Flowal Privacy Policy

Effective date: January 15, 2026
Last updated: February 14, 2026

‍

This Privacy Policy explains how Flowal (“Flowal”, “we”, “us”) collects, uses, shares, and protects your personal data when you use our website, app, and related services (together, the “Services”).

Reality check: A privacy policy normally must identify the legal entity and address of the data controller. You asked not to specify that for now. That’s a compliance risk (especially UK/EU), but the policy below is written to be operationally accurate with what you told me.

1) Who we are and how to contact us

Controller (generally): Flowal (the operator of the Services).
Contact: christian@flowal.co

Enterprise / Organization accounts (controller vs processor)

If you use Flowal through an organization (e.g., an MCN/agency/brand) that creates/administers your account or uploads/links creator information:

The organization is the controller for the personal data it provides to Flowal about its members/creators and the way it uses the Services.
Flowal acts as a processor for that organization for that data, and as a controller for limited data we process for our own purposes (security, billing, fraud prevention, legal compliance, and improving the Services).

If you sign up directly as an individual user, Flowal generally acts as the controller.

2) What we collect

A) Information you provide

Account & contact details: name (if provided), email, password (hashed), profile details you add, and communications with us.
Billing details: billing email, billing address (if provided), subscription status, invoices, and payment metadata. We do not store full card numbers; payments are handled by Stripe.
Payout details (where applicable):
- IBAN/bank details if you provide them directly; and/or
- payout information processed through Stripe (e.g., Stripe Connect), depending on your setup.
Claims and verification materials (if you submit them): screenshots, platform emails, correspondence with platform support, and other files you provide to support a claim or verification request. These may contain third-party data if you include it.
Support content and uploads: messages, attachments, and any information you send to customer support.

B) Information we collect automatically

Device and usage data: IP address, device identifiers, browser type, operating system, language, timestamps, pages/screens viewed, actions taken, and referring/exit URLs.
Log and security data: authentication logs, access logs, error logs, and security events.
Cookie and similar technology data: cookie identifiers, preferences, and analytics identifiers.
OAuth metadata: when you connect third-party accounts, we collect metadata such as connection timestamps, scopes/permissions granted, and token-related identifiers required to maintain the connection.

C) Information from third parties (including YouTube/Google)

If you connect a YouTube/Google account, we may receive data via Google/YouTube APIs depending on what you authorize. This can include:

Channel/account identifiers (e.g., channel ID), and connection status.
Channel metrics and performance data (e.g., views, engagement, content performance analytics).
Monetization-related signals (e.g., monetization eligibility/status indicators that your authorized access allows us to retrieve).
Any other data explicitly authorized through the permissions you grant.

We only access what you authorize, and you can revoke access at any time in your Google account settings.

3) How we use your data

We use personal data to:

Provide and operate the Services
- Create and manage accounts
- Provide dashboards, insights, and features you request
- Maintain OAuth connections to third-party services you link
Process payments and payouts
- Manage subscriptions and billing through Stripe
- Process payouts either via Stripe or via IBAN details you provide (as applicable)
Claims handling and support
- Review claim submissions and supporting documentation
- Communicate with you about your claim and required information
- Detect and prevent fraud and misuse related to claims
AI-assisted features (support only)
- Provide AI-powered assistance (e.g., guidance, drafting support, or help understanding policy/appeals)
- Important: AI in Flowal does not make automated approval/denial decisions. It provides support to users and/or internal teams.
Security, fraud prevention, and abuse detection
- Prevent unauthorized access, account takeover, fraud, and platform abuse
- Enforce our Terms and protect the Services
Analytics and product improvement (including session replay)
- Understand usage and improve features, reliability, and user experience
- We use session replay tools to help diagnose issues and improve the product. (See Section 6.)
Legal compliance
- Meet legal, regulatory, tax, accounting, and reporting obligations
- Handle disputes and enforce rights

4) Legal bases (UK GDPR / EU GDPR)

Where UK/EU data protection laws apply, we rely on these legal bases:

Contract: to provide the Services you request and perform our agreement with you (account, core features, billing).
Legitimate interests: security, fraud prevention, analytics/product improvement, service reliability, and enforcing our Terms—balanced against your rights.
Consent: where required (e.g., non-essential cookies; certain optional processing).
Legal obligation: where we must keep records or respond to lawful requests.

You can withdraw consent at any time where consent is the basis (this won’t affect processing already performed).

