Skip to content
FLOWPILOTS
Sign in Join early access

Privacy policy

Updated 2026-10-03

The short version: your data stays yours. We never sell it, and we never train any model on it. You approve every action the cockpit takes.

This policy says what FlowPilots collects, why, and the controls you hold.

What FlowPilots collects

  • Account basics: your name, email address, and a hashed password (or your Google identity, where Google sign-in is offered).
  • Two-factor sign-in data: the authenticator secret and recovery codes that verify it is you. They protect your account and are used for nothing else.
  • Your email address if you join the early-access waitlist: stored on its own, with no account, and used to send your invite.
  • What you create in the cockpit: organizations, squadrons, members, invitations, and the brand kits, copy, images and footage you make or upload in StudioFlow.
  • If you use the free scan: a keyed digest of your IP address for the day, to hold the two scans a day limit. Without a server secret it cannot be turned back into the address, and each day's rows are swept away the next day. The scan keeps no result.
  • No payment details: billing has not opened, so nothing can be bought and no checkout runs. This policy will name the payment provider before it does.
  • Your email address, if you join the waitlist. It is kept until you ask us to delete it, and used to tell you when your place opens. If you allowed ad measurement, a hashed form of it, which the platform can match to an account it holds, can also go to an ad platform (Advertising measurement, below).
  • Session cookies that keep you signed in. Ad platform tags run only on the public site, and only if you allow them (Advertising measurement, below).
  • Operational records: server logs and an audit trail of account actions.
  • Error and product telemetry (Sentry, and PostHog on EU Cloud behind a first-party proxy), where we have turned them on.

Connected tools

When you connect a tool, FlowPilots reads only what you authorize. Connectors are read-only wherever the job allows and request the narrowest scope that works. FlowPilots holds tokenized references issued by each provider, never your passwords and never full account or card numbers. Content read from a connected tool is treated as data, never as instructions, and no action that reaches outside the cockpit runs without your in-app approval. Disconnecting a tool purges what it ingested.

Ad accounts (Google Ads, Meta, Amazon Ads, Microsoft Advertising, LinkedIn and TikTok): MediaFlow reads your campaigns, ad groups and ad sets, with their daily spend and delivery figures such as impressions, clicks and conversions. A change - creating a campaign paused, setting a budget, pausing or resuming, or placing an ad from an approved StudioFlow set - runs only on your approval of that one change. Amazon, Microsoft and LinkedIn give FlowPilots no way to end its own access, so when you disconnect one of them FlowPilots purges what it read and tells you where to end the grant on that platform.

Generated creative

StudioFlow writes ad copy on the default EU model and renders images on Gemini through Google Vertex AI's EU region. Footage you upload is cut in a sandbox in Frankfurt, and images and cuts are stored in Frankfurt with the rest of your data. Each generated image records in its metadata that it was made or composed with AI. Nothing generated reaches an ad account until you approve it.

How data is protected

  • Encrypted in transit and at rest.
  • Isolated per organization at the database layer.
  • Nothing from your account or your connected tools is sold, shared for advertising, or used to train any model.

Where your data lives

The path your accounts and messages take through FlowPilots, and the model that reads them, runs in the EU. Recorded as of 3 October 2026; each leg below is a decision of record.

  • The store: Postgres, in Frankfurt.
  • The compute over it: the functions that read your data, in Frankfurt.
  • The model that reads it: an EU inference endpoint, by default. An organization can allow non-EU models in its settings; the model a member then picks decides where a question goes.
  • Generated images and video cuts: Google Vertex AI's EU region, and Frankfurt.
  • Product analytics: EU Cloud, in Frankfurt.

One leg is not ours to place: the tools you connect run where their own providers run them, so FlowPilots does not count that leg as its own. What the cockpit keeps from what it reads is stored in the EU, on the path above.

This promise is scoped on purpose: it covers your accounts, your messages, and the model that reads them. The CRM FlowPilots runs its own sales on is a separate system on an EU portal, held to the same standard, and this promise is not stretched to cover it. Ad measurement on the public site is outside it too: the ad platforms process what their tags receive on their own servers, including in the United States.

Advertising measurement

No ad platform tag runs on this site today. If one is added, this section will name it and nothing will load until you allow it.

Services that process your data

Each receives only what its job needs. On the EU path above:

  • Vercel hosts the app and runs StudioFlow's video cuts, in Frankfurt.
  • Supabase holds the database and your files, in Frankfurt.
  • The default model's provider runs the advisor and StudioFlow's copy, on its EU endpoint.
  • Google Vertex AI renders StudioFlow images from your brand kit and prompts, in its EU region.
  • PostHog receives product analytics, on EU Cloud.

Outside it:

  • Resend delivers account email - email verification, password resets and invitations - so it receives the recipient's address and, for an invitation, the organization's name.
  • Cloudflare Turnstile checks the sign-up, sign-in, password reset, waitlist and scan forms for bots.
  • Sentry receives error reports, where turned on.

Your controls

  • When you connect a tool, you can disconnect it in one click and its ingested data is purged.
  • Write to support@flowpilots.io to see the data we hold about you, correct it, export it, have it deleted, or object to how we use it.
  • Withdraw ad measurement consent at any time with Decline, as easily as you gave it.
  • If you are in the EU or the UK, you can also complain to your data protection authority.

Changes and contact

Changes are posted at this address. Questions and requests go to support@flowpilots.io.