Privacy Policy

This Policy applies to flowpad.ai and related Langware websites, the Flowpad desktop application, optional hosted cloud and collaboration services, application programming interfaces, support, sales, events and other services that link to this Policy (collectively, the "Services").

Flowpad is local-first. Core functionality may operate on a user’s device, in an air-gapped environment, through a customer’s Git environment, on customer-managed infrastructure, or through Langware-hosted cloud services. The data available to Langware depends on the deployment and features selected by the customer or user.

This Policy does not govern personal data that Langware processes solely on behalf of a business customer where the customer determines the purposes and means of processing. That processing is governed by the customer’s agreement with Langware and, where applicable, a Data Processing Addendum. The customer’s own privacy notice applies to its end users and personnel.

• Account and profile data. Examples: Name, business email, role, company, account identifiers, authentication and access information. Typical source: You, your organization or identity provider.
• Commercial data. Examples: Plan, order, billing contact, invoices, payment status and transaction history. Typical source: You, your organization and payment providers.
• Support and communications. Examples: Support requests, emails, survey responses, feedback and meeting records. Typical source: You and your organization.
• Device and technical data. Examples: IP address, browser, operating system, device identifiers, application version, logs, crash reports and security events. Typical source: Your device, browser and the Services.
• Usage data. Examples: Feature use, actions, timestamps, performance, API calls, quotas and diagnostic events. Typical source: The Services.
• Customer content. Examples: Prompts, files, code, session data, skills, workflows, messages, inputs and outputs. Typical source: You or your organization, only as enabled by the selected deployment and features.
• Integration data. Examples: Identifiers, permissions, metadata and content made available through connected services. Typical source: Third-party services authorized by you or your organization.
• Website data. Examples: Cookie identifiers, referral URLs, pages viewed and campaign information. Typical source: Cookies and similar technologies.

The following summary describes the intended data paths. Actual processing may vary based on customer configuration, administrator choices, integrations and future product changes.

• Air-gapped or fully local. Typical Flowpad access: Content remains on the user’s or customer’s systems. Langware does not receive it unless the user separately sends it to support or enables another connected feature.
• Git-based collaboration. Typical Flowpad access: Content is stored in the Git environment selected by the customer. Langware may process limited synchronization, account or event metadata if optional messaging or collaboration features are enabled.
• Customer-hosted or on-premises. Typical Flowpad access: Content remains in customer-controlled infrastructure, subject to the configuration and support access authorized by the customer.
• Langware-hosted cloud. Typical Flowpad access: Authorized content and metadata are processed and stored in Langware’s cloud environment to provide collaboration, delivery, mobile access and related hosted features.

Flowpad may connect to third-party AI model providers or other services selected by the user or customer. Data sent to those providers is governed by the customer’s configuration, the provider’s terms and privacy practices, and any applicable enterprise agreement. Langware does not use customer content to train general-purpose models unless the customer expressly agrees in writing.

• Provide, maintain, secure and support the Services.
• Create and administer accounts, authenticate users and manage permissions.
• Process orders, subscriptions, invoices and payments.
• Operate optional cloud collaboration, synchronization, API and integration features.
• Monitor performance, troubleshoot, prevent abuse and improve reliability and user experience.
• Respond to support, sales and other communications.
• Protect Langware, customers, users and the public; investigate security incidents and enforce agreements.
• Comply with legal obligations and establish, exercise or defend legal claims.
• Send product and marketing communications where permitted, subject to available opt-out rights.
• Create aggregated or de-identified information that does not reasonably identify an individual.

Where the GDPR or UK GDPR applies, Langware relies on one or more of the following legal bases: performance of a contract; legitimate interests in operating, securing, improving and marketing the Services; compliance with legal obligations; protection of vital interests where applicable; and consent where required. A user may withdraw consent at any time without affecting processing completed before withdrawal.

• With our affiliates, including LANGWARE LABS LTD, for product development, service delivery, security, finance, legal, support and administration.
• To hosting, infrastructure, authentication, payment, analytics, communications, support, security and professional service providers acting under appropriate contractual restrictions.
• To third-party services and integrations that a customer or user chooses to connect.
• To customer administrators and authorized collaborators according to account settings and permissions.
• To authorities or other parties where required by law or reasonably necessary to protect rights, safety and security.
• In connection with a merger, financing, acquisition, reorganization or sale of assets, subject to appropriate safeguards.

Langware does not sell personal data for money. If applicable law treats certain advertising or analytics disclosures as a sale or sharing, eligible individuals may exercise the opt-out rights described in Section 11.

Our websites and hosted portals may use strictly necessary cookies and, where enabled, analytics, preference or advertising technologies. Where required, non-essential technologies are not activated until the user makes a choice through the cookie controls. Users can adjust preferences through the cookie settings made available on the relevant site. The desktop application does not use browser cookies for local-only functionality, although it may use local storage, security tokens or diagnostic mechanisms necessary to operate the application.

