Effective Date: 2026-08-02

Last Updated: 2026-08-02

info 1. Introduction

This Privacy Policy explains how flowtoid ("we", "us", "our") collects, processes, stores, and protects your personal data when you use the flowtoid web application and related services (collectively, the "Service"). flowtoid is an AI agent orchestration platform that enables users to configure autonomous agents, connect external services (Telegram, GitHub, HTTP endpoints, and custom Model Context Protocol servers), and automate tasks via LLM providers.

We are committed to transparency and full compliance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR").

badge 2. Data Controller Identity

The data controller responsible for your personal data under the GDPR is:

[INSERT FULL LEGAL NAME]

[INSERT STREET ADDRESS]

[INSERT CITY, POSTAL CODE, COUNTRY]

Email: adambartos.dev@proton.me

Representative (if applicable): [INSERT NAME AND CONTACT]

If you have any questions about this policy or wish to exercise your data protection rights, please contact us at the email address above.

database 3. Data We Collect

3.1 Account Data

  • Email address — used for authentication and account identification.
  • Password — stored in hashed form by our database provider (PocketBase). We never store plaintext passwords.
  • Display name — used to personalize your workspace.
  • User ID — a unique identifier assigned by PocketBase.

3.2 API Keys & Integration Secrets

  • OpenRouter API key — you may optionally provide your own API key to unlock premium AI models. This key is stored in our database and sent directly to OpenRouter on your behalf.
  • Connector credentials — when you configure integrations, you may provide Telegram bot tokens, GitHub personal access tokens, HTTP headers (which may contain API keys or bearer tokens), and custom MCP server URLs and authentication headers.
  • Webhook keys — unique UUIDs generated for inbound webhook triggers.

3.3 Agent & Trigger Configurations

  • Agent configuration — names, tasks, system prompts, selected AI models, and flags (e.g., whether to use runtime data or memory).
  • Memory / conversation history — when enabled, prior messages are stored to maintain context across agent runs.
  • Execution results — text outputs produced by agents during task execution.
  • Trigger configuration — schedules (cron expressions), webhook URLs, Telegram bot settings, and agent-completion chaining rules.

3.4 Files

  • Uploaded files — any files you upload through the Service (e.g., documents, images, code). These are stored in our PocketBase file storage and may be accessed by your configured agents.

3.5 Runtime Inputs

  • Webhook payloads — JSON data sent to your webhook endpoints, temporarily stored as runtime data.
  • Telegram messages — text or voice messages received via Telegram, temporarily stored as runtime data. Voice messages are processed via OpenRouter's Whisper model and the temporary audio file is deleted immediately after transcription.

3.6 Technical Data

  • IP addresses — collected implicitly by our web server and Docker infrastructure.
  • Browser/device metadata — standard HTTP headers (User-Agent, Accept-Language, etc.) collected by our Flask frontend and nginx reverse proxy.
  • Server logs — debug and error logs generated by the backend worker, which may include truncated prompts or error messages.

gavel 4. Legal Basis for Processing

We process your personal data under the following legal bases pursuant to Article 6(1) GDPR:

Data Category Legal Basis Purpose
Account dataContract (Art. 6(1)(b))Account creation, authentication, personalization
API keys & connector secretsContract (Art. 6(1)(b))Integration functionality you requested
Agent configurations & resultsContract (Art. 6(1)(b))Core agent orchestration service
Memory / conversation historyContract (Art. 6(1)(b))Context-aware agent operation
Uploaded filesContract (Art. 6(1)(b))File-based agent operations
Runtime data (webhooks, Telegram)Contract (Art. 6(1)(b))Trigger processing and agent execution
Webhook keysContract (Art. 6(1)(b))Routing inbound automation events
IP addresses & technical logsLegitimate Interest (Art. 6(1)(f))Security monitoring and debugging

We do not process special categories of personal data (Art. 9 GDPR) as a matter of design. However, if you choose to upload files or send prompts containing sensitive data, you do so voluntarily and are responsible for ensuring you have the necessary rights to do so.

