant context may be transmitted to Flow-operated systems and to third-party model, infrastructure, retrieval, or tool providers to generate outputs or perform actions. We seek to limit the information sent to what is reasonably necessary for the applicable function, subject to product design, user instructions, account configuration, and contractual commitments.

Flow does not, in its capacity as controller, ordinarily make decisions based solely on automated processing that produce legal or similarly significant effects concerning an individual. A user or organization may configure an Agent or workflow to support or make decisions. In that situation, the user or organization is responsible for establishing a lawful basis, providing required notices, implementing meaningful human review, testing for accuracy and bias, and honoring applicable rights. Where applicable law grants rights concerning automated decision-making or profiling, you may contact us as described below.

6. Model Training and Service Improvement

We may review and use interaction data, feedback, telemetry, and de-identified or aggregated information to evaluate and improve the Service. We may also use User Content for service improvement when permitted by the applicable account settings, agreement, notice, consent, or law.

We do not authorize third-party model providers to use User Content to train general-purpose models for their own benefit unless this is expressly disclosed, enabled by the user or organization, or separately agreed. Data handling may differ for beta features, third-party connectors selected by you, free or promotional offerings, and enterprise configurations. Applicable order forms or product notices will control where they provide more specific terms.

7. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients for the purposes described in this Privacy Policy:

• Infrastructure and service providers: cloud hosting, databases, storage, content delivery, monitoring, security, authentication, customer support, email delivery, analytics, and similar vendors.
• Advertising, marketing, and measurement providers: platforms such as Meta Platforms, Inc. that may receive website or app activity, browser or device information, cookie or advertising identifiers, and conversion events through tools such as the Meta Pixel for campaign measurement, attribution, audience creation, retargeting, or advertising, subject to applicable consent and opt-out requirements.
• AI, model, retrieval, and tool providers: providers that process relevant inputs, context, and outputs to generate responses or perform requested functions.
• Connected services: systems you connect or instruct us to access, including communication, productivity, storage, developer, financial, and business platforms.
• Recipients and Agent counterparties: people, organizations, Agents, marketplaces, APIs, and systems that you or an authorized Agent chooses to contact, query, instruct, pay, or otherwise interact with.
• Payment and transaction providers: payment processors, fraud-prevention services, banks, networks, tax providers, and transaction counterparties.
• Organization administrators: administrators and authorized representatives of an organization that provides or manages your account.
• Professional advisers: auditors, attorneys, insurers, accountants, consultants, and financial advisers subject to appropriate duties of confidentiality.
• Authorities and protected parties: law enforcement, regulators, courts, government entities, or others when reasonably necessary to comply with law, protect rights or safety, investigate wrongdoing, or enforce agreements.
• Business transaction participants: actual or prospective buyers, investors, lenders, successors, or counterparties in a financing, merger, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate protections.
• Other recipients: when you direct us to disclose information, provide consent, or intentionally make information public.

Service providers may process personal information only for contracted or permitted purposes, subject to applicable agreements and law. Third parties you independently select, including Agent counterparties and connected services, may process information under their own terms and privacy policies.

8. Agent-to-Agent Communications and Public FJP Data

Agentic Services may transmit information outside Flow to discover, identify, authenticate, communicate with, negotiate with, or request services from other Agents and systems. Information included in an outbound message may be received, logged, retained, analyzed, or redistributed by the recipient. Do not configure an Agent to disclose information that the recipient is not authorized to receive.

Certain FJP resources may be designed to be public, such as public Agent profiles, capabilities, endpoints, protocol metadata, repositories, documentation, attestations, or content intentionally published by a user. Public information may be indexed, copied, cached, or retained by third parties after you modify or delete it from Flow. We are not responsible for third-party copies.

9. Agentic Transactions and Payment Information

When you authorize an Agent to request quotes, initiate purchases, transmit payment instructions, or facilitate other transactions, Flow may process and disclose information necessary to evaluate, authorize, execute, document, reconcile, or dispute the transaction. This may include identity, counterparty, authorization, spending-limit, transaction, fraud, tax, and fulfillment data.

