Privacy Policy

1. General

This Privacy Policy describes how FlowHunt processes the Users’ personal information to perform the Services offered on the website under the domain flowhunt.io and in the FlowHunt application at app.flowhunt.io (“Services”).

Users must read and expressly consent to the data treatment referred to in this Privacy Policy before using the Services.

If you connect a Google account, Section 10 (Google User Data) explains which Google data FlowHunt can access, how it is used, which AI service providers may process it, how long it is kept, and how to disconnect and delete it. Section 11 (AI Service Providers) explains how FlowHunt uses AI services.

2. Data Controller

The Controller of the personal data collected through this Website and of the account data of Users of the Services is AiMingle, s.r.o., Čistovická 1729/60, 163 00 Praha 6, Czech Republic. AiMingle, s.r.o. is the provider of the FlowHunt Service under our Terms and Conditions . Quality Unit, s.r.o. acts as a sub-processor of AiMingle, s.r.o. for certain infrastructure, billing, and support services.

For data that Users submit to or connect with the Services on behalf of their organisation, FlowHunt acts as a Data Processor, as described in Section 8.

3. Purposes of the Processing and Legal Basis

FlowHunt will process the personal data of the User of this Website for the following purposes:

• Services and Business Relationship: Enable the maintenance, development, and management of the Services. This includes managing contracts, orders, deliveries, invoices, and disputes. Data processed for this purpose will be kept as long as the business relationship is maintained, and afterward, during legally established retention periods.
• Responding to User Requests: Respond to requests for information or queries made by the User. Data will be kept until the request has been answered and for the legally established retention period.
• Marketing Communications: Keep the User informed about FlowHunt products, services, and news via electronic means. This processing is based on the User’s consent, which can be withdrawn at any time by contacting support@flowhunt.io .

Failure to accept this Privacy Policy will imply that FlowHunt’s Services and content will not be available.

4. Categories of Data

Depending on how you use the Services, we process the following categories of data:

• Account data: name, email address, login details (including the basic profile information returned by Google Sign-In, if you use it), workspace membership, and settings.
• Workspace content: the flows, AI agents, and chatbots you build, their configuration and prompts, flow inputs and outputs, chat sessions and conversation history, files and attachments you or your end users upload, knowledge sources and documents, and similar content you create in the Services.
• Connected platform data: data that your flows and tools read from or send to platforms you connect, as described in Sections 9 and 10.
• Billing data: personal data, including bank card details, is securely stored on Stripe. Refer to Stripe’s Privacy Policy for further details.
• Website and usage data: data collected through cookies and similar technologies, as described in Section 16.

5. Automated Decision-Making

FlowHunt informs Users that they may be subject to automated decision-making, including profiling, when using the Services.

6. Recipients and Personal Data Transfers

Data may be shared with third-party recipients, including the AI service providers described in Section 11 and the platforms you connect. For a complete list of subprocessors that may have access to or process your data, please refer to our Subprocessors page. This page provides detailed information about our infrastructure subprocessors, vendor subprocessors, and service-specific subprocessors, including when and how they may process your data.

7. Rights of the Users

Users have the right to:

• Access, rectify, erase, or restrict processing of their data.
• Exercise data portability rights.
• Object to automated decision-making or profiling.
• Withdraw consent at any time without affecting the lawfulness of prior processing.
• File a complaint with a supervisory authority.

To exercise the above rights, Users must contact support@flowhunt.io with a valid ID attached for verification purposes.

8. FlowHunt as Data Processor

When Users purchase a license to use the Services, FlowHunt acts as a Data Processor on behalf of the User or the legal entity represented by the User (Data Controller). The processing relationship is governed by GDPR and related regulations.

8.1. Obligations of the Processor

FlowHunt commits to:

• Process data only as directed by the Controller.
• Maintain confidentiality.
• Notify the Controller of any breaches within 48 hours.
• Assist the Controller in responding to data subject rights.
• Implement robust security measures to protect data.

8.2. Obligations of the Data Controller

The Controller must ensure compliance with data protection laws, supervise processing activities, and provide necessary access to data.

