This Privacy Policy explains how Crestward Labs, of Vancouver, British Columbia, Canada ("Crestward Labs", "we", "us"), collects, uses, and shares information through flowstudio-ai.com and the FlowStudio application at app.flowstudio-ai.com (together, the "Service"). It also sets out the terms under which we process personal data on behalf of Customers who use FlowStudio to build workflows, terms that would traditionally sit in a separate data processing addendum and are instead folded directly into Section 7 below.
§1Scope and our role
We act in two different capacities, and this Policy is written to make clear which one applies to a given category of data.
As controller
For account, tenant, billing, and website or contact-form data, the information about the people and organizations who sign up for FlowStudio, we decide why and how that data is processed, and this Policy is our direct privacy notice to you.
As processor
For Customer Content, meaning workflow data, connected databases, crawled sites, uploaded documents, and messages from a Customer's own end users on Slack, Discord, Telegram, or WhatsApp, we process that data on the Customer's documented instructions. The Customer is the controller responsible for having a lawful basis to process it; Section 7 sets out our commitments in that relationship.
§2Who we are
Crestward Labs
Vancouver, British Columbia, Canada
Contact: admin@flowstudio-ai.com
§3Information we collect
Account and tenant information
Email address, first and last name, tenant or organization name, a hashed password (we never store passwords in plain text), and, if you sign in with Google or GitHub, the provider name, provider account ID, and the email address it discloses.
Customer Content
Workflow and agent configurations, custom tool source code, uploaded documents, results returned from databases you connect (read-only), content crawled from websites you configure, full workflow run transcripts (inputs, outputs, and system prompts used), agent memory summaries, and any input you provide at a human-in-the-loop checkpoint.
End-user and channel data
If a Customer configures a messaging bot, we process messages and identifiers from the people who interact with it on Slack, Discord, Telegram, or WhatsApp, on behalf of and at the direction of that Customer.
Third-party API keys
Credentials you provide for AI model providers or other connected services, stored encrypted at rest and used only to run the workflows you configure.
Website and contact data
If you use the contact form on flowstudio-ai.com, we receive the work email address and message you submit. We do not currently use analytics cookies, advertising trackers, or tracking pixels on the marketing site; see Section 12.
Technical and usage data
IP address, request timestamps, and per-execution metering (CPU time, memory, and network egress) that we use to enforce usage quotas and, in the future, for billing, plus standard security and error logs.
§4How we use information
- To provide, operate, and maintain the Service, including executing workflows and routing Customer Content to the AI providers, MCP servers, and other integrations a Customer configures;
- To enforce usage quotas and, in the future, to bill for paid plans;
- To secure the Service, detect abuse, and enforce these Terms and this Policy;
- To communicate with you about the Service, including account, security, and, where you have opted in, product notices;
- To respond to inquiries submitted through the contact form; and
- To comply with applicable law.
§5Legal bases
Where the GDPR or UK GDPR applies, we rely on performance of a contract with you (operating your account and running your workflows), our legitimate interests in securing the Service, preventing abuse, and enforcing quotas, your consent where we ask for it, and compliance with legal obligations.
§6How we share information
We do not sell personal data. We share information as follows.
| Recipient | What and why |
|---|---|
| AI model providers | Whichever provider you configure (for example, OpenAI or Anthropic) receives the prompts and context needed to run your workflow, sent using your own API credentials. |
| Hosting and infrastructure | Cloud infrastructure providers that host the Service and store data on our behalf, located in Canada, the United States, or other jurisdictions where our providers operate. |
| Email delivery | Used to send verification, password-reset, and passwordless sign-in emails. |
| Messaging platforms | Slack, Discord, Telegram, or WhatsApp, only to the extent you configure a bot integration. |
| Service providers | Vendors who support our operations under confidentiality obligations. |
| Legal and safety | Where required by law or legal process, or to protect rights, safety, or property. |
| Corporate transactions | In connection with a merger, financing, acquisition, or sale of assets, subject to this Policy or a materially similar one. |
Third-party MCP servers, databases, and websites that you independently configure FlowStudio to connect with are not our sub-processors. You select them directly, and once data reaches them, its handling is governed by that third party, not by us. Please review any third-party service before connecting it.
