Privacy Policy · Flowlange

Introduction

Flowlange ("Flowlange", "Platform", "we", "us", or "our") values the privacy of our users and of individuals whose personal data is processed through the Platform. This Privacy Policy explains how personal data is collected, used, stored, transferred, and protected when you use Flowlange websites, applications, Studio/Editor services, Flows, APIs, integrations, and related services. Flowlange is not currently operating under a separate registered company or legal entity. For this reason, "Flowlange" is used as the service provider and data controller name under this policy.

1. Data Controller

For the processing of your personal data, the data controller for the relevant activity is: Data Controller: Flowlange Address: Türkiye Website: https://flowlange.com Privacy contact: privacy@flowlange.com You may contact us at the address above for privacy and personal data requests. Note: This section will be updated if Flowlange's legal structure or contact details change.

2. Who Does This Policy Cover?

This Privacy Policy applies to:

Visitors to the Flowlange website
Users who create a Flowlange account
Flowlange Workspace members
Customers using Flowlange paid or free services
Individuals using Flowlange support services
Individuals using Flowlange APIs and integrations
Individuals receiving communications sent by Flowlange
Individuals submitting data through a Flow, form, survey, booking, or other experience created by a Flowlange customer

3. Flowlange's Data Processing Roles

For personal data collected by Flowlange customers through their own Flows, Flowlange's role may be that of a processor or technical service provider, depending on the relevant use case. Flowlange may have different data protection roles in different use scenarios. 3.1. Flowlange Users When you create a Flowlange account or use the Platform directly, Flowlange may act as a data controller for personal data related to your account and use of the Service. This may include your account information, contact details, Workspace information, subscription information, support requests, and Platform usage information. 3.2. Data Collected by Flowlange Customers When a Flowlange customer creates a Flow and collects data from their customers, employees, applicants, or other individuals through that Flow, the customer typically determines the purposes and scope of processing. In that case, the Flowlange customer may be the data controller, and Flowlange may act as a technical service provider/processor on the customer's instructions. For example, if a salon uses Flowlange to collect name, phone, email, and appointment information from its customers, the salon business decides the primary purpose and retention period for that data. In such cases, the Flowlange customer must fulfill its own privacy and notice obligations.

4. Personal Data We Collect

Depending on the features you use, Flowlange may process the following categories of data. 4.1. Account Information If you create an account, we may process your name, email address, authentication information related to your password, account status, and user preferences. Your password is not stored in plain text. 4.2. Workspace and Organization Information If you use a Flowlange Workspace, we may process the Workspace name, Workspace members, user roles, permissions, invitation details, membership status, and Workspace settings. 4.3. Flow and Content Data For content you create on the Platform, we may process Flow configurations, pages, elements, text, images, videos, forms, field configurations, rules, workflow configurations, integration settings, and API configurations.

5. Flow Responses and Submission Data

Data submitted to Flows created on Flowlange may be processed according to the purposes defined by the Flowlange customer who created the Flow. This data may include, for example, name, surname, email, phone, address, date, time, message, file, selections, survey answers, booking information, and customer information. Flowlange does not predetermine the content of fields defined by the Flow owner. If a Flowlange customer wishes to collect special category or sensitive personal data, the customer is primarily responsible for the lawfulness of collection and for any required notice and consent processes.

6. Files

Files uploaded to the Platform may be stored or processed in Flowlange infrastructure depending on the feature used. Files may be used for Flow content, user uploads, submission attachments, and media content. Access to files is restricted through authorization mechanisms.

7. Technical Data

When you use the Platform, the following technical information may be processed:

IP address
browser type
operating system
device information
language and region preferences
request timestamps
pages accessed
error logs
session information
security logs

This information may be used for security, operating the Service, error detection, performance, and preventing abuse.

8. Authentication and Session Data

To enable secure use of your account, we may process session information, access tokens, refresh tokens, authentication information, and MFA/2FA information. This data is used to prevent unauthorized use of your account and to provide secure session management.

9. Cookies

Flowlange may use cookies and similar technologies necessary for the Service to function. These may include session and authentication cookies, security cookies, preference cookies, analytics technologies, and, where necessary, marketing technologies. Third-party analytics or marketing technologies used may change over time. More detailed information about cookie use is provided in our Cookie Policy.

10. How We Use Personal Data

We may process your personal data for the following purposes: Service delivery: creating and managing your Flowlange account, providing Workspace services, enabling you to create and publish Flows, processing Flow responses, providing API services, and running integrations. Security: preventing unauthorized access, detecting abuse, preventing attacks, applying rate limits, investigating security incidents, and protecting the integrity of the Platform. Billing: managing your subscription, tracking payment status, applying plan and usage limits, processing payments, and communicating about billing. Payment card information may be processed through payment service providers' own systems. Support: responding to support requests, resolving technical issues, and improving user experience. Platform development: detecting errors, analyzing performance, developing new features, and improving service quality. Legal obligations: complying with applicable law, responding to legal requests, resolving disputes, and protecting our legal rights.

