Privacy Policy

1. Introduction

Autoflowly ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered app builder platform.

Controller (Art. 4(7) GDPR): Jules Guilain Kenfack, trading as Autoflowly Software, Bernhardhauser Str. 1/2, 75417 Mühlacker, Germany · privacy@autoflowly.com. See the Impressum.

This policy applies to all information collected through our website, application, and related services (collectively, the "Service"). Please read this policy carefully to understand our practices regarding your personal data.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, password, and profile details
• Business Information: Company name, industry, business goals, and startup ideas
• Communication Data: Messages with AI agents, support tickets, and feedback
• Payment Information: Billing details, subscription plans (processed by secure third-party providers)
• User Content: Projects, documents, code, and other materials you create or upload

2.2 Information Collected Automatically

• Usage Data: Features used, AI interactions, time spent, and actions taken
• Device Information: IP address, browser type, operating system, device identifiers
• Analytics Data: Performance metrics, error reports, and usage patterns
• Cookies and Tracking: Essential cookies always; analytics and marketing cookies only after you consent in the cookie banner (see section 16). Until you decide, no analytics or marketing script is loaded.

2.3 Information from Third Parties

• OAuth Providers: Profile information from Google, GitHub, or LinkedIn when you use social login
• Integration Partners: Data from connected services you authorize
• Public Sources: Publicly available business information to enhance our services

3. How We Use Your Information

We use collected information for the following purposes:

3.1 Service Provision

• Create and manage your account
• Provide AI-powered MVP generation and recommendations
• Process transactions and manage subscriptions
• Generate insights and analytics for your business
• Enable collaboration and project management features

3.2 Service Improvement

• Analyze usage patterns to enhance features
• We never use the content of your apps (the data your business and its customers enter), the files you upload or your messages to train AI models — neither our own nor any provider's
• Develop new features and services
• Conduct research and analytics

3.3 Communication

• Send service updates and notifications
• Respond to support requests
• Provide marketing communications (with your consent)
• Send security alerts and account notifications

4. Data Sharing and Disclosure

We do not sell your personal information. We may share your data in these circumstances:

4.1 Service Providers (processors, Art. 28 GDPR)

We share data only with the providers below, each bound by a data processing agreement. Where a provider is outside the EU/EEA, the transfer safeguard is stated (section 8).

Fonts are self-hosted; no request is made to Google Fonts.

4.2 Legal Requirements

We may disclose information when required by law or to:

• Comply with legal obligations or court orders
• Protect our rights, property, or safety
• Prevent fraud or security issues
• Enforce our Terms of Service

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the successor entity, subject to the same privacy protections.

5. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit (TLS/SSL) and at rest
• Secure authentication with JWT and bcrypt password hashing
• Rate limiting and DDoS protection
• Regular security audits
• Kubernetes pod-level isolation for generated MVPs
• Incident response procedures

6. Your Rights and Choices

6.1 Access and Control

You have the right to:

• Access your personal information
• Correct inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Object to certain data processing
• Withdraw consent for optional data uses

6.2 Communication Preferences

You can manage your communication preferences by:

• Updating notification settings in your account
• Unsubscribing from marketing emails
• Adjusting cookie preferences in your browser

6.3 Account Deletion

You can request account deletion at any time. We will delete or anonymize your personal data, except where retention is required for legal or legitimate business purposes.

7. Data Retention

We retain your information based on the following criteria:

• Active Accounts: Data retained while account is active
• Deleted Accounts: Personal data deleted within 30 days of your request (at once when you delete your account in Settings); security logs keep the IP address, without your name or e-mail, for 12 months; invoices are kept 10 years (tax law)
• Legal Requirements: Some data retained as required by law
• Anonymized Data: May be retained indefinitely for analytics
• Backups: Deleted from backups within 30 days (daily backups, kept 30 days)
• Flo chats on autoflowly.com (no account): deleted after 6 months, or after 2 years if you left your e-mail to be contacted — or at once with the bin icon in the chat
• Flo feedback notes (feature requests, complaints, a competitor you named): 12 months