9. Connected Platforms

You can connect third-party platforms to your FlowHunt workspace so that your flows, AI agents, and tools can read data from them and perform actions in them. FlowHunt accesses a platform only after you connect it and grant access, and data is exchanged with it only when a flow, tool, trigger, or feature that you set up uses it. The integrations currently available include:

• Google: Google Sign-In, Gmail, Google Drive, Google Docs, Google Sheets, Google Slides, Google Calendar, Google Tasks, Google Meet, Google Search Console, Google Analytics 4, Google Ads, and BigQuery (see Section 10).
• Microsoft: Outlook Mail, Outlook Calendar, Outlook Contacts, OneDrive, SharePoint, Excel, OneNote, Microsoft Teams, Microsoft To Do, Microsoft Planner, Power BI, and Microsoft Advertising (Bing Ads).
• Messaging and collaboration: Slack (including reading channel and direct message history and posting messages through the FlowHunt bot), Telegram, and email through your own SMTP server.
• Social media and advertising: Meta Ads, Instagram business accounts (messages, comments, publishing, and insights), TikTok (see Section 9.1), LinkedIn, and OpenAI Ads.
• E-commerce: Shopify, WooCommerce, PrestaShop, Magento 2, Wix, Shoptet, and BiznisWeb, including orders, products, and customer records.
• CRM, helpdesk, and business systems: HubSpot, Salesforce, Zoho, Bitrix24, Odoo, Abra, Bexio, LiveAgent, and Zendesk.
• Productivity and development: Notion, Airtable, ClickUp, Asana, Atlassian (Jira and Confluence), GitHub, GitLab, WordPress, Vimeo, and Amazon S3.
• Marketing and other services: Mailchimp, Klaviyo, Post Affiliate Pro, Product Fruits, Chameleoon, Bing Webmaster Tools, and financial and sports data services such as Polygon, Alpaca, API-Sports, and FinStat.

Human handoff to live chat tools such as LiveChat, Smartsupp, Freshchat, or Tawk.to is available through flow templates that use credentials you provide; FlowHunt does not hold an account connection to these tools.

Data from a connected platform can be passed to the AI models used by your flows, as described in Sections 10 and 11. The data a flow sends to a platform, and the actions it performs there, are determined by the flows you build and the permissions you grant.

MCP servers: FlowHunt also exposes many of these integrations, including Gmail, Google Drive, Google Docs, Google Calendar, Google Search Console, Google Analytics, Google Ads, and BigQuery, through FlowHunt MCP servers. If you connect your own AI assistant or client to a FlowHunt MCP server, the data your assistant requests is sent to that assistant at your direction. The provider of your assistant is not our subprocessor.

9.1 TikTok Integration

When you choose to connect your TikTok account with FlowHunt, this integration allows you to manage your TikTok account using AI agents. The following disclosures apply to the TikTok integration:

9.1.1 Data Collection and Use

We use TikTok’s Login Kit and API services. When you authorize the TikTok integration, FlowHunt requests access to your basic profile information, profile details and statistics, your list of videos, and the ability to upload and publish videos. We may collect and process:

• Your TikTok profile information (username, display name, profile picture, and account statistics)
• Information about your videos
• Account access tokens required for API authentication
• Data necessary to perform the specific actions you configure through FlowHunt’s AI agents, such as uploading or publishing a video

All TikTok user data is processed only for the limited purpose of enabling and using TikTok integration features within FlowHunt.

9.1.2 User Consent and Control

We will never share your TikTok personally identifiable information (PII) with anyone without your explicit consent. You have complete control over:

• Which TikTok account permissions you grant to FlowHunt
• What actions FlowHunt can perform on your TikTok account
• The ability to revoke TikTok integration access at any time

9.1.3 Data Security and Processing

We implement appropriate technical and organizational security measures to protect TikTok user data in accordance with applicable data protection laws. TikTok data is:

• Encrypted in transit, and access tokens are stored encrypted
• Processed only by authorized personnel under confidentiality commitments
• Not used for any purpose other than providing the specific TikTok integration features you have enabled

9.1.4 TikTok’s Privacy Policy

For information about how TikTok collects, uses, and protects your data, please review TikTok’s Privacy Policy .

