Log inSign up

Flows privacy policy

At Flows, we take your privacy seriously. Please read this Privacy Policy to learn how we treat your personal data. By using or accessing our Services in any manner, you acknowledge that you accept the practices and policies outlined below, and you hereby consent that we will collect, use and share your information as described in this Privacy Policy.

What this Privacy Policy Covers

This Privacy Policy covers how we treat Personal Data that we gather when you access or use our Services. “Personal Data” means any information that identifies or relates to a particular individual and also includes information referred to as “personally identifiable information” or “personal information” under applicable data privacy laws, rules or regulations. This Privacy Policy does not cover the practices of companies we don’t own or control or people we don’t manage.

As a visitor to flows.sh website

The privacy of our website visitors is important to us so we do not track any individual people.

We use Plausible Analytics to collect anonymous usage data for statistical purposes. The goal is to track overall trends not individual visitors. All the data is in aggregate only, no personal data is collected. Data collected includes referral sources, top pages, visit duration, information from the devices (device type, operating system, country and browser) used during the visit and more. You can see the full details in the Plausible data policy.

As a user of Flows Cloud (app.flows.sh)

Our guiding principle is to collect only what we need and that we will solely process this information to provide you with the service you signed up for. For that we collect:

  • First and last name (if provided)
  • Email
  • Password

We use a select number of trusted third parties to help us provide the service. We only share information with them that is required for the services they provide.

Connecting AI tools (MCP server)

You can connect AI tools such as ChatGPT, Claude or Cursor to your Flows account through our MCP server. When you connect a tool, you sign in to Flows and approve its access. To keep the tool connected, we store:

  • The name and identifying details the tool provides about itself, such as its website
  • Your approval: which tool you connected, the access you granted and when
  • Access and refresh tokens that let the tool act as you

A connected tool acts as you and can only reach the organizations you are a member of. To answer your requests, our MCP server returns data from those organizations to the tool, which can include:

  • Your organizations, their environments, languages and settings
  • Your workflows, their content, components and analytics
  • Data about the users of your product that your app sends to Flows through the SDK: user IDs (which can be email addresses), user properties, workflow progress, events and survey answers

If the tool asks for it on the approval screen, it also receives the email address of your Flows account and whether you verified it, so it can tell which account you connected.

We return this data only to the tool you connected and only to complete the request it makes on your behalf. Once returned, the provider of that tool processes it under its own privacy policy and your agreement with that provider. You can disconnect a tool at any time on the MCP page in your Flows settings. It then can’t renew its access, and access it already has expires within 15 minutes. We keep the stored approval and tokens until you disconnect the tool or delete your account.

Sharing your information

We use Loops.io to send all our emails. Transactional email and marketing emails. We have disabled link tracking and Loops only tracks open rates. See the Loops.io privacy policy for full details.

We use DigitalOcean to host our applications and databases. See the DigitalOcean privacy policy for full details.

We use Cloudflare for a global CDN, DNS, DDoS, and Captcha protection. See the Cloudflare privacy policy for full details.

We use Lemon Squeezy as a merchant in the middle for our payment processing. See the Lemon Squeezy privacy policy for full details.

We use Stripe for payment processing. See the Stripe privacy policy for full details. (Note: Stripe is currently used only for organizations that were created after July 6th 2026. We are in the process of migrating all existing organizations to Stripe. Affected organizations will be notified via email.)

Retention of data

We will retain your information as long as your account is active, as necessary to provide you with the services or as otherwise set forth in this policy.

We will also retain and use this information as necessary for the purposes set out in this policy and to the extent necessary to comply with our legal obligations, resolve disputes, enforce our agreements and protect our legal rights.

Changes and questions

We may update this policy as needed to comply with relevant regulations and reflect any new practices. Whenever we make a significant change to our policies, we will alert you to any such changes by placing a notice on the Flows website, by sending you an email and/or by some other means.

Contact us at hello@flows.sh if you have any questions, comments, or concerns about this privacy policy, your data, or your rights with respect to your information.

Last updated: October 22, 2026