Privacy Policy

1. Data Controller

The data controller responsible for fainflow.com and the Fainflow service is Oleksandr Shcherbyna, a sole proprietorship registered in Poland (ul. Zamknięta 10/1.5, 30-554 Kraków, Poland; NIP: PL6772518711, REGON: 540273346). For any privacy-related matter, contact [email protected]. Fainflow processes personal data in accordance with the EU General Data Protection Regulation (GDPR).

2. Information We Collect

We collect information you provide when creating an account (name, email — via our authentication provider Auth0), data from services you connect (Telegram bot tokens, Telegram account data, API keys, Google account identifiers), the content and configuration of the flows you build, and flow execution logs (message metadata, not message content). When you purchase a paid plan, our payment provider Lemon Squeezy collects your billing details and payment card data; we never receive or store your card number — we only store subscription metadata (plan, status, invoices). We also collect basic usage analytics such as page views and feature usage.

3. How We Use Your Information

Your information is used to provide and improve the Fainflow service: executing your automated flows, authenticating your identity, storing your configuration, processing subscription payments, and sending service-related notifications. We process personal data on the following legal bases under the GDPR: performance of a contract (providing the service you signed up for), legitimate interests (security, fraud prevention, service improvement), legal obligations (accounting and tax), and consent (where you explicitly grant it — for example optional cookies or connected Google accounts). We do not sell your data to third parties.

4. Data Storage & Security

Your data is stored in encrypted databases hosted in the EU (Hetzner). API keys and credentials are encrypted at rest. We use TLS for all data in transit. Access to production systems is restricted to authorized personnel only. We retain personal data only for as long as your account is active or as required by law (for example, invoices are kept for the period mandated by tax law); when you delete your account, your personal data is deleted within 30 days, except where the law requires longer retention.

5. Third-Party Services & Processors

Fainflow integrates with third-party services as directed by you, and relies on a small set of infrastructure providers (processors) to run the service: Auth0 (Okta) — authentication; Telegram — messaging APIs your flows use; OpenAI — AI features in flows; Google — Gmail and Google Calendar features (see the dedicated section below); Lemon Squeezy — payments and billing (acting as Merchant of Record); Cloudflare — content delivery and security; Hetzner — EU hosting; Google Cloud — secret management; Grafana Cloud — infrastructure monitoring; Google Analytics (Google Ireland Ltd. / Google LLC) — consent-based usage analytics: loaded only after you allow the Analytics cookie category, with IP anonymization enabled; you can withdraw consent at any time in the cookie settings. When you connect a service, we store the credentials you provide and use them solely to execute your flows. Each provider processes data under its own privacy policy and a data-processing agreement with us. Where a provider processes data outside the EEA (for example, in the United States), the transfer is protected by the EU Standard Contractual Clauses and/or an EU–US Data Privacy Framework certification.

6. Your Rights

Under the GDPR you have the right to access, rectify, erase, and export (data portability) your personal data, to restrict or object to its processing, and to withdraw consent at any time without affecting prior processing. You can exercise most of these rights directly from your dashboard (update your profile, disconnect services, delete your account); for anything else — including a full data export or a deletion request — contact us at [email protected]. We respond to all requests within 30 days. You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO, uodo.gov.pl), or the authority of your EU member state.

7. Google API Services & Limited Use

Fainflow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect a Google account, Fainflow collects your basic Google profile (email address and name) to identify the connected account, and — only if you explicitly authorize them — requests these OAuth scopes so your flows can act on your behalf: sending email through your Gmail account (the gmail.send scope) and creating and managing events on your Google Calendar (the calendar.events scope). We request the narrowest scopes needed for the features you enable, and we do not request read access to your Gmail mailbox.

We use Google user data solely to provide the user-facing features you explicitly configure in your flows — for example, sending an email you composed in a flow through your connected Gmail account, or creating a calendar event from a flow. We do not use this data for any other purpose.

We do not share Google user data with third parties except (a) at your direction inside a flow you authored, (b) to the limited extent required by law, or (c) with subprocessors strictly to operate, secure, or improve the user-facing features you enabled, under contracts that match this policy.

We do not use Google user data to develop, improve, or train generalized or non-personalized AI/ML models. Any AI features in Fainflow that touch your Google data only run on the specific items you point them at in a flow and pass results back into that same flow.

Google user data is stored only as long as needed to execute your flows and provide the service. You can delete connected Google accounts (and all derived stored data) from the dashboard at any time; deletion is propagated within 30 days.

You may revoke Fainflow's access to your Google account at https://myaccount.google.com/permissions at any time. Revocation immediately disables all Fainflow flows that depend on the revoked Google connection.

8. Contact

For privacy-related questions, contact us at [email protected].