9.1.5 Data Retention

TikTok access tokens are kept only while you maintain an active TikTok connection in FlowHunt and are deleted when you remove the integration. TikTok data that your flows have already processed is kept in your flow history as described in Section 12.

9.1.6 Compliance with TikTok Developer Terms

Our TikTok integration complies with the TikTok Developer Terms of Service and TikTok Data Sharing Agreement .

10. Google User Data

Limited Use disclosure. FlowHunt’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements .

The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

We do not use Google user data, including raw, aggregated, anonymized, or derived data, to develop, improve, or train generalized or foundational AI or machine learning models. We send Google user data only to AI service providers whose published terms state that they do not use data submitted through their API to train their models, and only to provide the feature you are using.

This section describes how FlowHunt handles data obtained through Google APIs when you sign in with Google or connect a Google account to your workspace (“Google user data”). It does not cover the website analytics we collect about visitors to flowhunt.io, which is described in Section 16.

10.1. Google integrations and access we request

FlowHunt keeps one Google connection per workspace. When you connect an additional Google product, Google asks you to grant the access for that product, and the connection then covers all the access granted so far in that workspace. Requesting a permission does not mean that FlowHunt reads every type of data the permission allows: data is accessed only when a flow, tool, trigger, or feature that you or a member of your workspace set up uses it. FlowHunt does not request access to Google Photos, Google Forms, Google Contacts, Google Chat, Google Maps, or YouTube accounts.

Am I Cited, a product of AiMingle, s.r.o. that runs on the FlowHunt platform, uses the same Google connection for Google Search Console, Google Analytics 4, and Google Ads. Its processing of that data is described in the Am I Cited Privacy Policy .

10.2. How Google user data is used

We use Google user data only to provide the user-facing features you use: the flows, AI agents, triggers, tools, and MCP servers that you or your workspace members set up. FlowHunt does not use Google user data for advertising, and FlowHunt does not transfer it to advertising platforms. If a flow that you build sends data to another platform you have connected, including an advertising platform, that transfer happens at your direction. The hashed email transmission described in Section 16 uses registration data that you give us directly when you create an account, not data obtained through Google integrations.

10.3. AI processing of Google user data

• AI models in your flows: when a flow step that uses an AI model receives Google user data, for example an email delivered by the Gmail trigger or the result of a Google tool called by an AI agent, that data is sent to the AI model used by the step. The model is the one you select for the step, or the workspace default model and its fallback models, or a model chosen by routing rules, as described in Section 11 .
• Image generation: if a flow uses the image generation step, image attachments in the session, which can include attachments from emails delivered by the Gmail trigger, may be sent as reference images to the image generation service selected in the step (Replicate or OpenAI).
• Knowledge sources: if your flow adds Google user data to a knowledge source or document store, the text is converted into embeddings with Google Vertex AI and stored in our vector database so that it can be searched.
• MCP servers: if you connect your own AI assistant to a FlowHunt MCP server, the Google user data your assistant requests is sent to that assistant at your direction.

The AI service providers that may receive Google user data are listed on our Subprocessors page.

10.4. Where Google user data is stored

• Conversation and flow history: the inputs and outputs of flows, AI responses, and the full results of tool calls, which can include the content of emails, files, calendar events, and reports, are stored as part of the conversation and flow execution history of your workspace. Retention is described in Section 12.
• Technical logs: short excerpts of tool inputs and outputs may be recorded in technical logs used for security and troubleshooting.
• Temporary cache: data of a running session is held in a temporary cache for up to 3 hours.
• Attachments: attachments of emails delivered by the Gmail trigger are stored in FlowHunt file storage on Amazon Web Services in the EU, together with the session.
• Copies you create: if your flows store Google user data in knowledge sources, document stores, or other platforms, those copies remain until you delete them.
• Access tokens: Google access and refresh tokens are stored encrypted.

