Privacy Notice

This notice explains what personal data GetFlowing collects, why, who it goes to, how long we keep it and your rights. It covers the getflowing.ai website and the GetFlowing platform (the dashboard, the AI agent and the apps we build and run for you).

1. Who we are

GetFlowing is run by GETFLOWING LTD, a company registered in England and Wales with company number 17383970. We decide how and why your personal data is used, so we are its controller under UK data protection law (the UK GDPR and the Data Protection Act 2018). Contact us about anything in this notice at support@getflowing.ai.

2. What we collect

On the website. If you request early access, your email address and the fact that it came from this website. If you agree to analytics, the visit data described in section 9.

When you use the platform:

• Your account: your name, email address, password (stored only as a one-way hash), passkeys, two-factor settings, and, if you sign in with Google or GitHub, the identifier they give us.
• Your workspace and team: the workspace's name, its members, their roles and the invitations sent.
• Signing in: each sign-in's time, IP address, browser and method, and each failed attempt's time, IP address, browser and the email address tried; and your signed-in sessions (when they started, when they were last used, IP address and browser).
• Billing: your plan and subscription, the billing country and postcode you give at checkout, a business name and VAT number if you give them, and the last four digits, brand and expiry of your card. Stripe collects the card itself; we never see the full number.
• Each purchase: who made it and their email address at the time, the IP address, browser and signed-in session it was made from, what was bought and for how much, the box ticked at checkout with its words, and Stripe's references for the payment.
• What you build: the code we write and hold for you, your messages to the agent and its replies, the work it does, build and deploy logs, and the logs and data of the apps we run for you.
• Usage: the AI credits each piece of work used and who started it, deployments, and the plan limits you reach.
• How the platform is used (product analytics): records of what happens in your account, by id rather than by name or content: for example that an account signed up or signed in (and by which method), a workspace was made, an app was created, a build or deploy started and how it ended, a plan was bought, renewed or cancelled, a payment, refund or dispute and its amount, a plan limit or the AI credits stopped some work, a message was sent to the agent from the dashboard, an assistant, the IDE or Slack (counted, never read), which of our tools an assistant used, a job such as a build ran and how long it took, a preview or the planning workspace was used, a password, two-factor, passkey or session was changed, GitHub was connected or code was pushed or merged, an email was sent to you (its kind, never its content or your address), and each day how many credits a workspace spent and how many apps it has live. Each also carries the workspace's plan and billing status. Each entry of your account's activity record (such as a deploy that fixed itself, a teammate invited or a plan approved) is sent the same way, by its kind alone. Each record carries your account's id, your workspace's id and a coded form of the app's id, and never your name, email address, messages, code or repository names. If you agree to analytics cookies in the dashboard, also the pages you visit there, which of its main controls you use, and recordings of your sessions with every field, all text and the details behind it hidden (section 9).
• Talking to us: what you send to support and our replies.

3. Why we use it, and our lawful bases

Where we rely on legitimate interests, we have weighed them against your rights and kept the data to what the purpose needs. You can object (section 8).

4. AI processing

When you ask the agent for work, the relevant code, your messages and the context it needs are sent to an AI model provider to produce the answer. We use providers whose terms do not let them use that content to train their models: currently OpenAI, Anthropic and Alibaba Cloud (Qwen). We do not use your content to train AI models either.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The agent's work is for you to review, approve and change.

5. Who we share it with

We share personal data only with the companies that help us run GetFlowing, under contracts that require them to protect it and use it only on our instructions:

• Amazon Web Services, which hosts the platform, its databases and the apps we run for you (in the United States);
• Vercel, which hosts the dashboard and this website;
• Stripe, for payments, invoices and tax;
• Resend, for email;
• GitHub, where we store the code of the apps we build for you;
• OpenAI, Anthropic and Alibaba Cloud, for AI work (section 4);
• Cloudflare, for the domain names of GetFlowing and the apps we run;
• PostHog, for product analytics (servers in the European Union): the records of how the platform is used in section 2, and, only if you agree, analytics on the website and in the dashboard;
• Google, for Google Analytics on this website only, and only if you agree.