5) How we share your data

We share personal data only as needed:

A) Service providers (processors)

We use vendors to operate the Services, such as:

Payments: Stripe (billing, payments, and potentially payouts)
AI services: OpenAI (model inference for AI-assisted features)

We may also use providers for hosting, analytics/session replay, customer support tooling, communications, and security monitoring. They are permitted to process data only to provide services to us.

B) Legal and safety

We may share data if required to comply with law, regulation, subpoena, court order, or to protect rights, users, and the integrity of the Services.

C) Business transfers

If we’re involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that deal (subject to appropriate safeguards).

D) No “sale” of personal data

We do not sell personal data. We also do not share personal data for cross-context behavioral advertising (targeted ads) based on your answers (no ad/social pixels running).

6) Cookies, analytics, and session replay

We use cookies and similar technologies for:

Essential functions (login sessions, security, preferences)
Analytics and performance
Session replay to understand user experience issues and improve the Service

Your choices

You can control cookies through your browser settings and any cookie preference controls we provide.
Where legally required, we will ask for consent before placing non-essential cookies.

Session replay note (important)

Session replay can capture interactions within the product (e.g., clicks, scrolling, navigation). We design our implementation to avoid collecting sensitive fields where possible (masking/redaction), but you should still avoid entering sensitive information into free-text fields unless required.

7) AI and OpenAI processing

We use OpenAI models to provide AI-assisted functionality.

What we send: content you submit to an AI feature (e.g., prompts, drafts, claim-related text if you choose to use AI assistance), plus minimal context needed for the feature to work.
Training: We do not train models on your data.
Automated decisions: AI does not make automated decisions to approve/deny claims. Any decisions remain human-led and/or rule-based operationally.

8) YouTube/Google API data and “Limited Use”

If you connect Google/YouTube:

We access Google user data only to provide the features you request and only within the permissions you grant.
We handle Google user data in line with the Google API Services User Data Policy, including the Limited Use requirements.
You can revoke access at any time via your Google account permissions, which will stop future collection via the API.

9) International transfers

Your data may be processed in countries other than where you live, depending on where we and our service providers operate.

Where UK/EU transfer rules apply, we use appropriate safeguards (such as Standard Contractual Clauses and/or the UK International Data Transfer Addendum/IDTA, and other legally recognized mechanisms).

10) Data retention

We keep data as long as necessary for the purposes described, with an intentionally conservative (long) retention approach that’s still defensible:

Account data: kept while your account is active. After closure, we typically retain core account records for up to 7 years for legal, accounting, and dispute reasons.
Billing records: up to 7 years (typical tax/accounting retention).
Claims and verification files: up to 10 years (fraud prevention, disputes, and legal defense), unless law requires longer/shorter.
OAuth connection metadata and tokens: retained while connected; after disconnect/revocation we delete/expire tokens as soon as practical, but may retain audit logs for up to 7 years.
Logs and security records: typically 12–24 months, longer if needed for security investigations or legal issues.
Analytics/session replay: typically 30–180 days, unless needed longer for debugging/security or unless you delete your account and we purge earlier where feasible.
Backups: rolling backups may persist up to 90–180 days.

We may retain data longer where required by law or for legitimate claims, security investigations, or fraud prevention.

11) Security

We use administrative, technical, and organizational measures designed to protect personal data. No method of transmission or storage is 100% secure, so we can’t guarantee absolute security.

12) Your rights

Depending on where you live, you may have rights including:

Access to your personal data
Correction/rectification
Deletion
Restriction of processing
Objection to processing (especially where we rely on legitimate interests)
Data portability
Withdraw consent (where consent applies)

How to exercise rights

Email us at christian@flowal.co. We may request information to verify your identity.

Complaints (UK/EU)

If you are in the UK or EEA, you can lodge a complaint with your local supervisory authority. In the UK, that’s the Information Commissioner’s Office (ICO).

13) Children’s privacy

The Services are not intended for anyone under 18, and you must be at least 18 or the age of legal majority in your country (whichever is higher) to use Flowal. If we learn we collected personal data from a minor, we will delete it.

14) Changes to this policy

We may update this policy from time to time. If changes are material, we will provide notice (for example, by email or in-product). The “Last updated” date will reflect the latest version.

15) Contact

For privacy questions or requests: christian@flowal.co

‍

YouTube / Google Data Addendum

‍