Privacy Policy

This Privacy Policy explains what personal information Guillaume SEVRIN ("Flowjat", "we", "us", or "our") collects, how we use and share it, and the choices and rights you have. Flowjat is an AI ad copilot for indie developers and small teams: you connect your advertising accounts so the copilot can analyze performance and tell you, in plain language, what to change.

This policy applies to visitors and users in the United States and elsewhere. If you are a California resident, see Your California privacy rights (CCPA/CPRA). If you are in the European Economic Area (EEA), the United Kingdom, or Switzerland, see Your rights in the EEA, UK & Switzerland (GDPR).

1. Who we are

Flowjat is operated by Guillaume SEVRIN (Entrepreneur individuel (EI)), based at France — contact via email for official correspondence. For any privacy question you can reach our privacy team at privacy@flowjat.com. For data-protection matters specific to the EEA/UK, you can also contact dpo@flowjat.com.

2. Information we collect

Account information

When you create an account we collect your name and email address, and the authentication metadata needed to keep your account secure (for example a hashed password or the identifier from your sign-in provider).

Advertising data you connect via OAuth

Flowjat only accesses ad data for accounts you choose to connect. When you link an account through OAuth — Meta Ads, Google Ads, TikTok Ads, Snapchat Ads, or Apple Search Ads — we access, through that platform's API, information such as:

• campaign, ad set, and ad structure and settings;
• spend, budgets, and billing-related metrics;
• performance metrics (impressions, clicks, conversions, ROAS, and similar);
• creative metadata and assets (for example ad text and references to your creatives) so the copilot can reason about what is working.

We request the minimum scopes needed to provide analysis and recommendations, and we do not collect the personal information of the people your ads reach.

OAuth tokens

To keep a connection live, we store the access and refresh tokens issued by each platform. These tokens are sensitive — they are encrypted at rest and are never shared with third parties beyond what is needed to call the relevant platform API on your behalf.

Revenue & monetization data (optional)

If you connect a revenue tool (such as Stripe, Paddle, or RevenueCat) so the copilot can compute a true ROAS, we process the revenue and subscription metrics you authorize. As with ad data, we request only the scopes needed for analysis.

Copilot conversations

When you chat with the AI copilot, we store the messages you send and the replies you receive, together with related metadata (timestamps, the model used, token counts, and any actions the copilot proposed or applied). We keep these conversations to provide the feature and your chat history, to keep the service safe and prevent abuse or misuse, and to investigate and resolve support issues or disputes between you and Flowjat. Admins on our team may review conversation content for these purposes on a need-to-know basis. We do not use the content of your conversations to train third-party AI models — see How the AI copilot uses your data.

Technical logs

We keep technical logs (IP address, device and browser information, approximate location inferred from IP, timestamps, and error traces) to operate the service, prevent abuse, and debug issues.

Product analytics

To understand how Flowjat is used and improve it, we use PostHog (EU Cloud) for privacy-friendly product analytics. It is cookieless — it sets no cookie and stores no tracking identifier on your device — and we do not enable session recording or automatic content capture. We record only high-level usage events (such as pages viewed and key actions like signing in), tied to your account identifier once you are signed in, plus aggregate, metadata-only metrics about copilot usage (model, token counts, latency). We never send the content of your campaigns or your copilot conversations to PostHog. PostHog is listed on our sub-processors page.

Cookies and similar technologies

We use cookies and similar technologies for essential functionality and, where applicable, with your consent. For details on what we set and how to manage your choices, see our Cookie Policy.

3. How we use your information

We use the information above to:

• create and manage your account and authenticate you;
• read your connected ad and revenue data to produce analysis and generate copilot recommendations;
• operate, maintain, secure, and improve the service;
• prevent fraud, abuse, and other harmful or unlawful activity;
• respond to your support requests;
• send you service and (where permitted) product or marketing communications, which you can opt out of at any time;
• comply with our legal, tax, and accounting obligations.

4. How the AI copilot uses your data

To generate plain-language recommendations, the copilot sends the relevant context — for example aggregated campaign metrics, spend, and the question being answered — to Anthropic, PBC, which operates the Claude AI models we use, on infrastructure located in the United States. Anthropic processes this data on our behalf, as a service provider, to return the copilot's response.

