Privacy

Who handles your data

Ilia Kustov PR, Serbia, operates flowlensgram and is responsible for the personal data described here. Contact details appear in the Operator contacts section at the end of this notice. This notice covers the website, account, IDE extension, support and optional AI and analytics.

Accounts, security and local diagrams

We process your email, display name, profile image where provided, authentication records and session identifiers to provide the account you request. Authentication may include the Google or GitHub provider you choose. Session IP addresses, device information and limited technical records support account security, abuse prevention and reliability. The basis is performance of the service contract for account functions and our legitimate interests for proportionate security measures.

Your diagram library, source, saved AI results and editor preferences remain in your browser or IDE storage until you delete them or clear that storage. Rendering, editing and export run on your device. Rejecting analytics does not delete your diagrams or prevent these functions. We do not use diagram text for product analytics.

AI runs only when you request it

When you submit an AI request, we send the selected diagram source, including comments and unsaved changes, its structured representation, your instructions and language to our server and OpenAI. The source may contain personal data; remove unnecessary personal, confidential or sensitive information and only send material you are authorized to share. This processing performs the AI operation you request and is separate from optional analytics consent.

The OpenAI Agents API currently processes and stores session content in the United States and is not eligible for Zero Data Retention. We request session deletion after completing or cancelling processing and retry unresolved cleanup. A successful application response is not proof that every provider copy has already been removed. OpenAI may retain abuse-monitoring records for up to 30 days, or longer when legally required, under its data controls. API content is not used to train models by default.

We keep minimal job identifiers, usage, charges and cleanup status to avoid duplicate charges and resolve failures. Settled technical job metadata is removed after seven days from its last update once usage and provider cleanup are resolved. Unresolved jobs remain until reconciliation; any separate billing record follows the payment rules below. Local saved results are yours to remove.

Payments, support and their legal bases

Polar is the Merchant of Record for purchases. It receives the checkout and payment information needed to sell the subscription or credits. We keep customer, checkout, order and subscription references, payment status, credit history, and the version and time of acceptance of purchase terms. We do not store card details. Contract performance supports purchases and account billing; specific accounting, tax or other legal duties can require limited records after account deletion.

We store your name, reply email, message and delivery status to respond to support or privacy requests. Resend delivers authentication emails and support notifications; the support mailbox is the operator’s Google Gmail account. Information sent by email is consequently also processed by Google. Ordinary support is based on providing the requested assistance and our legitimate interests in resolving problems; rights requests are handled to comply with applicable data-protection duties. Do not include unnecessary sensitive information.

Delivered support messages are removed from the application database after 365 days from delivery, except records kept to resolve a documented dispute or legal obligation. Copies in the email provider and support mailbox are handled separately when reviewing a deletion request. Privacy cases are removed 365 days after closure; a case is not closed as erased until the relevant systems and retained exceptions have been reviewed.

Optional product analytics

Analytics is optional and based on your consent. Until you explicitly allow it, or after refusal or withdrawal, we do not collect optional product events. Ignoring the banner, using the editor, signing in or buying a plan does not grant consent. Refusal does not restrict the service. Collection requires configured consent, withdrawal and deletion-request controls. Stored history is considered erased only after completion has been verified; unresolved deletion is kept under review.

When enabled, limited allowlisted interactions with the editor, sign-in, plans and AI features, page categories and coarse technical outcomes are associated with a random identifier separate from your account. PostHog keeps a minimal technical profile under this identifier from the first consented event so linked history can be targeted for deletion. Profiles are not linked to accounts or merged across consent periods; renewed consent uses a new identifier. These are pseudonymous data, not a promise of irreversible anonymity. After consent we also measure fixed page categories, page duration and tab-scoped visits. Visits expire after 30 minutes without a tracked event or 24 hours at most. We collect only validated utm_source, utm_medium and utm_campaign labels of up to 64 ASCII letters, digits, hyphens or underscores; do not put personal data in these labels. The first valid labels are kept for the tab visit and attached to its events. We do not include diagram content or names, email, account identifiers, full URLs, referrers, advertising click IDs, user agents, screen recordings or other URL parameters.

Events go through our server to the EU PostHog service. Our server receives the network information needed to deliver and secure a request; it does not forward your IP address to PostHog. We do not use advertising trackers, session recording or fingerprinting for this analytics purpose.

Refusal, withdrawal and deletion of analytics

Your choice lasts 180 days in this browser and on this website origin. Use Privacy settings to refuse or withdraw as easily as you allowed analytics. Other browsers or devices have their own choice. An expired or incompatible notice version cannot authorize new collection. If a choice cannot be saved, analytics stays off in the current tab and the interface explains the problem. If you are offline and the browser cannot preserve the choice, it may be lost when you close the tab; check Privacy settings when you return or contact us.

Withdrawal immediately stops new product events in the current tab and attempts to save the refusal and submit a request to delete the linked analytics history. Expiry also queues deletion. A queued or processing status is not confirmation of erasure: provider deletion requires verified completion, including a follow-up check for late-arriving events. If delivery or deletion fails, the interface shows an unresolved status. If the browser cannot save it, contact us before closing the tab.

