1. Introduction
Autoflowly ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered app builder platform.
Controller (Art. 4(7) GDPR): Jules Guilain Kenfack, trading as Autoflowly Software, Bernhardhauser Str. 1/2, 75417 Mühlacker, Germany · privacy@autoflowly.com. See the Impressum.
This policy applies to all information collected through our website, application, and related services (collectively, the "Service"). Please read this policy carefully to understand our practices regarding your personal data.
2. Information We Collect
2.1 Information You Provide
- Account Information: Name, email address, password, and profile details
- Business Information: Company name, industry, business goals, and startup ideas
- Communication Data: Messages with AI agents, support tickets, and feedback
- Payment Information: Billing details, subscription plans (processed by secure third-party providers)
- User Content: Projects, documents, code, and other materials you create or upload
2.2 Information Collected Automatically
- Usage Data: Features used, AI interactions, time spent, and actions taken
- Device Information: IP address, browser type, operating system, device identifiers
- Analytics Data: Performance metrics, error reports, and usage patterns
- Cookies and Tracking: Essential cookies always; analytics and marketing cookies only after you consent in the cookie banner (see section 16). Until you decide, no analytics or marketing script is loaded.
2.3 Information from Third Parties
- OAuth Providers: Profile information from Google, GitHub, or LinkedIn when you use social login
- Integration Partners: Data from connected services you authorize
- Public Sources: Publicly available business information to enhance our services
3. How We Use Your Information
We use collected information for the following purposes:
3.1 Service Provision
- Create and manage your account
- Provide AI-powered MVP generation and recommendations
- Process transactions and manage subscriptions
- Generate insights and analytics for your business
- Enable collaboration and project management features
3.2 Service Improvement
- Analyze usage patterns to enhance features
- Train and improve AI models (using anonymized data)
- Develop new features and services
- Conduct research and analytics
3.3 Communication
- Send service updates and notifications
- Respond to support requests
- Provide marketing communications (with your consent)
- Send security alerts and account notifications
4. Data Sharing and Disclosure
We do not sell your personal information. We may share your data in these circumstances:
4.1 Service Providers (processors, Art. 28 GDPR)
We share data only with the providers below, each bound by a data processing agreement. Where a provider is outside the EU/EEA, the transfer safeguard is stated (section 8).
| Provider | Purpose | Data | Location / safeguard |
|---|---|---|---|
| Own servers (VPS, Kubernetes) | Hosting of the platform, your account and the apps generated for you | All account and app data | Germany / EU |
| Anthropic, PBC | AI model that generates apps, answers in the builder and powers AI agents | Prompts and content you submit, incl. business data in your app | USA — EU–US Data Privacy Framework and SCCs; no training on your data |
| OpenAI, L.L.C. | Fallback AI model for the same purposes | Same as above | USA — DPF and SCCs; no training on your data |
| Google LLC (Gemini) | Fallback AI model | Same as above | USA — DPF and SCCs |
| Stripe Payments Europe, Ltd. | Subscription payments | Name, e-mail, billing and payment details | Ireland; sub-processors in the USA under DPF/SCCs |
| Resend, Inc. | Transactional and (with consent) marketing e-mail | Name, e-mail address, message content | USA — DPF and SCCs |
| Google LLC — Google Analytics 4 and Tag Manager | Reach and campaign measurement | Pseudonymous client id, pages, events; a hashed account id for signup attribution | USA — DPF; only with your consent |
| Meta Platforms Ireland Ltd. (Meta Pixel) | Advertising measurement | Pseudonymous browser id, pages | Ireland / USA — DPF; only with your consent |
| TikTok Technology Ltd. (TikTok Pixel) | Advertising measurement on the homepage | Pseudonymous browser id, pages | Ireland / third countries — SCCs; only with your consent |
| Google LLC, GitHub Inc., Apple Inc., LinkedIn | Social login, only when you choose it | Name, e-mail, provider user id | USA — DPF / SCCs |
| Expo (650 Industries, Inc.) and Google Firebase | Push notifications for the mobile app | Device push token | USA — DPF / SCCs |
| Amazon Web Services EMEA SARL (S3) | Storage of files you upload to AI agents and build caches | Uploaded files | EU region |
| Cloudflare, Inc. | DNS / CDN for custom domains you connect | IP addresses, DNS records | USA — DPF |
Fonts are self-hosted; no request is made to Google Fonts.
4.2 Legal Requirements
We may disclose information when required by law or to:
- Comply with legal obligations or court orders
- Protect our rights, property, or safety
- Prevent fraud or security issues
- Enforce our Terms of Service
4.3 Business Transfers
In the event of a merger, acquisition, or sale of assets, your information may be transferred to the successor entity, subject to the same privacy protections.
