Flowmyi - Privacy Policy

Last updated: July 2026

This Privacy Policy describes how Flowmyi ("we", "us", or "our") collects, uses, and stores information when you use our service at flowmyi.com. We are committed to being transparent about what data we access and why.

1. Who We Are

Flowmyi is an AI-powered email management tool that connects to your Gmail account and helps you organise your inbox as a project board. The service is operated by Patricia Guerola i Carbó, based in Spain.

Contact: hello@flowmyi.com

2. What Data We Access

2.1 Gmail Data

When you connect your Gmail account, we request the following Google OAuth scope:

gmail.readonly - read-only access to your Gmail messages and metadata

With this scope, we access:

Email thread content (subject, body, sender, recipients, timestamps) - this content is processed to power AI classification, but the full email body is not permanently stored; see Section 2.4 for what we actually retain
Email metadata (labels, read/unread status, attachment names)
Sender email addresses and display names

We do NOT access:

Your Gmail contacts list
Your Google Drive or any other Google service
Your ability to send emails on your behalf (we cannot send emails)
Any Google account data beyond what is described above

2.2 Google Calendar Data

When you connect Google Calendar, we request:

calendar.readonly - read-only access to your Google Calendar events

With this scope, we list and read events from all calendars you have reader access to (your primary calendar, any secondary calendars, and any calendars shared with you), limited to the relevant time window (e.g. today, this week), to display them on your Daily Briefing screen and to power calendar filters. We do NOT create, modify, or delete calendar events, and we only access calendars you already have reader access to in your own Google account.

2.3 Account Data

When you sign up, we store:

Your email address (used for authentication via Supabase Auth)
Your onboarding preferences (role, inbox habits) - used to personalise AI classification
Your manual category corrections - used to improve classification accuracy for your account

2.4 Usage Data

We collect:

Email threads: we store metadata (sender, subject, a short snippet), AI-generated classifications, statuses, and summaries. We do NOT store the full body of your emails - full email content is processed transiently by our AI classification pipeline and is not persisted in our database
Sync timestamps - when your inbox was last synced
Plan status (free or Pro) and subscription information via Stripe

3. How We Use Your Data

We use the data we collect exclusively to provide the Flowmyi service. Specifically:

To classify your email threads into categories using the Claude AI API (Anthropic)
To generate AI summaries, statuses, and draft replies for your threads
To display your today's meetings from Google Calendar
To learn from your manual corrections and improve classification accuracy over time
To manage your subscription and process payments via Stripe

We do NOT:

Sell your data to any third party
Use your email content for advertising
Share your data with any third party except those listed in Section 4
Use your data to train general AI models (your corrections only improve your own classification)

4. Third Parties We Share Data With

To provide the service, we share data with the following third-party processors:

Anthropic (Claude API)

Your email thread content is sent to Anthropic's Claude API for classification and summarisation. Anthropic processes this data to generate the AI responses. We use Anthropic's API under their standard terms of service. Data sent to Claude is not used to train Anthropic's models under their current API terms. Anthropic retains API request data for up to 30 days for safety and debugging purposes, after which it is deleted. We share email content with Anthropic solely to provide Flowmyi's classification, summarisation, and draft-reply features, and not for any other purpose.

Lovable (Lovable Cloud)

Flowmyi is built and hosted using Lovable, an application platform that provides our database, authentication, and backend infrastructure through its "Lovable Cloud" service. Your account data, email classifications, and preferences are stored within Lovable Cloud. Lovable Cloud is built on Supabase's open-source infrastructure, which acts as Lovable's sub-processor for hosting; Supabase does not have a separate, direct relationship with Flowmyi or its users. Lovable applies access controls and encryption to protect this data, as described in Section 5.

Stripe

If you subscribe to Flowmyi Pro, your payment information is processed by Stripe. We never store your card details. Stripe handles all payment data under PCI DSS compliance.

Google

We access your Gmail and Google Calendar data via the Google API. Your use of Google services is subject to Google's Privacy Policy.

5. Data Storage and Security

All data is stored via Lovable Cloud, in the Asia Pacific (Tokyo) region
Row Level Security (RLS) is enforced at the database level - no user can access another user's data
Data is encrypted in transit (HTTPS/TLS) and at rest, by default and without additional configuration
Gmail OAuth tokens are stored securely and used only to fetch your email data
We do not store your Gmail password - authentication is handled entirely by Google OAuth

6. Data Retention

We retain your data for as long as you have an active Flowmyi account. Specifically:

Classified email threads: retained until you disconnect your Gmail account or delete your account
User preferences and corrections: retained until account deletion
Payment records: retained for 6 years, as required under Spanish commercial law (Código de Comercio, Article 30)
Data sent to Anthropic's Claude API: retained by Anthropic for up to 30 days for safety and debugging, then deleted

You can request deletion of your account and all associated data at any time by emailing hello@flowmyi.com. We will process deletion requests within 30 days.

7. Your Rights (GDPR)

If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR):

Right of access - you can request a copy of the personal data we hold about you
Right to rectification - you can ask us to correct inaccurate data
Right to erasure - you can ask us to delete your data (see Section 6)
Right to restriction of processing - you can ask us to limit how we use your data
Right to data portability - you can request your data in a machine-readable format
Right to object - you can object to certain uses of your data
Right to withdraw consent - where our processing is based on your consent (such as connecting your Gmail account), you can withdraw that consent at any time by disconnecting your account or deleting your account. This does not affect the lawfulness of processing carried out before withdrawal

To exercise any of these rights, contact us at hello@flowmyi.com. We will respond within 30 days.

Legal basis for processing: We process your data on the basis of your explicit consent (given when you connect your Gmail account) and the performance of a contract (providing the Flowmyi service you signed up for).

8. International Data Transfers

Flowmyi's data is hosted via Lovable Cloud in the Asia Pacific (Tokyo) region, Japan. The European Commission has recognised Japan as providing an adequate level of data protection under GDPR Article 45 since January 2019, most recently reviewed in 2023. This means personal data can be transferred to Japan without additional safeguards such as Standard Contractual Clauses, on the same legal footing as a transfer within the EU.

Some of the other third parties we use, specifically Anthropic (Claude API) and Stripe, are based in the United States. Where data is transferred to them, this is carried out under Standard Contractual Clauses (SCCs) approved by the European Commission, which is the legal mechanism recognised under GDPR Article 46 for transferring personal data to countries that do not have an adequacy decision. This requires the receiving party to apply data protection safeguards equivalent to those required within the EU.

9. Cookies

Flowmyi uses only essential cookies required for authentication and session management. We do not use advertising cookies, tracking cookies, or third-party analytics cookies.

10. Children's Privacy

Flowmyi is not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by displaying a notice in the app. The date at the top of this page indicates when it was last updated.

12. Google API Limited Use Disclosure

Flowmyi's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We do not use Gmail or Calendar data to develop, improve, or train generalized AI and/or ML models.
We do not allow human review of your email content, except (a) with your explicit consent, for example for support purposes, (b) for security investigations, (c) to comply with applicable law, or (d) where data is aggregated and anonymised for internal operations.
We do not transfer or sell this data to advertisers, data brokers, or any third party for purposes unrelated to providing the Flowmyi service.
We do not use this data to determine creditworthiness or for lending purposes.

13. Contact

If you have any questions about this Privacy Policy or how we handle your data:

Email: hello@flowmyi.com
Website: flowmyi.com
Data controller: Patricia Guerola i Carbó, Spain

If you are unsatisfied with our response, you have the right to lodge a complaint with the Spanish Data Protection Authority (AEPD): https://www.aepd.es