Payment processors and financial providers generally collect and process full payment credentials directly under their own privacy policies. Flow may receive tokens, status information, limited account details, and transaction records. Agent counterparties may independently collect information necessary to provide products or services.

10. Sale, Sharing, and Targeted Advertising

Flow does not sell personal information for money. We may, however, use advertising and measurement technologies, including the Meta Pixel, that disclose personal information or online activity to advertising platforms for campaign measurement, attribution, audience creation, retargeting, or personalized advertising. Depending on the jurisdiction and how the technology is configured, these disclosures may be considered “sharing” for cross-context behavioral advertising, “targeted advertising,” or a “sale” under certain U.S. state privacy laws even though no money is exchanged.

Where applicable law gives you the right to opt out of sale, sharing, or targeted advertising, you may exercise that right through any privacy or cookie controls we make available or by contacting privacy@flowinfo.co. Where required, we also process legally recognized opt-out preference signals, such as Global Privacy Control, for the browser or device sending the signal. After an applicable opt-out, we will not knowingly use the affected browser or device data for covered targeted-advertising or cross-context behavioral-advertising purposes unless you later consent or applicable law permits the processing.

Operational disclosures to service providers, connected services, recipients, and Agent counterparties are described elsewhere in this Policy and are not intended to be sales or targeted-advertising disclosures.

11. Cookies, Meta Pixel, and Similar Technologies

We and our providers may use cookies, local storage, pixels, SDKs, tags, and similar technologies to authenticate users, preserve preferences, maintain sessions, prevent fraud, measure performance, understand use, improve the Service, measure marketing campaigns, attribute conversions, and, where permitted, support advertising or retargeting.

• Essential technologies: required for authentication, security, network management, and core functionality.
• Preference technologies: remember settings, language, and interface choices.
• Analytics technologies: help us understand feature use, performance, reliability, and audience engagement.
• Advertising and marketing technologies: help us measure campaigns, attribute visits or conversions, build or measure audiences, limit or improve ads, and, where permitted, support retargeting or personalized advertising.

11.1 Meta Pixel

Flow uses the Meta Pixel, a technology provided by Meta Platforms, Inc., on certain Flow websites or landing pages. When active, the Meta Pixel can allow Flow and Meta to collect or receive information about visits and actions on those pages, such as page views, URLs, referral information, timestamps, browser and device information, IP address and related network information, Meta or browser cookie identifiers, ad interactions, and conversion events that Flow configures. Meta may associate information received through the Pixel with other information it holds in accordance with Meta's own terms and privacy policies.

Flow may use Meta Pixel information to understand whether marketing works, measure and attribute conversions, create or measure advertising audiences, improve campaign delivery, and, where permitted by law and your choices, show or help Meta show advertising based on prior interactions with Flow. We do not intend to transmit prompts, uploaded files, private account content, payment-card numbers, or sensitive personal information to Meta through the Meta Pixel. If Flow enables a Meta feature that uses customer identifiers, such as an advanced matching feature, we will configure and disclose that processing as required by applicable law.

11.2 Consent and controls

In jurisdictions where consent is required before using non-essential advertising or tracking technologies, Flow will seek the required consent before activating those technologies for the affected user. You can reject or withdraw consent through any cookie or privacy controls we make available. Where applicable U.S. state law treats advertising-related Pixel disclosures as sale, sharing, or targeted advertising, you may opt out as described in Section 10. You may also control cookies through your browser and may have additional ad controls through Meta. Blocking or deleting cookies can affect measurement and may require you to renew a privacy choice on a new browser or device.

12. Data Retention

We retain personal information for no longer than reasonably necessary for the disclosed purposes, subject to account settings, contractual commitments, legal obligations, dispute preservation, security needs, and technical limitations. Retention criteria include the nature and sensitivity of the information, the purpose for which it was collected, the duration of the customer relationship, applicable limitation periods, and legal or regulatory requirements.