5. Data Security
We implement industry-standard security measures to protect your data:
- Encryption in transit (TLS/SSL) and at rest
- Secure authentication with JWT and bcrypt password hashing
- Rate limiting and DDoS protection
- Regular security audits
- Kubernetes pod-level isolation for generated MVPs
- Incident response procedures
6. Your Rights and Choices
6.1 Access and Control
You have the right to:
- Access your personal information
- Correct inaccurate data
- Request deletion of your data
- Export your data in a portable format
- Object to certain data processing
- Withdraw consent for optional data uses
6.2 Communication Preferences
You can manage your communication preferences by:
- Updating notification settings in your account
- Unsubscribing from marketing emails
- Adjusting cookie preferences in your browser
6.3 Account Deletion
You can request account deletion at any time. We will delete or anonymize your personal data, except where retention is required for legal or legitimate business purposes.
7. Data Retention
We retain your information based on the following criteria:
- Active Accounts: Data retained while account is active
- Deleted Accounts: Personal data deleted within 90 days
- Legal Requirements: Some data retained as required by law
- Anonymized Data: May be retained indefinitely for analytics
- Backups: Deleted from backups within 180 days
8. International Data Transfers
The platform and your data are hosted in Germany. Some providers in section 4.1 process data in the USA. For each of them the transfer rests on the EU–US Data Privacy Framework (adequacy decision of 10 July 2023, Art. 45 GDPR) where the provider is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) with supplementary measures. You can request a copy of the safeguards at privacy@autoflowly.com.
9. GDPR Compliance (EU Users)
For users in the European Union, we comply with GDPR requirements:
9.1 Legal Basis for Processing
| Purpose | Legal basis | Retention |
|---|---|---|
| Account, login, building and hosting your apps, support | Art. 6(1)(b) — contract | Life of the account, then deleted within 30 days |
| Payments and invoices | Art. 6(1)(b) and (c) — contract, tax law (§ 147 AO, § 14b UStG) | 10 years (invoices) |
| Transactional e-mail (verification, receipts, approvals, security) | Art. 6(1)(b) | Delivery log 90 days |
| Marketing e-mail and onboarding tips | Art. 6(1)(a) — consent, revocable in every mail and in Settings | Until you withdraw |
| Analytics and advertising cookies | Art. 6(1)(a) GDPR and § 25(1) TTDSG — consent in the cookie banner | See section 16 |
| Security logs (IP address, user agent, login events) | Art. 6(1)(f) — legitimate interest in abuse prevention | 12 months |
| Activity and audit events inside your apps | Art. 6(1)(b) | 180 days, then aggregated |
| Campaign attribution at signup (UTM parameters, hashed GA client id) | Art. 6(1)(a) — only when marketing cookies were accepted | Life of the account |
9.2 Your Rights and the Supervisory Authority
You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection (Art. 21) and may withdraw any consent at any time with effect for the future (Art. 7(3)). Data export and account deletion are available in Settings or by e-mail to privacy@autoflowly.com.
You have the right to lodge a complaint with a supervisory authority. The authority responsible for us is Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, baden-wuerttemberg.datenschutz.de.
9.3 Your customers' data (Art. 28)
For the apps we build and host for you, you are the controller of your customers' data and Autoflowly is your processor. Each generated app ships an Impressum and privacy page you configure in its dashboard, and a data processing agreement is available on request.
10. California Privacy Rights (CCPA)
California residents have specific rights under the CCPA:
- Right to know what personal information we collect
- Right to delete personal information
- Right to opt-out of data sales (we do not sell data)
- Right to non-discrimination for exercising privacy rights
11. Children's Privacy
Our Service is not directed to individuals under 16. We do not knowingly collect personal information from children. If we learn we have collected information from a child under 16, we will delete it promptly.