10.5. Disconnection, revocation, and deletion

• Removing the Google integration from your workspace’s integrations page revokes FlowHunt’s access at Google and deletes the stored connection and tokens. It does not delete Google user data that your flows have already stored in conversation and flow history, attachments, or knowledge sources. To delete that data, delete the knowledge sources you created or contact support@flowhunt.io .
• Revoking access in your Google Account: you can remove FlowHunt from your Google Account connections at any time. After that, FlowHunt can no longer access your Google account.
• Deleting a workspace deletes the stored Google connection, documents, and knowledge sources, but it does not revoke FlowHunt’s access at Google. Remove the Google integration before deleting the workspace, or revoke access in your Google Account. Conversation and flow history of a deleted workspace is deleted when its retention period ends (see Section 12), or earlier on request. Attachments are deleted on request.
• Deleting your account: there is currently no self-service account deletion. To delete your account and the Google user data we hold about you, contact support@flowhunt.io .

Deleted data may remain for a limited period in the backups and recovery mechanisms of our infrastructure providers until those copies expire.

11. AI Service Providers

FlowHunt is a platform for building AI agents, chatbots, and automated flows, so most features send data to AI service providers. Depending on the feature and configuration, we send prompts, instructions, conversation history, relevant context (which may include knowledge source content, tool results, and data from connected platforms), and supported files to the providers listed on our Subprocessors page to generate responses, classifications, transcriptions, embeddings, images, or other media.

How the model is chosen: the AI model and provider that process a request may be:

• selected by you for a flow step;
• the default model of your workspace, including the fallback models configured for it;
• the default of a step or feature when no model is selected, such as the default model of the AI agent or the classification step;
• chosen by FlowHunt routing rules, including fallback to another model when the primary one is unavailable, and the “FlowHunt Auto” options, which choose a model for each request; or
• chosen by FlowHunt for built-in features, such as the flow assistant.

Which provider receives the data: the company that receives a request is not always the developer of the model:

• Anthropic Claude models are processed through Amazon Bedrock in the European Union (Frankfurt, using EU cross-region inference). Some Claude models, and all Claude models when Bedrock is unavailable or disabled for a model, are processed by Anthropic directly.
• OpenAI models are processed by OpenAI. OpenAI also transcribes audio and video files, reads scanned PDF pages when you enable text recognition (OCR), and provides image generation models.
• Open-weight models, such as GPT-OSS, are processed through Amazon Bedrock or Groq, depending on the model. Other open-weight and third-party models (for example DeepSeek, Mistral, Qwen, GLM, MiniMax, and MiMo), and the “FlowHunt Auto” options, are processed through OpenRouter, which routes each request to an inference provider hosting the model.
• Google Gemini models are processed by Google through the Gemini API.
• Text classification uses TypeSafe by default, directly or through OpenRouter, with an OpenAI model as a fallback.
• Embeddings for knowledge sources are generated with Google Vertex AI in the European Union (Frankfurt).
• Image generation uses models served by Replicate (from model developers such as Black Forest Labs, Google, ByteDance, Ideogram, Recraft, Stability AI, and xAI) or by OpenAI.
• Search and data tools send search queries, keywords, and URLs to Serper, DataForSEO, and other services listed on the Subprocessors page.

Your own AI accounts: if you connect your own Azure OpenAI, Amazon Bedrock, or OpenAI-compatible endpoint with your own credentials, requests are sent to that provider under your agreement with it. That provider is not our subprocessor.

Retention and training: provider retention and deletion conditions vary by provider, service, and configuration. Processing a request to produce a result is distinct from using its content for model training. Google user data is never used for model training, as described in Section 10. We do not claim that every provider deletes request data immediately or that no request contains personal data. Avoid including personal data in prompts and flows unless it is needed for your use case.

AI-generated responses and the data processed in your flows are stored in your workspace as described in Section 12.