If you connect your own GitHub, cloud or other accounts, data you send there is handled under those companies' terms.

If you dispute a payment with your card provider, we send them, through Stripe, what shows the payment was yours: the purchase record and the box ticked at checkout, the IP address and browser it came from, your sign-in history and your use of the service.

We may also disclose data where the law requires it, to protect our rights or someone's safety, or to a buyer of our business, who would then be bound by this notice. We do not sell personal data.

6. International transfers

Some of these companies, and our own hosting, are outside the UK, mostly in the United States. Where personal data goes outside the UK, we rely on the UK's adequacy regulations (including the UK-US data bridge for certified US companies) or on the UK International Data Transfer Agreement or Addendum in our contracts with them.

7. How long we keep it

8. Your rights

You have the right to ask for a copy of your personal data, to have it corrected, deleted or restricted, to receive it in a portable form, to object to our use of it, and to withdraw consent where we rely on it. Some rights have limits: for example, we keep payment records for disputes and tax even after an account is deleted, as section 7 says.

To use any of them, email support@getflowing.ai. We will answer within one month. You can delete your account yourself from the dashboard's settings.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

9. Cookies and similar technologies

The dashboard uses cookies that are strictly necessary to keep you signed in and secure. It sets no advertising cookies, and asks before setting any analytics cookie (below).

The website stores your light or dark theme and your answer to the analytics question in your browser, so it can remember them. Neither leaves your device.

Website analytics, only if you agree. If you accept, PostHog (in the European Union) and Google Analytics count visits and see which pages people read. Each stores an identifier as a cookie (PostHog also in your browser's local storage) to recognise the same browser across pages and on a later visit, and records the page address, the page you came from, your approximate location from your IP address, and basic device information such as browser and screen size. PostHog does not keep the IP address itself. Google Analytics also records how far down a page you scroll, the links you follow to other websites, the files you download, the videos on the site you play, when you start or send a form (but not what you type into it), and the terms of any search you make on the site. If you join the waitlist, both are also told that a waitlist form was sent (never the address you gave). Google Analytics runs with Google's advertising storage, ad personalisation and Google signals turned off. Nothing loads until you accept. On the website PostHog does not record your clicks, forms or session, and apart from search terms neither tool records what you type. If your browser sends a Do Not Track or Global Privacy Control signal we load no analytics even if you accepted. Each identifier is limited to this website.

Dashboard analytics, only if you agree. The dashboard asks the same question for itself. If you accept there, PostHog records the pages you visit, as the kind of page with ids taken out, which of its main controls you use (deploying or releasing an app, opening a preview or VS Code, changing an app's tab, following a step of the setup checklist, opening the command palette, and a prompt to upgrade, when it is shown and when it is followed), and recordings of your sessions in which every field you type into, all text on the page and the details behind it (such as link addresses and labels) are hidden, so a recording shows only the layout of a page and where you moved and clicked. Your apps' previews, code, data, variables and logs, and your invoices, are never recorded at all. It keeps neither your IP address nor a location worked out from it. Its identifier is linked to your account's id. You can change your answer at any time in the dashboard's Account settings, as you can here for the website.

Product analytics without cookies. Separately, the platform itself sends PostHog the records of how it is used described in section 2. They set no cookie and read nothing from your browser, so they do not depend on your answer to either question. The website's server also counts each waitlist sign-up in PostHog, as a number alone, with nothing about you or your browser.

10. Your apps' users

If an app we build or run for you collects personal data about its own users, you decide what it collects and why, so you are the controller of that data and we process it on your behalf. Business customers can ask us for our Data Processing Addendum.

11. Children

GetFlowing is not for anyone under 18, and we do not knowingly collect their data.

12. Changes to this notice

We will update this notice when what we do changes, and tell you by email or in the dashboard before a change that matters takes effect.