shield 5. How We Use Your Data

Your data is used exclusively to provide and improve the Service:

  • Account management: Authentication, session management, and workspace personalization.
  • Agent execution: Sending your prompts, system instructions, and tool inputs to OpenRouter for LLM inference; executing tool calls against configured connectors (Telegram, GitHub, HTTP, MCP).
  • Trigger automation: Running agents on schedules, in response to webhooks, or when specific Telegram messages are received.
  • File handling: Storing and serving files you upload so agents can read or reference them.
  • Service improvement: Analyzing aggregated, anonymized usage patterns to improve reliability.

We do not sell your personal data to third parties, use your data for advertising or marketing purposes, or share your data with third parties except as necessary to provide the Service (see Section 7).

storage 6. Data Storage & Retention

6.1 Storage Locations

  • Primary database: PocketBase (SQLite-backed), self-hosted on our infrastructure.
  • File storage: PocketBase file store on local encrypted volumes.
  • Session data: Client-side signed cookies (Flask session). No server-side session store is used.
  • Temporary files: Telegram voice messages are written to /tmp on the backend worker and deleted immediately after transcription.

6.2 Retention Periods

Data Type Retention
Account dataUntil you delete your account
API keys & connector secretsUntil you delete them or your account
Agent configurationsUntil you delete the agent
Memory / conversation historyUntil you delete the agent or manually reset it
Agent execution resultsUntil you delete the agent or the specific result
Trigger configurationsUntil you delete the trigger
Uploaded filesUntil you delete the file
Runtime data (webhooks, Telegram)Transient — cleared after execution
Server logsIndefinite (see Section 15 for change notice)

You are responsible for managing your data lifecycle. We recommend periodically reviewing and deleting agents, connectors, triggers, and files you no longer need.

public 7. Third-Party Processors & International Transfers

OpenRouter AI

Role: LLM inference and audio transcription provider.

Data transferred: Prompts, system prompts, conversation memory, runtime data, audio data (base64-encoded), and your OpenRouter API key.

Transfer mechanism: HTTPS API (https://openrouter.ai/api/v1).

Safeguards: OpenRouter acts as an independent data controller for its own processing.

Telegram

Role: Messaging platform for inbound triggers and outbound message delivery.

Data transferred: Bot tokens, target user IDs, outbound message text, and (temporarily) voice message files.

Transfer mechanism: HTTPS Bot API (https://api.telegram.org).

GitHub

Role: Code repository integration for reading, creating, editing, and deleting files.

Data transferred: GitHub personal access tokens, repository URLs, file contents, and commit messages.

Transfer mechanism: HTTPS GitHub API (https://api.github.com).

Custom MCP Servers

Role: User-defined external tool servers connected via the Model Context Protocol.

Data transferred: User-defined authentication headers, tool arguments, and tool results.

Transfer mechanism: HTTP or Server-Sent Events (SSE) to URLs you provide.

CDN Providers

jsDelivr: Delivers static JavaScript libraries (HTMX, AlpineJS, Tailwind). May log IP addresses.

Google Fonts: Delivers web fonts. May set cookies and log IP addresses. See our Cookie & Tracking Policy for details and opt-out mechanisms.

lock 8. Data Security Measures

We implement the following technical and organizational security measures:

  • Authentication: Password-based authentication via PocketBase, with passwords hashed using industry-standard algorithms.
  • Session management: Signed session cookies. We recommend using a strong, random APP_SECRET in production.
  • Data isolation: Each user's data is scoped by PocketBase record ownership. Frontend routes enforce login_required decorators.
  • Transport security: All external API calls use HTTPS. Internal service communication uses Docker networking.
  • Secret storage: API keys and connector credentials are stored in the PocketBase database. Note: At the time of this policy, database-level encryption at rest is not enabled by default. We recommend enabling full-disk encryption on the host server.
  • Infrastructure: Services run in Docker containers behind an nginx reverse proxy manager with Let's Encrypt TLS termination.