§7Data processing terms for Customers
This section sets out our commitments where we process personal data as a processor on a Customer's behalf, the terms a separate data processing addendum would otherwise cover.
- Instructions. We process Customer Content only as instructed through the Service's own configuration, and as required by applicable law.
- Confidentiality. Personnel with access to Customer Content are bound by confidentiality obligations.
- Security. See Section 10.
- Sub-processors. Engaged per Section 6; we will provide notice of material changes to that list on request.
- Data subject requests. We will provide reasonably necessary assistance with a Customer's obligation to respond to its end users' requests, using the account and workflow deletion tools built into the Service.
- Breach notification. We will notify the affected Customer of a confirmed personal data breach affecting Customer Content without undue delay, and in any event within 72 hours of confirming the breach.
- Deletion on termination. Customer Content is deleted or returned on termination of a Customer's account, subject to the retention terms in Section 9 and any copies we are required to retain by law.
- Audit. Enterprise Customers may request information reasonably necessary to demonstrate our compliance with this section, subject to confidentiality.
- International transfers. Where personal data originating in the EEA or UK is transferred outside those regions, we rely on appropriate safeguards recognized under applicable law, such as the European Commission's Standard Contractual Clauses, to protect that data.
§8Data location and international transfers
Service infrastructure and backups are hosted with cloud providers located in Canada, the United States, or other jurisdictions where we or our infrastructure providers operate. Personal data may accordingly be processed in a country other than where you or your end users are located. Enterprise Customers with data-residency requirements can ask us about self-hosted or VPC deployment options.
§9Data retention
- Account and tenant data: retained while your account is active and for a reasonable period afterward for legal, security, and backup purposes.
- Workflow run transcripts, agent memory, and channel session history: retained for as long as your account and the relevant workflow remain active. You can delete a specific run, workflow, or channel session at any time, which removes its stored content, and closing your account deletes this data as described above.
- Usage-metering data: retained for a configurable window used for quota enforcement and, in the future, billing.
- Third-party API keys: retained until you remove them or close your account.
§10Data security
API keys and other secrets are encrypted at rest; passwords are hashed and never stored in plain text; custom code runs in an isolated, single-use sandboxed container with resource and network-egress limits; data in transit is encrypted (TLS); and internal access to Customer Content is restricted. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
§11Your rights and choices
- Everyone: you can access, correct, or request deletion of the personal data associated with your account by emailing admin@flowstudio-ai.com or through in-product account settings.
- Canada (PIPEDA): you have the right to access and challenge the accuracy of personal information we hold about you, and to withdraw consent, subject to legal and contractual restrictions.
- EEA/UK (GDPR/UK GDPR), where applicable: rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with a supervisory authority.
- California (CCPA/CPRA), where applicable: the right to know, delete, and correct personal information, and to opt out of any "sale" or "sharing"; we do not sell personal information.
We may need to verify your identity before acting on a request, and will respond within the timeline required by applicable law.
§12Cookies and similar technologies
flowstudio-ai.com does not currently use analytics cookies, advertising trackers, or tracking pixels; the contact form submits directly to our backend without setting any cookie. The FlowStudio application at app.flowstudio-ai.com uses session-related storage necessary to keep you signed in. If this changes, for example if we introduce product analytics, we will update this Policy and, where required, ask for your consent first.
§13Not directed to children
FlowStudio is a business and developer tool intended for use by organizations and their personnel. It is not directed to children, and we do not knowingly collect personal information from them.
§14Third-party links
The Service and this site may link to third-party websites, for example an AI provider's documentation or a marketplace template's source. We are not responsible for the privacy practices of sites we do not operate.
§15Changes to this Policy
We may update this Policy from time to time. We will notify you of material changes by email or an in-product or on-site notice, and update the "Last updated" date above.
§16Contact us
Crestward Labs
Vancouver, British Columbia, Canada
admin@flowstudio-ai.com