Uploaded files and user-submitted content. When you delete an uploaded file, document, or other user-submitted content through the Service's controls, we will remove the file from active production systems within a reasonable period, typically within 30 days. You may also request deletion of specific uploads by contacting privacy@flowinfo.co. We will not retain copies of user-uploaded files beyond the retention periods described above except as required by law, active legal proceedings, or documented compliance obligations.

When information is deleted, it may remain temporarily in encrypted backups, security archives, transaction records, or systems designed to prevent accidental loss, and will be purged from those systems in accordance with our backup rotation schedules. We may retain de-identified information and information necessary to document that a deletion request was completed. Public information and information disclosed to third parties may remain in their systems.

13. Security

We use administrative, technical, and physical safeguards designed to protect personal information, which may include encryption in transit, encryption of selected data at rest, access controls, authentication protections, logging, monitoring, secrets management, vulnerability management, vendor review, secure development practices, incident response, and employee confidentiality controls.

Storage and infrastructure security. All cloud storage buckets, databases, and file-storage systems containing user data are configured as private by default. We do not expose user-uploaded files, personal information, or account data through publicly accessible storage endpoints. We conduct regular access-control audits and automated configuration checks to prevent unintended public exposure of stored data.

No method of transmission, storage, model processing, integration, or Agent operation is completely secure. You are responsible for protecting your devices, credentials, API keys, access tokens, connected accounts, Agent permissions, and approval settings. Notify us promptly at security@flowinfo.co if you believe your account, Agent, credential, or connected system has been compromised.

14. Your Choices and Account Controls

• Profile and preferences: you may update certain account, topic, briefing, Agent, and communication settings through the Service.
• Connected services: you may disconnect integrations or revoke permissions through Flow or the third-party provider. Revocation does not undo actions or disclosures already completed.
• Agent controls: you may change permissions, approval gates, spending limits, destinations, memory, tools, and other settings made available by the Service.
• Marketing email: you may unsubscribe using the link in a marketing email. We may still send transactional, security, billing, legal, and service communications.
• Cookies and advertising technologies: you may use browser or available cookie/privacy controls to reject or withdraw consent for non-essential technologies and, where applicable, opt out of sale, sharing, or targeted advertising as described in Sections 10 and 11.
• Data deletion: you may delete individual uploaded files, content, and history through in-app controls. Deleted content is removed from active systems within 30 days.
• Account deletion: you may request complete account deletion through available product controls or by contacting privacy@flowinfo.co. Upon account deletion, we will delete or de-identify your personal information in accordance with the retention schedule above and applicable law.

15. U.S. State Privacy Rights

Depending on your state and whether the applicable law covers Flow’s processing, you may have the right to request access to or confirmation of personal information, correction, deletion, portability, a list of certain third parties, or additional information about collection and disclosure. You may also have the right to opt out of sale, sharing, targeted advertising, or certain profiling; limit certain uses of sensitive personal information; appeal a denied request; and receive equal service and pricing without unlawful discrimination.

Submit a request to privacy@flowinfo.co with the subject line “Privacy Request.” Describe the right you wish to exercise and the account or interaction involved. We may verify your identity and authority using information reasonably related to the request. We will use information submitted for verification only to verify and respond to the request, prevent fraud, and maintain legally required records.

Where permitted, an authorized agent may submit a request for you. We may require proof of authorization, verification of your identity, and direct confirmation that you authorized the request. You may appeal an eligible denial by replying to our decision and stating that you wish to appeal. We may deny or limit a request where permitted by law, including when we cannot verify it, an exception applies, or compliance would adversely affect the rights of another person.

16. California Notice at Collection and Privacy Disclosures

This section supplements the rest of this Privacy Policy for California residents. In the preceding 12 months, depending on how individuals used the Service, Flow may have collected the categories of personal information listed below. We collect these categories from the sources described in Section 3, use them for the purposes described in Sections 4 through 6, and disclose them to the recipient categories described in Sections 7 through 9.