12. Data Retention and Deletion Policies

• Workspace content: flows, AI agents, chatbots, settings, documents, and knowledge sources are kept while the workspace exists, and are deleted when you delete them or delete the workspace.
• Conversation and flow history: chat sessions, flow inputs and outputs, AI responses, and tool results are deleted automatically on a rolling schedule, generally within about 15 months after they are created. Session summaries shown in the session list may be kept longer, until you ask us to delete them.
• Attachments: files uploaded to chat sessions and attachments delivered by triggers are kept with the session until you ask us to delete them.
• Temporary data: data of a running session is held in a temporary cache for up to 3 hours.
• Technical logs: technical logs, which may include short excerpts of flow and tool inputs and outputs, are kept for a limited period for security and troubleshooting.
• User-initiated deletion: you can delete flows, documents, knowledge sources, and workspaces in the Services. Deleted data may remain for a limited period in the backups and recovery mechanisms of our infrastructure providers until those copies expire. To delete your user account entirely, or to request deletion of conversation history and attachments, contact support@flowhunt.io .
• Backups: backups of Service Data are stored on Amazon AWS S3.

13. Explicit Use of User Data

Customer workspace data and content — including flows, inputs, outputs, and usage data generated within the FlowHunt platform — are used to provide, secure, and improve FlowHunt’s Services. Such data is not used for targeted advertising or shared with third parties for commercial purposes. Google user data is additionally subject to the restrictions in Section 10.

Registration data (such as your email address) may be used for advertising measurement purposes as described in Section 16 (Cookies and Tracking Technologies), including transmission in hashed form to advertising platforms solely to measure the effectiveness of our campaigns.

14. Data Access and Control

Users can manage data access via:

• Role-Based Permissions:
  • Administrator: Full access.
  • Editor: Can modify flows and data.
  • Member: View-only access.
  • Guest: Limited read-only access.
• API Key-Based Access: Users can define API key validity for programmatic access.

Requests to manage data should be submitted via the support portal or emailed to support@flowhunt.io .

15. Security and Protection of Data

FlowHunt employs encryption, access controls, and regular security assessments to ensure user data remains secure.

16. Cookies and Tracking Technologies

What are cookies

Cookies are small text files stored in your browser when you visit a website. We use cookies and similar tracking technologies to operate our website, measure the effectiveness of our marketing campaigns, and improve your experience.

Cookie categories we use

Managing your preferences

You can manage your cookie preferences at any time:

• On your first visit via the cookie consent banner
• At any time via the “Cookie settings” link in the website footer
• By adjusting your browser settings (note: this may affect website functionality)

Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

Server-side tracking and analytics

In addition to browser-based cookies, AiMingle, s.r.o. uses server-side tracking infrastructure to collect analytics and attribution data. This processing occurs on AiMingle’s servers before being forwarded to authorised analytics and advertising platforms. Data is stored in a data warehouse for internal analytics purposes and is subject to the same consent controls as browser-based tracking where applicable.

Enhanced conversions — hashed email transmission

When you register for a free trial or complete a purchase, AiMingle, s.r.o. may transmit your email address in hashed (SHA-256 encrypted) form to Google LLC and Meta Platforms, Inc. for advertising measurement purposes. The hashing process is one-way — the original email address cannot be reconstructed. This data is used solely for conversion measurement. The legal basis is AiMingle’s legitimate interest in measuring marketing effectiveness.

Third-party processors involved in tracking

Geographic scope of consent requirements

Analytics and attribution data retention

Data collected via Google Analytics is retained for 14 months from the date of collection, in accordance with Google Analytics default retention settings. Data stored in AiMingle’s data warehouse for internal attribution purposes is retained for no longer than necessary for the purposes for which it was collected, subject to legal counsel confirmation. Hashed email data transmitted for Enhanced Conversions purposes is subject to the data retention policies of Google LLC and Meta Platforms, Inc. and is not stored by AiMingle beyond the transmission event.

Your Privacy Choices (US residents)

If you are a resident of California or another US state with applicable privacy legislation, you have the right to opt out of the sale or sharing of your personal data for cross-contextual behavioural advertising purposes. To exercise this right, use the “Your Privacy Choices” link available in the website footer, or contact us at privacy@flowhunt.io .

17. Changes to this Privacy Policy

FlowHunt may amend this policy to reflect new regulations or practices. Changes will be posted on this page.

Updated: 10/06/2026