12. AI and Machine Learning
Our AI features are provided by Anthropic (primary), with OpenAI and Google Gemini as fallbacks (section 4.1). What you type into the builder, the agent chat and the files you upload to agents are sent to these providers under API terms that exclude training on your data:
- AI processing occurs within secure, isolated environments
- We do not use your data to train models for other users
- You can request AI-generated content about your projects be deleted
- AI decisions can be reviewed by human support staff
13. Mobile App Permissions and Data Collection
Our Autoflowly mobile app requests specific permissions to provide enhanced functionality. Here's what each permission is used for:
13.1 Camera Permission (android.permission.CAMERA)
- Purpose: Used exclusively for scanning QR codes to quickly share and access your created MVPs
- Data Storage: We do not store any photos, videos, or camera data. All QR code scanning is processed locally on your device
- User Control: This permission is optional. You can deny camera access and still use all other app features without any limitations
- Privacy Protection: No visual data leaves your device through this permission
13.2 Internet Permission (android.permission.INTERNET)
- Purpose: Essential for communicating with our AI servers to generate MVPs and sync your projects
- Data Transmitted: Project descriptions, user authentication tokens, generated app code
- Security: All data transmission uses HTTPS encryption
13.3 Network State Permission (android.permission.ACCESS_NETWORK_STATE)
- Purpose: To check internet connectivity and provide offline functionality when needed
- Data Collected: Network connection status only (connected/disconnected)
- Privacy Impact: No personal or location data collected through this permission
13.4 Record Audio Permission (android.permission.RECORD_AUDIO)
- Purpose: Enables voice input for describing your app ideas to our AI assistant
- Data Processing: Audio is processed in real-time for speech-to-text conversion and not permanently stored
- User Control: Voice input is completely optional. Text input is always available as an alternative
- Data Retention: Voice data is not saved or transmitted to our servers
13.5 Wake Lock Permission (android.permission.WAKE_LOCK)
- Purpose: Prevents your device from sleeping during AI processing to ensure uninterrupted app generation
- Privacy Impact: This permission does not access or collect any personal data
- Battery Consideration: Used sparingly and only during active AI processing
13.6 Mobile App Data Collection Summary
Data We Collect Through the Mobile App:
- Account information (email, name, profile picture when you create an account)
- Project data (MVP descriptions, generated code, app configurations)
- Chat history with our AI assistant for app generation
- Usage analytics (features used, session duration, crash reports for improvement)
- Device information (model, OS version, app version for compatibility)
Data We DO NOT Collect:
- Photos or videos from your camera
- Audio recordings or voice data
- Location information
- Contact lists or phone numbers
- Text messages or call logs
- Other apps on your device
13.7 Third-Party AI Processing
When using our mobile app, your project descriptions may be processed by:
- OpenAI: For advanced AI-powered app generation (subject to OpenAI's privacy policy)
- Anthropic (Claude): For AI assistant functionality (subject to Anthropic's privacy policy)
- Data Protection: Your personal project data is not used to train these AI models
- Secure Transmission: All AI processing requests are encrypted and transmitted securely
13.8 Mobile App Security
We implement additional security measures for our mobile app:
- Local data encryption on your device
- Secure token-based authentication
- Automatic logout for inactive sessions
- Regular security updates through app stores
- Biometric authentication support (when available on your device)
13.9 Google Play Store Compliance
Our app complies with Google Play Store policies regarding:
- Transparent permission requests with clear explanations
- Minimal data collection necessary for app functionality
- Secure handling of sensitive permissions like camera and microphone
- User control over optional features and permissions
- Regular security audits and updates
13.10 Managing Mobile App Permissions
You can manage app permissions at any time:
- Android Settings: Go to Settings > Apps > Autoflowly > Permissions
- In-App Settings: Access permission controls within the app's settings menu
- Granular Control: Enable or disable individual permissions based on your preferences
- No Feature Loss: Core app functionality remains available even with restricted permissions
14. Updates to This Policy
We may update this Privacy Policy periodically. We will notify you of material changes by:
- Posting the updated policy with a new "Last updated" date
- Sending email notifications for significant changes
- Displaying in-app notifications
15. Contact Us
For privacy-related questions or to exercise your rights, contact us at:
Email: privacy@autoflowly.com
Data Protection Officer: dpo@autoflowly.com
We aim to respond to all privacy requests within 30 days.
16. Cookie Policy
When you first visit, a banner asks for your choice. "Essentials only" and "Accept all" are equally easy; "Settings" lets you pick analytics and marketing separately. Until you decide, no analytics or marketing script is loaded at all. You can change or withdraw your choice at any time via Cookie settings in the footer.
| Name | Provider | Purpose | Category · legal basis | Lifetime |
|---|---|---|---|---|
af-cookie-consent (local storage) | Autoflowly | Stores your cookie decision | Essential · § 25(2) TTDSG | Until you clear it |
af-lang (local storage) | Autoflowly | Remembers the language you chose | Essential | Until you clear it |
| Auth tokens (app.autoflowly.com) | Autoflowly | Keeps you logged in | Essential | Session / 30 days |
af_attribution (local storage) | Autoflowly | Remembers which campaign brought you here so a later signup can be attributed | Marketing · consent | Until you clear it |
_ga, _ga_HE3WLJLWG9 | Google Analytics 4 | Distinguishes visitors and sessions | Analytics · consent | 2 years |
_fbp | Meta Pixel | Advertising measurement | Marketing · consent | 3 months |
_ttp, _tt_enable_cookie | TikTok Pixel | Advertising measurement (homepage only) | Marketing · consent | 13 months |
You can also delete cookies in your browser at any time. Disabling essential storage may affect login and language selection.