Flow does not sell personal information for money. Flow may use advertising and measurement technologies, including the Meta Pixel, in ways that may constitute “sharing” for cross-context behavioral advertising under California law. California residents may opt out of such sharing through the privacy or cookie controls we make available, by contacting privacy@flowinfo.co, or through a legally recognized opt-out preference signal such as Global Privacy Control. Flow does not use or disclose sensitive personal information for purposes that require a right to limit under California law unless we provide the legally required notice and method to exercise that right. We do not knowingly sell or share the personal information of consumers under 16.

California residents may exercise applicable rights to know, access, correct, delete, and receive information about collection and disclosure, subject to verification and legal exceptions. California’s “Shine the Light” law may also permit residents to request information concerning certain disclosures for third parties’ direct-marketing purposes. Flow does not disclose personal information to third parties for their own direct marketing as contemplated by that law.

17. EEA, United Kingdom, and Switzerland

If European data protection law applies and Flow acts as controller, our legal bases depend on the processing activity:

• Contract: to create accounts, provide requested features, operate FJP and Agentic Services, process subscriptions, and support users.
• Legitimate interests: to secure, maintain, improve, personalize, and understand the Service; prevent fraud and abuse; communicate with business users; and protect Flow, users, and others, balanced against individual rights.
• Consent: where we ask for consent, including for certain cookies, marketing, sensitive information, or optional processing.
• Legal obligation: to comply with accounting, tax, regulatory, sanctions, law-enforcement, and other legal requirements.
• Vital interests or public interest: in limited circumstances where recognized by applicable law.

Subject to applicable conditions and exceptions, you may have rights to be informed, access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and safeguards concerning solely automated decisions. You may object at any time to processing for direct marketing. You may lodge a complaint with the data protection authority where you live or work or where an alleged violation occurred.

You may contact privacy@flowinfo.co to request information about the applicable controller, representative, data protection contact, legitimate-interest assessment, or transfer mechanism. Withdrawal of consent does not affect the lawfulness of processing that occurred before withdrawal.

18. International Data Transfers

Flow is based in the United States, and personal information may be processed in the United States and other countries where Flow, its providers, connected services, model providers, recipients, or Agent counterparties operate. Those countries may have privacy laws that differ from those in your jurisdiction.

Where required, we use recognized transfer safeguards, such as adequacy decisions, standard contractual clauses, the United Kingdom addendum or international data transfer agreement, or another lawful mechanism. Copies of relevant safeguards may be requested, subject to redaction of confidential or commercially sensitive information.

19. De-identified and Aggregated Information

We may create and use aggregated or de-identified information that is not reasonably capable of being associated with an individual. We may use and disclose such information for research, analytics, benchmarking, security, product development, and other lawful purposes. Where required by law, we will maintain de-identified information in de-identified form and will not attempt to reidentify it except to test whether our de-identification processes are effective.

20. Third-Party Services and Links

The Service may contain links to or integrations with third-party websites, applications, models, Agents, marketplaces, payment services, or content. Their collection and use of personal information is governed by their own policies and agreements. Review those policies before directing Flow or an Agent to disclose information or take action through a third party.

21. Children’s Privacy

The Service is intended for business and professional users and is not directed to children under 13. We do not knowingly collect personal information directly from children under 13. Users under 18 may not create an account or use the Service unless expressly authorized under a separate written program that includes legally required consent and safeguards. If you believe a child has provided personal information, contact privacy@flowinfo.co.

22. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in the Service, data practices, technology, law, or business operations. We will post the updated policy and revise the “Last updated” date. Where required, we will provide additional notice or obtain consent before materially changing how we use previously collected personal information.

23. Contact Us

Questions, privacy requests, complaints, and requests concerning international transfers or automated processing may be sent to:

To exercise a privacy right, use the subject line “Privacy Request” and identify the account, jurisdiction, and right involved. Please do not send passwords, complete payment-card numbers, private keys, or unnecessary sensitive information.