FlowAi Privacy Policy
Version: 2026-09-30-draft · Last updated: October 4, 2026
Law we follow: Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), plus Ontario and other rules that apply to email and consumers. See section 14 for Quebec.
Items marked planned are not live yet.
1. Summary
- We collect little: mainly your email address, your account and plan settings, the gauges you follow and alert rules you set, and basic security logs.
- We don't sell your personal information and we don't use it for advertising.
- Your data is stored in Toronto, Canada. A few service providers we use process limited data outside Canada (section 8).
- We use no advertising cookies and no analytics cookies. Our login cookie is strictly needed to keep you signed in.
- We count page visits ourselves, without cookies and without storing your IP address, and we honour Do Not Track and Global Privacy Control (section 5).
- You can see, correct, export and delete your data. Account deletion is completed within 30 days.
- Our privacy officer is the Owner of FlowAi, reachable at [email protected].
2. Who is responsible
FlowAi ("FlowAi", "we"), a Washington State sole proprietorship, at 12550 120th Ave NE, Kirkland WA, 98034, is responsible for the personal information we collect. We are a business based in Washington State, USA, that serves customers in Canada, and we store the data in Canada. See the Data Residency Statement for the effect of that on legal requests.
Privacy officer: the Owner of FlowAi, [email protected], 12550 120th Ave NE, Kirkland WA, 98034.
3. What we collect and why
| What | Details | Why | Where it comes from |
|---|---|---|---|
| Account | Email address; a password stored only as a salted hash (never in readable form); your plan; when you signed up and verified your email; the Terms version and time you accepted | To run your account, sign you in, apply your plan, and prove what you agreed to | You |
| Sessions | A sign-in token and its expiry | To keep you signed in | Created when you sign in |
| Verification and reset codes | A hash of a one-time code, its expiry, and how many tries and sends were made | To verify your email, reset your password and stop abuse | Created when you ask |
| Organisation details (Commercial) | Organisation name and email domain; optional logo, mailing address, phone and email; which users belong to it and their roles | To run team accounts, invites and shared settings | You or your administrator |
| Gauges you follow | Your favourite gauges and display preferences, and any threshold you set on them | To personalise the app | You |
| Unlocks | Which gauges you have unlocked, on which plan, and until when; swaps | To give you the forecasts you paid for | You |
| Alert rules and history | Gauge, threshold, direction and variable of each rule; each alert event, the email address it was sent to, the email as sent, and whether it was delivered | To send alerts, retry failures, and show you what was sent | You and our alert checker |
| Rivers and reports (Commercial) | River names and gauge lists; messages or flood reports your team writes | To provide those features | You |
| Security and audit log | Date and time, type of event (for example sign-up, login failure, password reset), your account, your IP address, and technical details | To detect abuse, investigate problems and keep the service secure | Our servers |
| Support messages | What you write to us and our replies | To help you | You |
| Billing (planned, when payments open) | Name and billing details you give Stripe, plan, gauge quantity, invoices, payment status, tax details. We do not receive or store your full card number; Stripe does. | To charge you, issue receipts, handle refunds and tax | You, through Stripe |
| Technical data | IP address, browser type and request details, handled by our hosting and network providers in server logs | To deliver pages, protect against attacks and fix errors | Your browser |
| Error reports (planned) | Technical details of errors, which may include your account ID and IP address. We configure this to leave out passwords and message content. | To find and fix bugs | Your browser and our servers |
| Site usage | The pages you visit (the address without anything after a "?"), a few named actions (for example viewing a gauge or a forecast, opening the pricing page, adding a favourite, creating an alert, downloading a report; never what you type in search), the name of the site that linked you to us, campaign tags in the link, device type (phone, tablet or computer), country, and the time. A visitor code made by one-way scrambling your IP address and browser details with a random value that we delete every day, so visits on different days can't be linked. We don't store your IP address or browser details, and we use no cookies for this. If you are signed in, the visit is linked to your account and plan. | To see which pages and features are used, how people find us, and improve the service | Your browser |
We do not collect your name (unless you give it to us in your organisation details, to Stripe, or in support messages), your precise location, or any sensitive personal information. We don't use your personal data to train models. The forecasts themselves are made from weather and river data, not from personal data.
If you are in an Ontario organisation with a FlowAi account, your organisation's administrator can see the users, rivers and alert settings of that organisation.