Personal data may be processed in Israel, the United States, the European Economic Area and other locations where Langware or its service providers operate. Where required, Langware uses recognized transfer mechanisms, such as adequacy decisions, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or other lawful safeguards.

Langware retains personal data only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, satisfy contractual and legal obligations, resolve disputes and enforce agreements. Retention depends on the type of data, deployment model, customer settings, sensitivity, legal requirements and operational need. Customer content processed through hosted services is deleted or returned in accordance with the applicable agreement and documented retention settings. Backups may persist for a limited period until overwritten in the ordinary course.

Langware maintains technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, loss and destruction. These measures are risk-based and may include access controls, encryption, logging, monitoring, secure development, vendor management, incident response and business continuity controls. No system is completely secure, and Langware cannot guarantee absolute security.

Depending on location and applicable law, individuals may have rights to access, review, correct, delete or receive personal data; restrict or object to processing; withdraw consent; opt out of marketing; receive information about disclosures; or lodge a complaint with a supervisory authority. California residents may also have rights to know, correct, delete, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive equal service without unlawful discrimination.

To exercise a right, contact privacy@langware.ai. Langware may verify identity and authority before responding. If Langware processes the relevant data solely for a customer, the request should normally be directed to that customer; Langware will assist the customer as required by contract and law.

Recipients may unsubscribe from marketing emails using the link in the message or by contacting privacy@langware.ai. Langware may continue to send non-promotional service, security, billing and administrative communications where necessary.

The Services are intended for business and professional use and are not directed to children under 18. Langware does not knowingly collect personal data from children through the Services without appropriate authorization. If you believe a child has provided personal data, contact privacy@langware.ai.

Langware may update this Policy from time to time. The current version will be posted with its effective date. Where required by law, Langware will provide additional notice or obtain consent before a material change takes effect.

Langware may offer Flow, Flowpad’s AI-assisted WhatsApp support agent, through Flowpad’s official WhatsApp Business account. Flow is limited to responding to questions about Flowpad, assisting with customer service and support, and routing matters to Langware personnel. Flow is not intended to operate as a general-purpose AI assistant.

Message data. When a person communicates with Flow, Langware may process the person’s WhatsApp phone number, profile or display name, message content, attachments, timestamps, delivery and read status, language, opt-in and opt-out records, linked account or support-ticket identifiers, AI-generated responses, and responses from Langware personnel. This information is processed to provide and document support, secure the service, improve support quality, detect abuse, and comply with law.

Meta and AI processing. Meta and providers supporting the official WhatsApp Business Platform process and transmit messages under their applicable terms and privacy practices. Langware’s authorized AI systems and service providers may process message content to understand requests, generate or suggest responses, classify and route support issues, and detect abuse. Langware personnel may review messages where appropriate to provide support, maintain quality or address safety and security.

Retention. For an active customer, Langware may retain full WhatsApp conversations and files for up to 24 months after the related support ticket is closed. Essential ticket summaries may be retained while needed to provide the Services and for up to 24 months after termination. If the customer terminates the Services, full conversations will be deleted within 12 months after termination or 24 months after ticket closure, whichever occurs first. Langware may retain limited records for longer where necessary for legal or accounting obligations, disputes, security incidents, or proof of consent or opt-out, with restricted access, and will delete or anonymize them when no longer needed.

Opt-in and opt-out. Langware sends WhatsApp support communications after the user initiates a conversation or otherwise opts in, as permitted by law and Meta’s applicable rules. A user may stop future WhatsApp messages by replying STOP or by changing the relevant messaging setting in Flowpad. Opting out may limit Langware’s ability to provide support through WhatsApp but does not prevent the user from using another available support channel.

Deleting your data. A person can ask Langware to delete their WhatsApp conversations and related data by sending DELETE MY DATA to Flow on WhatsApp and filling in the short request form Flow sends, or by emailing privacy@langware.ai. Langware completes verified requests without undue delay and within 30 days, subject to the limited records described under Retention. Meta keeps its own copy of messages under its own terms, which Langware cannot delete. Instructions are also available at flowpad.ai/delete-data.

For additional information about Flowpad’s data architecture and the circumstances in which data remains local or reaches Langware’s cloud, see Where does your data go?.

For privacy questions, requests or complaints, contact:

LANGWARE INC.
1521 Concord Pike Suite 201, Wilmington, Delaware 19803

Email: privacy@langware.ai
Websites: https://flowpad.ai and https://langware.ai

LANGWARE INC. is the primary privacy contact for Flowpad. If an applicable Order Form or separately signed customer agreement expressly identifies LANGWARE LABS LTD as the contracting entity, LANGWARE LABS LTD is the primary contact for that relationship. Each company remains responsible for personal data processing it controls or carries out in accordance with its actual role.