8. International Data Transfers

Your Autoflowly account and the builder run on our servers in the USA (IONOS data centre, Kansas City). The app of a business based in the EU/EEA, the United Kingdom or Switzerland — with its database and files — runs on our servers in Germany (Berlin, or Frankfurt when Berlin has no room). Only if neither German server has room when the app is created is it placed in the USA; you can ask us at any time to move it. Apps created before 15 October 2026 are moved to Germany on request. Some providers in section 4.1 process data in the USA. For each of them the transfer rests on the EU–US Data Privacy Framework (adequacy decision of 10 July 2023, Art. 45 GDPR) where the provider is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) with supplementary measures. You can request a copy of the safeguards at privacy@autoflowly.com.

9. GDPR Compliance (EU Users)

For users in the European Union, we comply with GDPR requirements:

9.1 Legal Basis for Processing

9.2 Your Rights and the Supervisory Authority

You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection (Art. 21) and may withdraw any consent at any time with effect for the future (Art. 7(3)). Data export and account deletion are available in Settings or by e-mail to privacy@autoflowly.com.

You have the right to lodge a complaint with a supervisory authority. The authority responsible for us is Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, baden-wuerttemberg.datenschutz.de.

9.3 Your customers' data (Art. 28)

For the apps we build and host for you, you are the controller of your customers' data and Autoflowly is your processor. Each generated app ships an Impressum and privacy page you configure in its dashboard, and a data processing agreement is available on request.

10. California Privacy Rights (CCPA)

California residents have specific rights under the CCPA:

• Right to know what personal information we collect
• Right to delete personal information
• Right to opt-out of data sales (we do not sell data)
• Right to non-discrimination for exercising privacy rights

11. Children's Privacy

Our Service is not directed to individuals under 16. We do not knowingly collect personal information from children. If we learn we have collected information from a child under 16, we will delete it promptly.

12. AI and Machine Learning

Our AI features are provided by Anthropic (primary), with OpenAI and Google Gemini as fallbacks (section 4.1). What you type into the builder, the agent chat and the files you upload to agents are sent to these providers under API terms that exclude training on your data:

• AI processing occurs within secure, isolated environments
• We do not use your data to train models for other users
• You can request AI-generated content about your projects be deleted
• AI decisions can be reviewed by human support staff

12.1 Flo, the support assistant in the app

When you chat with Flo, your messages and its answers are stored with your account so the conversation can continue and the team can help when you ask for a person. Passwords, API keys, card numbers and IBANs you paste are removed before anything is stored or sent to the AI model. To improve Autoflowly, Flo keeps short notes of feature requests, complaints, price objections and a competitor you mention (at most 300 characters, the same secrets removed) for 12 months. Legal basis: Art. 6(1)(b) GDPR for support, Art. 6(1)(f) for improving the product. Your Flo conversations and notes are part of your data export and are erased with your account.

12.2 Flo on autoflowly.com (visitors without an account)

Only after you send a first message, Flo keeps a random visitor id and a copy of the conversation in your browser (local storage af-flo) so the conversation can continue. On our servers we store the conversation, the page and referrer you came from, your language and tags such as your trade — linked only to a hash of the visitor id, never to your IP address. E-mail addresses and phone numbers typed into the chat are removed before storage. If you leave your e-mail in the form and tick the box, we keep it to reply about your request (Art. 6(1)(a) GDPR, withdrawable at any time); the chat itself rests on Art. 6(1)(f) — answering the question you asked. You can delete all your Flo chats, including any e-mail you left, at any time with the bin icon in the chat; otherwise they are deleted after 6 months, or 2 years if you left your e-mail. Messages are answered by the AI providers in section 4.1.

12.3 No solely automated decisions

Autoflowly takes no decisions based solely on automated processing that produce legal or similarly significant effects on you (Art. 22 GDPR). Our AI prepares work and answers questions; actions that touch money or a business's customers wait for a person's approval, except automatic replies an owner switches on, which say they come from an AI. Details: AI transparency.