No method of electronic storage or transmission is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

person_alert 9. Your Rights Under GDPR

You have the following rights regarding your personal data:

9.1

Right of Access (Art. 15)

You may request confirmation of whether we process your personal data and, if so, a copy of that data together with information about the processing purposes, categories of data, recipients, retention periods, and your rights.

9.2

Right to Rectification (Art. 16)

You may request correction of inaccurate personal data or completion of incomplete data.

9.3

Right to Erasure / "Right to be Forgotten" (Art. 17)

You may request deletion of your personal data. You can delete individual agents, connectors, triggers, files, and results through the Service interface. To request full account deletion, contact us at adambartos.dev@proton.me. We will delete your account and associated data within 30 days, except where we are required to retain certain data for legal or security purposes.

9.4

Right to Restriction of Processing (Art. 18)

You may request that we limit processing of your data in certain circumstances (e.g., while we verify accuracy).

9.5

Right to Data Portability (Art. 20)

You may request your personal data in a structured, commonly used, machine-readable format (JSON). To request a data export, contact us at adambartos.dev@proton.me.

9.6

Right to Object (Art. 21)

You may object to processing based on legitimate interests (Art. 6(1)(f)). To object, contact us at adambartos.dev@proton.me.

9.7

Right to Withdraw Consent

Where we process data based on consent (if applicable in future features), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

9.8

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement.

mail 10. Exercising Your Rights

To exercise any of the above rights, please contact us at adambartos.dev@proton.me with the subject line "GDPR Request — [Right Name]". We may request verification of your identity before processing your request. We will respond within one month of receipt (extendable by two further months where necessary, and we will inform you of any such extension).

warning 11. Data Breach Notification

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, and we will inform you without undue delay where required by GDPR Art. 34.

delete 12. Data Retention & Deletion Policy

12.1 Automatic Deletion

  • Runtime data (webhook payloads, Telegram messages) is automatically cleared after agent execution.
  • Temporary voice message files are deleted immediately after transcription.

12.2 Manual Deletion

You may delete the following at any time through the Service: Agents (and their associated memory, results, and runtime data), Connectors, Triggers, Files, and your OpenRouter API key.

12.3 Account Deletion

To delete your account and all associated data, contact adambartos.dev@proton.me. Account deletion will remove your user record, all agents, connectors, triggers, files, results, and any other linked data.

12.4 Logs

Server logs (IP addresses, request metadata) are retained indefinitely unless we configure automated log rotation. We will update this policy once automated rotation is implemented.

public 13. International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States (OpenRouter, GitHub) and the United Arab Emirates (Telegram). Where such transfers occur, we rely on the necessity of the transfer for the performance of a contract between you and us (Art. 49(1)(b) GDPR).

You are advised that some non-EEA countries may not provide the same level of data protection as the EEA.

smart_toy 14. Automated Decision-Making & Profiling

The Service uses LLM-based agents to process your inputs and generate outputs. This constitutes automated decision-making in a broad sense. However:

  • Agents do not produce legally binding decisions concerning you (e.g., credit scoring, employment decisions).
  • You retain full control over agent configuration, triggers, and data inputs.
  • You may disable or delete any agent at any time.

If you believe an automated output has adversely affected you, please contact us so we can review and, if necessary, remove or correct the output.

child_care 15. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us immediately.

update 16. Changes to This Privacy Policy

We may update this policy from time to time to reflect changes in our practices, technology, or legal requirements. We will post the updated policy on the Service and update the "Last Updated" date. Continued use of the Service after changes constitutes acceptance of the updated policy.

mail 17. Contact Information

For privacy-related inquiries, data subject requests, or concerns about this policy, please contact:

[INSERT FULL LEGAL NAME]

Email: adambartos.dev@proton.me

Postal Address: [INSERT FULL ADDRESS]

You may also contact your local data protection supervisory authority.