4. How we use it, and why we're allowed to
We use personal information only to:
- provide, secure and support FlowAi and your account;
- send you the emails you ask for (see section 7);
- bill you and meet legal, tax and accounting duties (planned, from payments);
- fix bugs and understand how the site and its features are used (section 5, Analytics);
- respond to legal requirements and protect our rights.
Where the law requires consent, we rely on the consent you give when you sign up and use the service, and you can withdraw it (which may mean we can't provide the service). We don't use your information for a new purpose without telling you and, where needed, asking for your consent.
5. Cookies and similar technology
- Sign-in cookie. When you sign in, we set a cookie that keeps you signed in. It is
httpOnly(page scripts cannot read it) and is only sent to FlowAi. It is strictly necessary, so it doesn't need a consent banner. A separate security (CSRF) token protects your requests. - Analytics. We run our own privacy-friendly analytics (section 3, "Site usage"). It does not use cookies or local storage, does not follow you across sites, and doesn't store your IP address or browser details. The data stays on our servers in Canada and is not shared with an analytics company. If your browser sends Do Not Track or Global Privacy Control, we record nothing. If we ever add cookies for anything other than keeping you signed in, we'll update this policy and ask first.
- Bot check (planned). Sign-up and password reset use Cloudflare Turnstile to tell people from bots. It runs in your browser during those steps.
- Local storage. The app may keep interface preferences (for example a chosen view) in your browser. These stay on your device.
- We use no advertising trackers and no social-media pixels.
6. Retention: how long we keep it
| Data | Kept for |
|---|---|
| Account, favourites, unlocks, alert rules, rivers | While your account is open; deleted within 30 days after you delete your account |
| Sign-in sessions | Until they expire or you sign out; expired ones are purged within 30 days |
| Verification and reset codes | Until they expire (minutes) and are overwritten by a new request; removed on account deletion |
| Unverified accounts | Deleted if not verified within 30 days |
| Alert event history (including the email as sent) | 12 months, then deleted or anonymised |
| Security and audit log (including IP address) | 12 months, then deleted. If an entry is part of an active investigation or a legal matter, we keep it until that ends |
| Site usage events | 13 months, then deleted. If you delete your account, past events are kept only without your account link |
| Daily random value used to make visitor codes | Deleted after one day |
| Support messages | 24 months after the last message |
| Billing records, invoices, tax records (planned) | 7 years, as tax and accounting law requires. These are kept even after account deletion |
| Email suppression list (addresses that unsubscribed or bounced) | As long as needed so we don't email you again, even after account deletion (kept as a one-way hash where practical) |
| Backups | Nightly backups and point-in-time recovery data are overwritten on a rolling cycle of no more than 30 days. If we ever restore a backup, we re-apply your deletion before going live |
| Anonymous, aggregated statistics (for example how forecasts performed) | No time limit. They can't be tied to you |
When retention ends, we delete or irreversibly anonymise the data.
7. Email
We send email through Resend. There are two kinds.
- Service email (transactional): verification codes, password resets, receipts, billing notices, security notices, and the alerts you set up. You can't opt out of essential security and billing messages while you have an account. Alert emails have a one-click unsubscribe link, and a preferences page lets you pause or delete alert rules.
- Marketing email: we send it only if you opt in, in line with Canada's anti-spam law (CASL). Every marketing email has an unsubscribe link, and we honour it within 10 business days (normally immediately).
Addresses that bounce or complain are suppressed automatically.
8. Who we share it with (service providers)
We don't sell personal information. We share it only with service providers who help us run FlowAi, under contract, for our purposes only, and in the limited ways below. We list where each one handles data.
| Provider | What for | Personal data involved | Where | Status |
|---|---|---|---|---|
| DigitalOcean | Hosting: database, cache, servers, backup storage | Everything in section 3 | Toronto, Canada (TOR1). DigitalOcean is a US company | Live (at launch) |
| Vercel | Hosts the website front end | Request data such as IP address and pages requested; requests may be handled at edge locations outside Canada | Pages are served from Vercel's global edge network; server-side code runs in Montréal, Canada (yul1). Vercel is a US company | Live (at launch) |
| Cloudflare | DNS, network protection and content delivery, bot check (Turnstile), cookieless analytics | IP address and request data for every visit | Global network, including outside Canada | Live (at launch); Turnstile and analytics planned |
| Resend | Sends our email | Recipient email address, subject and body (including alert content) | United States: Resend sends from its US East region and stores account data, logs and message metadata in the US | Live |
| Stripe | Payments, invoices and tax calculation | Name, email, billing details, payment method, purchase history | Stripe processes in the US and other countries | Planned |
| Sentry | Error reports | Technical data, possibly account ID and IP address | United States (Sentry's US data region); we strip email addresses and IP addresses from reports before they are sent | Planned |
| Have I Been Pwned (password check) | Checks a new password against known leaks using only the first 5 characters of a one-way hash; your password and email are never sent | Partial hash only | Outside Canada | Planned |
We may also disclose information: if the law requires it, to a court, regulator or police with lawful authority; to protect people or our rights; or to a buyer of the business, under a confidentiality promise, if we are sold.