Under our agreement with Anthropic, your data is processed only to serve your request and is not used to train their models. We send the model only the data needed to answer your question; we do not transmit your OAuth tokens to the model.

5. We do not sell your information

Flowjat does not sell, rent, or trade your personal information or your advertising data, and we do not use it to build advertising profiles for third parties. We have not sold or "shared" (as those terms are defined under California law) personal information in the preceding 12 months. We share information only with the service providers needed to run Flowjat, as described below.

6. How we share information

We rely on a small set of vendors to host, operate, and power Flowjat. Each acts as our service provider (or processor), is bound by a contract, and may only use the information on our instructions to provide services to us. The current list — including each vendor's purpose and location — is kept up to date on our sub-processors page.

We may also disclose information when required by law, to respond to lawful requests and legal process, to protect the rights, property, and safety of Flowjat, our users, and the public, or in connection with a merger, acquisition, or sale of assets (in which case we will continue to protect your information consistent with this policy).

7. Your California privacy rights (CCPA/CPRA)

This section applies to California residents and supplements the rest of this policy. It is provided under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA").

Categories of personal information we collect

In the past 12 months we have collected the following categories of personal information (as defined by the CCPA/CPRA):

• Identifiers — such as your name, email address, and account or device identifiers.
• Internet or other electronic network activity — such as IP address, device and browser information, and usage logs.
• Geolocation data — approximate location inferred from your IP address.
• Commercial information — your subscription plan and, if you connect a revenue tool, the revenue and subscription metrics you authorize.
• Professional information and connected advertising data — the campaign, spend, performance, and creative data from the ad accounts you connect.

We collect this information from you directly, from your device and browser, and from the ad and revenue platforms you choose to connect. We use it for the business purposes described in How we use your information and disclose it to the service providers described in How we share information. We do not collect sensitive personal information for the purpose of inferring characteristics about you.

Your California rights

As a California resident, you have the right to:

• Know and access — request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes, and the categories of third parties with whom we share it.
• Delete — request that we delete the personal information we collected from you, subject to legal exceptions.
• Correct — request that we correct inaccurate personal information we hold about you.
• Opt out of the sale or sharing of your personal information. As stated above, we do not sell or share your personal information.
• Non-discrimination — you will not receive discriminatory treatment for exercising any of these rights.

Do Not Sell or Share My Personal Information

Flowjat does not sell or share your personal information, so no opt-out is required. If this ever changes, we will update this policy and provide a clear "Do Not Sell or Share My Personal Information" mechanism before doing so. In the meantime, you can confirm or exercise your choices by contacting us at privacy@flowjat.com.

How to exercise your California rights

To submit a request to know, delete, or correct, email us at privacy@flowjat.com. We will verify your request using the information associated with your account before responding, and we will not discriminate against you for exercising your rights.

Authorized agents. You may use an authorized agent to submit a request on your behalf. We may require the agent to provide proof of your written permission and may ask you to verify your own identity directly with us.

"Shine the Light". California's "Shine the Light" law (Civil Code § 1798.83) lets California residents request information about disclosures of personal information to third parties for their direct marketing purposes. We do not disclose your personal information to third parties for their own direct marketing, so this generally does not apply; you may still contact us at privacy@flowjat.com with any such request.

8. Your rights in the EEA, UK & Switzerland (GDPR)

This section applies if you are located in the EEA, the UK, or Switzerland. Flowjat is operated by a French entity, so the EU General Data Protection Regulation (GDPR) and applicable national law may apply to your data. We act as the controller for the account and usage data described above.

Legal bases for processing

• Performance of a contract (Art. 6(1)(b)) — to create and manage your account, authenticate you, and read your connected ad and revenue data to produce the analysis and recommendations you ask for.
• Legitimate interests (Art. 6(1)(f)) — to keep the service secure and reliable, prevent fraud and abuse, maintain technical logs, moderate copilot conversations and retain them for a limited period to establish, exercise, or defend legal claims, and improve the product.
• Consent (Art. 6(1)(a)) — for non-essential cookies and for product or marketing emails, which you can withdraw at any time.
• Legal obligation (Art. 6(1)(c)) — to comply with tax, accounting, and other legal requirements.