13. Mobile App Permissions and Data Collection

Our Autoflowly mobile app requests specific permissions to provide enhanced functionality. Here's what each permission is used for:

13.1 Camera Permission (android.permission.CAMERA)

• Purpose: Used exclusively for scanning QR codes to quickly share and access your created MVPs
• Data Storage: We do not store any photos, videos, or camera data. All QR code scanning is processed locally on your device
• User Control: This permission is optional. You can deny camera access and still use all other app features without any limitations
• Privacy Protection: No visual data leaves your device through this permission

13.2 Internet Permission (android.permission.INTERNET)

• Purpose: Essential for communicating with our AI servers to generate MVPs and sync your projects
• Data Transmitted: Project descriptions, user authentication tokens, generated app code
• Security: All data transmission uses HTTPS encryption

13.3 Network State Permission (android.permission.ACCESS_NETWORK_STATE)

• Purpose: To check internet connectivity and provide offline functionality when needed
• Data Collected: Network connection status only (connected/disconnected)
• Privacy Impact: No personal or location data collected through this permission

13.4 Record Audio Permission (android.permission.RECORD_AUDIO)

• Purpose: Enables voice input for describing your app ideas to our AI assistant
• Data Processing: Audio is processed in real-time for speech-to-text conversion and not permanently stored
• User Control: Voice input is completely optional. Text input is always available as an alternative
• Data Retention: Voice data is not saved or transmitted to our servers

13.5 Wake Lock Permission (android.permission.WAKE_LOCK)

• Purpose: Prevents your device from sleeping during AI processing to ensure uninterrupted app generation
• Privacy Impact: This permission does not access or collect any personal data
• Battery Consideration: Used sparingly and only during active AI processing

13.6 Mobile App Data Collection Summary

Data We Collect Through the Mobile App:

• Account information (email, name, profile picture when you create an account)
• Project data (MVP descriptions, generated code, app configurations)
• Chat history with our AI assistant for app generation
• Usage analytics (features used, session duration, crash reports for improvement)
• Device information (model, OS version, app version for compatibility)

Data We DO NOT Collect:

• Photos or videos from your camera
• Audio recordings or voice data
• Location information
• Contact lists or phone numbers
• Text messages or call logs
• Other apps on your device

13.7 Third-Party AI Processing

When using our mobile app, your project descriptions may be processed by:

• OpenAI: For advanced AI-powered app generation (subject to OpenAI's privacy policy)
• Anthropic (Claude): For AI assistant functionality (subject to Anthropic's privacy policy)
• Data Protection: Your personal project data is not used to train these AI models
• Secure Transmission: All AI processing requests are encrypted and transmitted securely

13.8 Mobile App Security

We implement additional security measures for our mobile app:

• Local data encryption on your device
• Secure token-based authentication
• Automatic logout for inactive sessions
• Regular security updates through app stores
• Biometric authentication support (when available on your device)

13.9 Google Play Store Compliance

Our app complies with Google Play Store policies regarding:

• Transparent permission requests with clear explanations
• Minimal data collection necessary for app functionality
• Secure handling of sensitive permissions like camera and microphone
• User control over optional features and permissions
• Regular security audits and updates

13.10 Managing Mobile App Permissions

You can manage app permissions at any time:

• Android Settings: Go to Settings > Apps > Autoflowly > Permissions
• In-App Settings: Access permission controls within the app's settings menu
• Granular Control: Enable or disable individual permissions based on your preferences
• No Feature Loss: Core app functionality remains available even with restricted permissions

14. Updates to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by:

• Posting the updated policy with a new "Last updated" date
• Sending email notifications for significant changes
• Displaying in-app notifications

15. Contact Us

For privacy-related questions or to exercise your rights, contact us at:

We aim to respond to all privacy requests within 30 days.

16. Cookie Policy

When you first visit, a banner asks for your choice. "Essentials only" and "Accept all" are equally easy; "Settings" lets you pick analytics and marketing separately. Until you decide, no analytics or marketing script is loaded at all. You can change or withdraw your choice at any time via Cookie settings in the footer.

You can also delete cookies in your browser at any time. Disabling essential storage may affect login and language selection.