Privacy Policy

1. Introduction

FlowCastle ("we", "us", "our") operates the flowcastle.ai website. This Privacy Policy explains how we collect, use, and protect your personal information when you visit our website or create an account.

2. Information We Collect

Information you provide

• Email address — when you create an account or contact us

Information collected automatically

• Analytics and session replay data — we use PostHog to understand website usage, including pages visited, clicks, rough device/browser/location data, referrer and campaign data, and privacy-masked session replay recordings. We mask form inputs and do not intentionally record passwords, tokens, or payment data.
• Language preference — stored in your browser's local storage

3. How We Use Your Information

• To support account creation and onboarding
• To send occasional product updates (you can unsubscribe at any time)
• To improve our website and user experience
• To review new accounts for failures, so we can fix defects and improve quality

A small number of authorised people at FlowCastle may access your account — including the flows you have built, your conversations with the AI assistant, and the related build and error logs — in order to diagnose failures and fix defects. Where something we shipped has broken your workspace, we may repair it directly, and we will tell you when we do. This access is strictly limited to those purposes: we never use what we see for advertising, profiling, or marketing. If you are in the EEA or the UK, our legal basis is our legitimate interest in providing a reliable service and in correcting our own errors (Article 6(1)(f) GDPR). You can object at any time — see “Your Rights”.

4. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We may share data with:

• PostHog — for product analytics and privacy-masked session replay (governed by PostHog's Privacy Policy)
• Service providers — who help us operate the website, account flows, email delivery, and hosting, bound by confidentiality agreements
• Law enforcement and safety bodies — if we receive an abuse report or learn that a bot may be sending illegal content, we may inspect the related messages and media, preserve them, and disclose them to law enforcement, courts, or child-protection hotlines

5. Data Retention

We retain your account and contact data for as long as necessary to fulfill the purposes described above. You may request deletion of your data at any time by contacting us.

6. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Request correction or deletion of your data
• Withdraw consent for data processing
• Request a copy of your data in a portable format

To exercise any of these rights, contact us at the email below.

7. Cookies & Local Storage

We use PostHog cookies and local storage for product analytics and privacy-masked session replay. We also store your language preference in browser local storage. We do not use advertising cookies or sell personal data.

8. Security

We implement appropriate technical and organizational measures to protect your personal data. However, no method of transmission over the Internet is 100% secure.

9. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated date. Continued use of the website constitutes acceptance of any changes.

10. Contact Us

If you have questions about this Privacy Policy or want to exercise your data rights, contact us at:

contact@flowcastle.ai