Privacy Policy

Last updated 5 October 2026

Flowmaps helps you plan and build your product. To do that we store your plans and a few account details. This page explains what we collect, why, who helps us process it, and what you can ask of us. In short: we only collect what we need to run Flowmaps, we don't sell your data, and we don't use tracking or advertising cookies.

1. Who we are

Flowmaps (“we”, “us”) is operated by Emmerce & Media, based in the Netherlands (Chamber of Commerce/KvK number 76128016). We are the controller of the personal data described here. Questions about privacy: flowmapsco@gmail.com.

2. What we collect

  • Account details: your email address. You sign in with a link sent to that address; there is no password.
  • Your content: the ventures, mind maps, cards, notes, flags, build prompts, skills and help articles you create.
  • Your Anthropic API key, if you add one. It's encrypted before it's stored and we only show its first and last characters.
  • Connected computers and Claude connections: a name (like “Sam's Windows PC”), when it was last used, and a fingerprint (hash) of its access token. We never store the token itself.
  • Waitlist: your email address, where on the site you signed up, and when.
  • Technical data: our hosting provider keeps short-lived logs with IP addresses, browser type and times of requests, which we use for security and fixing problems.
  • Support messages: what you send us by email.

We don't collect payment details, and we don't use analytics or advertising trackers.

3. Why we use it, and on what basis

  • To provide Flowmaps (store your plans, sign you in, run the features you use): necessary for our agreement with you.
  • To keep Flowmaps secure (prevent abuse, investigate problems): our legitimate interest in a safe service.
  • To invite you from the waitlist and send beta updates: your consent, which you can withdraw at any time.
  • To answer your questions: our agreement with you, or our legitimate interest in helping you.
  • To meet legal obligations, where the law requires us to keep or share data.

4. AI features

When you use an AI feature (recommended features, follow-up suggestions, build prompts, help articles or flag text), we send the content that feature needs, such as your venture description and the titles and notes of your cards, to Anthropic using your own API key. Anthropic processes it under your agreement with them; see Anthropic's privacy policy. We don't use your content to train AI models.

When you build with Claude Code, the flowmaps command or a Claude connection, your build instructions go to the coding tool on your own computer or account.

5. Public help centers

If you switch on a public help page for a venture, the help articles you publish are visible to anyone with the link, together with the venture's name and description. Drafts and everything else stay private. You can unpublish articles or switch the page off at any time.

6. Who processes your data for us

  • Supabase: database and sign-in. Your data is stored in the European Union (Ireland).
  • Vercel: hosting of the website. Our servers run in the European Union (Dublin); Vercel may handle some request data in other regions.
  • Anthropic: AI processing, only when you use AI features with your own key.
  • Google (Gmail): our support mailbox.

Where a provider handles data outside the European Economic Area, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. We don't sell or rent your personal data.

7. How long we keep it

  • Account details and content: for as long as you have an account.
  • After you ask us to delete your account: removed within 30 days, and from backups when they expire in the normal backup cycle.
  • Waitlist: until we invite you, or until you ask us to remove you.
  • Hosting logs: for a short period set by our hosting provider.
  • Support emails: for as long as needed to help you, and no longer than two years.

8. Your rights

Under the GDPR you can ask us to:

  • see the personal data we hold about you, and get a copy of it;
  • correct it;
  • delete it;
  • send it to you in a machine-readable format;
  • limit how we use it, or object to how we use it;
  • stop using it where you gave consent (this doesn't affect what we did before).

Email flowmapsco@gmail.com and we'll reply within one month. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

9. Cookies

Flowmaps only uses cookies that are needed for it to work: cookies that keep you signed in, and a short-lived cookie (15 minutes) that sends you back to the right page after you sign in. We don't use analytics, advertising or tracking cookies, so we don't ask for cookie consent.

10. Security

  • All connections use HTTPS.
  • Your data is separated per account: you can only reach your own ventures.
  • API keys are encrypted (AES-256) before they're stored; access tokens are stored only as a fingerprint.

11. Children

Flowmaps is not meant for anyone under 16, and we don't knowingly collect their data.

12. Changes

If we change this policy, we'll update the date at the top. For important changes we'll also email you before they take effect.

13. Contact

Privacy questions or requests: flowmapsco@gmail.com.