Outside Canada. Some providers above are US companies or process data outside Canada, so your information may be accessible to courts and authorities in those countries under their laws. We use contracts and security measures to protect it, but we can't promise foreign law will never apply. Our main database stays in Toronto.
Maps. We plan to serve map tiles from our own storage, so your browser does not contact a third-party map server when it shows a map. Map data is © OpenStreetMap contributors.
9. Security
- Data is encrypted in transit (HTTPS) and the hosting provider encrypts stored data at rest.
- Passwords are stored only as strong one-way hashes, and new passwords are checked against known leaks (planned).
- Access to servers and data is limited to what the work needs.
- Admins on Commercial plans must confirm new-device logins with an emailed code. Everyone can add an authenticator app.
- API keys (Data Integration package) are read-only, revocable and rate-limited.
- We take backups, monitor the service, and review security before launch and when we make significant changes.
No system is perfectly secure. Please use a strong, unique password.
10. If something goes wrong: breach notice
If a security breach involving your personal information creates a real risk of significant harm, we will:
- tell you as soon as feasible, directly (by email), saying what happened, what information was involved, what we're doing, and what you can do;
- report it to the Office of the Privacy Commissioner of Canada (and other regulators where required);
- tell other organisations that can reduce the harm, where appropriate;
- keep a record of every breach we know of for at least 24 months, whether or not we reported it.
11. Your rights: access, correction, export, deletion
You can, at any time:
- See the personal information we hold about you and how we use it;
- Correct it if it is wrong (most fields you can change yourself in settings);
- Export your data in a common format (JSON), yourself in Profile → Account ("Download my data"), or by request;
- Delete your account and personal information yourself in Profile → Account ("Delete account", confirmed with a code we email you), or by request. We finish deletion within 30 days. Deleting your account also removes you from Stripe (planned), except records we must keep by law (section 6);
- Withdraw consent, including unsubscribing from emails;
- Challenge our compliance by contacting the privacy officer.
To make a request, email [email protected] (subject: "Privacy request") or use the account settings when available. We'll verify it's you, and reply within 30 days. We don't charge for ordinary requests. If we refuse a request, we tell you why and what you can do next. If you are unhappy with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
12. Children
FlowAi is not aimed at children. We don't knowingly collect personal information from anyone under 16. If you think a child has given us information, contact us and we'll delete it.
13. Where we store data
Our database, cache, servers and backups are in Toronto, Canada. Providers that handle limited data elsewhere are listed in section 8. Because we are a US-based business, section 8 and the Data Residency Statement explain what that means for legal requests.
14. Quebec (Law 25)
FlowAi is built for Ontario and is not marketed in Quebec. But people in Quebec may still use it, and Quebec's Act respecting the protection of personal information in the private sector (Law 25) applies to businesses that collect personal information about people in Quebec, wherever the business is. In practice, for any Quebec resident who uses FlowAi we aim to:
- collect only the minimum information described in this policy;
- name a person in charge of privacy (our privacy officer above) and publish this plain-language policy;
- assess the privacy risk of sending personal information outside Quebec (we assess this for our US and other providers) and protect it by contract;
- keep a register of security incidents and report serious ones to Quebec's privacy regulator (the Commission d'accès à l'information) as well as to you;
- let you access, correct and delete your information and receive it in a portable format;
- give this policy in French if we begin to target Quebec.
15. Changes
We'll update this policy when our practices change. The version and date are at the top. For a material change we'll email you or show a notice in the app before it takes effect.
16. Contact
Privacy officer: the Owner of FlowAi
Email: [email protected]
Mail: FlowAi, 12550 120th Ave NE, Kirkland WA, 98034