Your GDPR rights

Subject to applicable law, you have the right to:

• access the personal data we hold about you;
• rectify data that is inaccurate or incomplete;
• erase your data ("right to be forgotten");
• data portability — receive your data in a structured, machine-readable format;
• object to processing based on our legitimate interests;
• restrict processing in certain circumstances;
• withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at privacy@flowjat.com or dpo@flowjat.com. You also have the right to lodge a complaint with a supervisory authority. In France, this is the Commission Nationale de l'Informatique et des Libertés (CNIL), www.cnil.fr .

9. International data transfers

Flowjat is operated from France, and some of our service providers — notably Anthropic (United States) and the ad platforms whose APIs you connect — are located or operate outside your country of residence. This means your information may be transferred to, and processed in, the United States and other countries.

Where data is transferred out of the EEA, the UK, or Switzerland, we rely on appropriate safeguards, in particular the European Commission's Standard Contractual Clauses (SCCs) and the UK and Swiss equivalents, together with technical and organizational measures such as encryption. You can ask us for more detail at privacy@flowjat.com.

10. How long we keep your information

• Account information: for as long as your account is active.
• Connected ad & revenue data and derived analysis: while the connection is active and for a limited period afterwards to provide historical context, unless you delete it sooner.
• OAuth tokens: until you disconnect the platform or delete your account, after which they are revoked and deleted.
• Copilot conversations: for as long as your account is active. When you delete your account, we retain your conversation content for 12 months and then permanently delete it. We keep it during this window only to establish, exercise, or defend legal claims and to handle any safety, abuse, or dispute matter that may arise from the conversation (GDPR Art. 17(3)(e)); access is restricted to staff who need it for those purposes.
• Technical logs: for a limited period needed for security and debugging, then deleted or anonymized.
• Billing records: for the period required by applicable tax and accounting law.

When you delete your account, we delete or anonymize your personal information within a reasonable period, except where we must retain certain records to meet a legal obligation or, as described above for copilot conversations, to defend against potential legal claims for a limited, pre-defined period.

11. Security

We apply technical and organizational measures appropriate to the sensitivity of the data, including encryption of OAuth tokens and of data in transit, access controls, and monitoring. No system is perfectly secure; if you have a concern, contact security@flowjat.com.

12. Revoking access and deleting your data

You stay in control of every connection. You can disconnect any ad or revenue platform from your Flowjat settings at any time; once disconnected, we revoke the stored OAuth tokens and stop accessing that platform's API. You can also revoke Flowjat's access directly from the security or connected-apps settings of Meta, Google, TikTok, or Apple.

For step-by-step instructions on disconnecting a platform and requesting deletion of the associated data, see our data deletion page.

13. Platform data & API terms

Data we access through the Meta, Google Ads, TikTok, Snapchat, and Apple Search Ads APIs is handled in accordance with each platform's developer terms and data policies, in addition to this Privacy Policy. In particular, we use platform data only to provide the analysis and recommendations you ask for, we do not sell it or transfer it to data brokers, we do not use it for unrelated purposes, we keep it only as long as needed for those purposes, and we delete it when you disconnect the platform or on request. If a platform's terms are stricter than this policy for that platform's data, the platform's terms apply.

14. Children's privacy

Flowjat is a professional tool intended for adults. The service is available only to users who are at least 18 years old and is not directed at children. We do not knowingly collect personal information from anyone under 18 (or under 16 in the EEA/UK). If you believe a minor has provided us information, contact us and we will delete it.

15. Changes to this policy

We may update this policy as the product evolves. We will revise the "Last updated" date above and, for material changes, notify you through the service or by email.

16. Contact us

For any question about this policy or your information, contact our privacy team at privacy@flowjat.com, our data-protection contact at dpo@flowjat.com, or our general contact at contact@flowjat.com. You can also write to Guillaume SEVRIN, France — contact via email for official correspondence.