Developer Privacy Policy

Effective Date: December 12, 2025
Last Updated: March 12, 2026

1. Introduction

This policy covers how we handle data from developers and businesses using Flowsta Auth API.

2. Developer Data We Collect

Account Data

  • Organization name
  • Contact email
  • API keys
  • Team members (user IDs, roles)
  • Pending invites (email addresses - deleted after 7 days or acceptance)

Billing Data (via Stripe)

  • Payment method (stored by Stripe)
  • Billing address
  • Invoice history

Usage Data

  • API request counts
  • Error rates
  • Response times
  • MAU counts (aggregate only)

Holochain Signing Data (If You Use Signing Service)

  • Which apps you've enabled signing for
  • Signing permission metadata (granted/revoked timestamps)
  • Number of signing requests per app
  • NOT stored: Actual content of what was signed (only SHA256 hashes in user's encrypted Holochain)

3. What We DON'T Collect About Your Users

DataStatusNotes
User passwords❌ NeverZero-knowledge architecture
User IP addresses❌ NeverRemoved from all logs
User device info❌ NeverRemoved from all logs
User activity❌ NeverStored in user's Holochain

Your users' data stays with your users.

4. Zero-Knowledge MAU Analytics

How MAU Tracking Works

  1. User logs in via your app
  2. Flowsta generates random analytics_id (stored in user's Holochain)
  3. We record: analytics_id + your app_id + month
  4. You see: "42 MAU this month"

What You CAN'T Do

  • Identify which users logged in
  • Link analytics_id to email or DID
  • Access user activity logs
  • See IP addresses or devices

This is by design. Zero-knowledge analytics protects your users' privacy while giving you the metrics you need.

5. Agent Linking Data (If You Use It)

When users link their Flowsta identity with your app via Flowsta Vault:

What We Collect

DataRetention
App ID + client_id (which app was linked)Until revoked
Linked timestampsPermanent (audit trail)

What We DON'T Collect

  • The user's private signing keys (never leave the user's device)
  • Individual user identifiers in your analytics

How Attestations Work

  • When a user approves a link, a cryptographic attestation (IsSamePersonEntry) is committed to the public Holochain identity DHT
  • This attestation is immutable — it cannot be deleted after creation
  • Developers can verify attestations on their own DHT but cannot create them without user approval
  • Flowsta does not process agent linking data on behalf of developers — all attestations are created by the user's device

6. Support Services (Gleap)

We use Gleap, a third-party support platform, to provide AI chat assistance and support ticket management.

For Anonymous (Not Logged In) Users

DataShared with Gleap?Purpose
Email❌ NoN/A
Authentication status✅ Yes (false)Workflow routing

For Authenticated Developers

DataShared with Gleap?Purpose
User ID✅ YesContact identification
Email address✅ YesSupport ticket communication
Organization name✅ YesContext for support
Authentication status✅ Yes (true)Workflow routing
Developer plan✅ YesSupport prioritization

Privacy Protection

  • Data is only shared when you open the support widget (AI chat or ticket creation)
  • Anonymous users can access the AI chat without providing any personal information
  • Authenticated users' data is shared to enable personalized support and ticket tracking
  • Gleap is GDPR-compliant and bound by their privacy policy
  • Support chat transcripts and tickets are retained by Gleap per their data retention policy

Your Control

  • You can use the AI assistant anonymously without logging in
  • If authenticated, you can request deletion of your support data by contacting privacy@flowsta.com
  • Ticket transcripts can be provided upon request

7. How We Use Developer Data

Service Provision

  • Generate and manage API keys
  • Monitor usage and enforce limits
  • Bill for API usage

Communication

  • Service announcements
  • API changes
  • Billing notifications
  • Security alerts

8. Data Sharing

Service Providers

  • Stripe (payments)
  • Google Cloud (hosting)
  • Gleap (support services)

We DON'T

  • Sell developer data
  • Share API keys
  • Use your data to compete

9. Your Responsibilities

As a developer using Flowsta, you are the "Data Controller" for your users:

You Must

  • Have a privacy policy
  • Inform users Flowsta is used
  • Obtain consent for data sharing
  • Handle user data requests
  • Comply with GDPR/CCPA

Data Processing Agreement

Enterprise customers can request formal DPA.

10. Developer Rights

  • Access your account data
  • Update business information
  • Export usage analytics
  • Delete your developer account

Account Deletion

  • Request via dashboard
  • Deleted within 30 days
  • Billing records retained per tax law (7 years)

11. Data Retention

Active Accounts

  • Data retained while active
  • API logs: 90 days
  • Usage analytics: 2 years (aggregated)
  • Pending team invites: 7 days (auto-deleted if not accepted)
  • Signing activity logs: 90 days

Deleted Accounts

  • Account data: 30 days
  • Billing records: 7 years (legal requirement)

12. Security

Our Protections

  • Encrypted connections (TLS 1.3)
  • API keys encrypted at rest
  • Role-based access control
  • Regular security audits

Your Responsibilities

  • Keep API keys secure
  • Rotate keys regularly
  • Report security issues
  • If using signing service: secure OAuth tokens (they grant signing access)

13. Changes to Policy

  • 60 days notice for material changes
  • Email notification
  • Continued use = acceptance

14. Governing Law

Jurisdiction: Victoria, Australia

This Privacy Policy and any disputes arising from it shall be governed by and construed in accordance with the laws of Victoria, Australia. Any legal proceedings shall be brought in the courts of Victoria, Australia.

15. Contact