Privacy Policy

FlowPilot AI (“FlowPilot”, “we”, “us”) provides a software-as-a-service platform for capturing, managing and following up on sales leads. This policy explains what information we collect when you use our website and web application (the “Service”), how we use it, who we share it with and how you can contact us about it.

It applies to account holders and members of their workspaces, and to people whose details are entered into the Service or submitted through a customer’s public intake form.

Account and authentication data. When you sign up we collect the information needed to create and secure your account, such as your name, email address and sign-in method. Authentication is handled by Clerk, our identity provider, which processes your credentials on our behalf. We do not store your password.

Lead data you enter. The Service exists to store the lead records you and your team create: names, companies, contact details, notes, stages, owners and similar fields. You decide what to enter, and you are responsible for having the right to collect it.

Public intake submissions. Each workspace can publish a public intake form. When a visitor submits it we store the fields they fill in (currently name, work email, company, role and phone) as a new lead in that workspace, together with the time of submission and the fact that it came from the public form.

Workspace data. The Service is multi-tenant: every record belongs to exactly one workspace, and workspaces cannot read each other’s data. We store the workspace name, its settings and the association between the workspace and its members.

Audit and activity records. To give you an accountable history of what happened in your workspace, we record events such as leads being created or updated, approvals being decided and settings being changed, along with who or what performed them and when. Public intake submissions are recorded as coming from the public form, not from a signed-in person.

Billing data. Payments are processed by Stripe. Stripe collects and stores your payment details; we receive confirmation of payment, your subscription status and the billing information Stripe shares with us, such as your name, email and billing country. We do not store your full card number.

Technical data and logs. Like most online services, operating the Service securely involves technical information such as request logs, error reports, browser and device details and network addresses. Some of this is generated by our hosting and infrastructure providers as part of running the platform. We use it to keep the Service running, to diagnose problems and to detect and prevent abuse.

The public intake form is the one part of the Service that accepts input from people who are not signed in, so it is built with specific safeguards:

• Every field is validated on the server before anything is stored.
• A hidden honeypot field and a minimum fill time help reject automated submissions.
• Rate limits per visitor and per workspace prevent floods of submissions.
• For rate limiting, FlowPilot’s Public Intake does not store the visitor’s raw IP address. It derives a keyed hash (HMAC) of the address to count submissions, and the counters are deleted once their time window has passed. The hash cannot be reversed into an address without the server-side key.

This statement is about FlowPilot’s own Public Intake code. Our infrastructure providers may process network addresses in their own logs as part of delivering the Service, as described under “Technical data and logs” above.

We use the information described above to:

• provide, operate and maintain the Service, including storing and displaying your workspace’s leads and activity;
• authenticate you and keep your account and workspace secure;
• detect, prevent and respond to abuse, fraud and security incidents;
• process subscription payments and manage billing;
• respond to your support requests and communicate with you about the Service;
• understand how the Service is used so we can improve its operation and reliability.

We do not run the Service alone. The following providers process information on our behalf, each for the purpose stated and under their own security and privacy commitments:

• Clerk — user authentication and account management.
• Neon (PostgreSQL) — the database where workspace, lead and activity data is stored.
• Vercel — hosting and delivery of the website and application.
• Stripe — payment processing, subscription billing and the customer portal.

We may also disclose information when required by law, to protect the rights, safety or property of FlowPilot, our customers or others, or as part of a business transfer such as a merger or acquisition, in which case this policy will continue to apply to the information transferred.

We do not sell personal information, and we do not share it with third parties for their own marketing purposes. Information is shared only with the providers listed above so that they can help us deliver the Service, and in the limited circumstances described in section 5.

We keep information for as long as it is needed to provide the Service to you and to meet the purposes described in this policy. Lead data remains in your workspace until you remove it from active workspace views. Removing a lead uses a deletion marker rather than immediately erasing the underlying record. Related activity history may be retained to preserve the workspace’s audit trail. For requests concerning retained records or account closure, contact us at support@flowpilotplatform.com. Rate-limit counters from the public intake form are removed automatically once their time window has passed. Billing records are kept for as long as accounting and tax obligations require.

When your account is closed, we will delete or anonymise the information associated with it within a reasonable period, except where we need to keep it to comply with a legal obligation, resolve disputes or enforce our agreements. Copies may persist for a limited time in routine backups before they are overwritten.

We take reasonable technical and organisational measures to protect information against unauthorised access, loss or misuse. These include isolating each workspace’s data, requiring authentication for every action except the public intake form, validating all input on the server, and relying on established providers for identity, database, hosting and payments. No online service can guarantee absolute security, and we do not claim any certification or regulatory compliance that has not been independently validated.

You can view and update your account details from within the Service, and you can edit lead records or remove them from active workspace views at any time. For requests concerning retained or removed records, contact us at support@flowpilotplatform.com. If you want to access, correct or delete personal information we hold about you, close your account, or ask a question about this policy, contact us at the same address. We will respond within a reasonable time and may need to verify your identity before acting on a request.

If your details were submitted to a customer’s workspace through their public intake form, that customer decides how the information is used. You can contact them directly, or contact us and we will help route your request.

We may update this policy as the Service evolves. When a change is material we will give reasonable notice, for example by email or through the Service. The “Last updated” date at the top of this page shows when the current version was published.

Privacy questions and requests can be sent to support@flowpilotplatform.com. Our Terms of Service and Cancellation & Refund Policy are also available.