11. AI Features

Flowlange may offer AI features to help users create content and experiences. When you use AI features, depending on the feature, we may process prompts you submit, content you provide, selected Flow context, AI-generated outputs, and AI usage information. Some data may be transferred to third-party AI service providers to enable AI features. These transfers are intended to be limited to operating the relevant AI feature and protected with appropriate security measures. AI-generated results may be inaccurate or incomplete. Users should evaluate the accuracy and suitability of AI outputs before relying on them.

12. Third-Party Service Providers

Flowlange may use third-party technology and service providers to deliver the Service. Depending on usage, these may include Cloudflare, Supabase, PostgreSQL infrastructure providers, Upstash, Lemon Squeezy, Resend, AI service providers, Google OAuth, analytics services, and integration providers. Third-party service providers are included only for services actually used. The current provider list and processing purposes may be requested at privacy@flowlange.com.

13. Transfer of Personal Data

Personal data may be transferred to Flowlange service providers for the purpose of delivering the Service. Transfers may occur for technical infrastructure, data storage, authentication, email delivery, payment, AI services, security, analytics, and integrations. If personal data is transferred to service providers outside Türkiye, we aim to carry out transfers in compliance with applicable law. Rules on cross-border transfers of personal data in Türkiye were amended in 2024, and appropriate safeguards and other transfer conditions may apply.

14. Retention of Personal Data

Personal data may be retained for as long as necessary for processing purposes and as required by applicable legal obligations. Retention periods may vary depending on the type of data, the nature of the Service, account status, legal obligations, security requirements, and disputes or legal claims. When data no longer needs to be retained, we aim to delete, destroy, or anonymize it within applicable law and technical capabilities.

15. Account Closure and Data Deletion

If you close your user account, data associated with your account may be deleted or anonymized. However, records that must be retained by law, accounting/billing records, security records, and records related to disputes may be retained for the relevant legal periods. For respondent data collected by a Flow owner, deletion and retention policies may depend on that Flow owner's instructions and responsibilities.

16. Data Security

Flowlange aims to implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, or alteration. Security mechanisms used may include, depending on the relevant part of the Service, access control, role and permission controls, tenant/workspace isolation, API authentication, rate limiting, file access controls, XSS protection, SSRF controls, secure connections, security testing, and audit logs. However, no method of transmission or storage over the internet can be guaranteed to be absolutely secure.

17. Children's Data

Flowlange is not designed as a standalone service directed at children. If personal data relating to children is collected through Flows created by Flowlange customers, the relevant Flow owner, as data controller, should assess its legal obligations. Flowlange does not support unnecessary or unlawful collection of children's personal data.

18. User Responsibilities

Flowlange users are responsible for complying with applicable law regarding personal data they collect or process through the Platform. In particular, users must provide required notices, obtain legally valid consent where required, define appropriate processing purposes, avoid collecting personal data unnecessarily, assess requirements for special category personal data, and respect data subject rights. Flowlange is not responsible for customers fulfilling their legal obligations.

19. Rights Under KVKK (Türkiye)

Under Article 11 of Türkiye's Law No. 6698 on the Protection of Personal Data (KVKK), you may have the following rights where applicable:

to learn whether your personal data is processed
to request information if your personal data has been processed
to learn the purpose of processing and whether data is used accordingly
to know third parties to whom personal data is transferred domestically or abroad
to request correction of incomplete or inaccurate data
to request deletion or destruction of personal data where legal conditions apply
to request notification of correction, deletion, or destruction to third parties to whom data was transferred
to object to a result against you arising solely from automated processing
to request compensation for damage caused by unlawful processing

Under KVKK, notice must be provided as a separate obligation at the time of data collection, and this obligation must still be fulfilled even where explicit consent is obtained.

20. How to Submit Requests

You may send privacy requests or questions to privacy@flowlange.com. We may need to verify your identity when reviewing your request. Depending on the nature of your request, we may ask for additional information or documents.

23. Automated Decision-Making and AI

Flowlange may offer AI-assisted analysis, classification, or recommendations in some features. These features may be used for content creation, classification, recommendations, response analysis, and operational routing. An AI-generated recommendation or classification may be reviewed by a person or subject to predefined business rules, depending on the design of the relevant feature. Flowlange does not guarantee that AI outputs are always accurate, complete, or error-free.

24. Third-Party Websites and Services

The Platform may include links and integrations to third-party services or websites. Those services may have their own privacy policies and terms of use. Flowlange is not responsible for third parties' own data processing practices. Users should review the policies and terms of the relevant third parties.

25. Changes to This Privacy Policy

This Privacy Policy may be updated from time to time. If material changes are made, we aim to inform users through appropriate methods. The Last Updated date at the top of the policy indicates the current version.

26. Contact

For privacy and personal data questions: Flowlange Address: Türkiye Web: https://flowlange.com Privacy: privacy@flowlange.com