New analytics identifiers are limited to a 180-day consent period; the history is scheduled for deletion when consent expires or is withdrawn. The deletion process includes at least 24 hours for late-arriving events before final verification. We schedule minimal consent receipts and deletion evidence for removal 180 days after confirmed completion, once the backup lifecycle has been verified so restoring an older copy cannot undo deletion. Until that check is complete, we retain the evidence needed to preserve the deletion. Unresolved requests retain the minimum identifiers needed to finish deletion. After proof is removed, its status may be unavailable; an unavailable status does not confirm deletion. Previously collected history and missing browser identifiers can require a separate privacy request; we will explain what can be located.

Providers and international processing

Our application and database are hosted using Hetzner infrastructure. OpenAI processes requested AI content; PostHog EU processes consented analytics; Resend delivers email; Google processes the support mailbox and, if chosen, Google sign-in; GitHub processes GitHub sign-in. Polar processes purchases and its own payment, tax, fraud-prevention and legal records. A provider may be a processor for one activity and an independent controller for another.

OpenAI Agents content and Resend email data are processed in the United States. Selecting a European Resend sending region does not move its stored message data to the EU. Resend states 30-day email/log retention for its Free, Pro and Scale plans, seven-day backups and separate procedures for earlier deletion. Polar and its suppliers may process data in the US and other countries; payment records can remain for legal purposes.

OpenAI, Resend and Polar include data-processing agreements in their applicable service terms, with transfer clauses where specified. Separate account-specific agreements, including Hetzner and PostHog, require verification; links to public terms do not confirm acceptance. Optional analytics requires your consent and configured withdrawal and deletion-request controls. Pending deletion is monitored and is not reported as complete until provider erasure has been verified. The support mailbox is personal Gmail under Google’s consumer terms, not a Google Workspace business account. EU hosting alone does not keep all processing in the EU. You may ask us about recipients and the safeguards confirmed for your data.

Regional availability

In the EU/EEA, including Iceland, Liechtenstein, Norway and the covered EU territories, we offer the local editor without new account registration, AI or purchases. Optional product and website analytics is available only after your explicit consent; refusing or withdrawing consent leaves the editor available. In Russia, Belarus and when the region cannot be verified, the local editor remains available with product analytics, new registration, AI and purchases disabled. The United Kingdom, Switzerland and Serbia are outside this launch restriction.

AI credits and Personal additionally require eligibility under both OpenAI’s supported countries and territorial exceptions and Polar’s payment rules; Polar also excludes Cuba, Iran, North Korea and Syria. These are rules based on verified service location, not language or citizenship.

Local editing, rendering and export remain available. Existing users can sign in to manage their existing data, privacy requests, account deletion and subscription cancellation; support is also available. Necessary hosting and security records and information you submit for these purposes are still processed under this notice. If the region is identified incorrectly, contact support for review. We do not request precise device location for this check.

Account deletion, backups and retained exceptions

Deleting an account first stops future subscription billing and then removes active account data. Local diagrams are not remotely deleted: you control them on your device. Deleting the account does not by itself confirm deletion of every support email, provider record or backup. You can request a review covering those systems through the privacy-request form.

Limited records may remain where a specific legal obligation, an unresolved payment or dispute, security investigation, or unfinished deletion requires them. We identify the relevant category, reason and retention criterion in our response. Retained data is restricted to that purpose; it is not reused for product analytics. Backups and manual recovery copies have a separate lifecycle and must be reviewed before an erasure request is closed; restoring a backup must reapply confirmed deletions before normal use resumes.

Your rights and how to contact us

You may request access, correction, deletion, restriction or portability where applicable, object to processing based on legitimate interests, and withdraw consent without affecting the lawfulness of prior consented processing. We do not make solely automated decisions that produce legal or similarly significant effects through product analytics.

Use the privacy-request form or email the operator. You can submit a request without signing in; we may ask for proportionate information to verify authority before disclosing or deleting account information. You do not need to accept analytics or new purchase terms to exercise rights. We ordinarily respond within one month and explain any lawful extension or retained exception.

You may complain to the Commissioner for Information of Public Importance and Personal Data Protection of Serbia, or another competent data-protection authority. Material changes to optional analytics purposes or recipients require a new informed choice before that collection starts.

Cookies and local storage

Refusing analytics preserves necessary sign-in, choice and functional storage for the features you use. Clearing all browser data may delete your local diagrams; use Privacy settings to withdraw analytics consent.

Provider policies and requests

Request access, export or deletion · Support and region review · Serbian Commissioner

• OpenAI — data controls · DPA · Supported countries
• PostHog — privacy · DPA
• Resend — processing and retention · DPA
• Polar — privacy · DPA · Payment availability
• Hetzner · Google · GitHub

Sign-in and payment sites have their own provider notices. Your flowlensgram analytics choice does not change settings on those domains.