Privacy Policy

FlowSpace is a self-management tool for remote professionals. When you use FlowSpace we act as the data controller for the personal data described below. You can reach us at privacy@flowspace.oriworks.org.

• Account data — your email address, a display name if you set one, and authentication metadata (including data returned by Google if you sign in with Google).
• Content you create — conversations with the copilot, journal entries, memory items, workspace sketches, moodboard selections and the answers you give during setup.
• Room photos — images you deliberately upload for room analysis. They are downscaled in your browser before being sent, used only to produce the analysis you review, and are not stored as images afterwards.
• Derived insights — the Alignment Plan, signals and energy/clarity readings FlowSpace generates from your content.
• Minimal technical data — logs needed to keep the service running and secure. We do not run advertising or cross-site tracking.

• To provide the service you asked for — performance of our contract with you (Art. 6(1)(b) GDPR).
• To keep the platform secure, prevent abuse and fix faults — our legitimate interests (Art. 6(1)(f) GDPR).
• To process room photos and optional AI features — your consent, given by choosing to use them (Art. 6(1)(a) GDPR). You can stop at any time.
• To meet legal obligations where they apply (Art. 6(1)(c) GDPR).

We do not sell your data, and we do not use your content to train third-party foundation models.

• Lovable Cloud — hosting, database, file storage and authentication.
• Google Gemini (via the Lovable AI Gateway) — generates copilot replies, extractions and room analysis. Content is sent only to produce your result.
• Pexels — stock photo search for the moodboard. Only your search terms are sent; your account is not identified.

Where processing happens outside the EEA, transfers rely on the European Commission's Standard Contractual Clauses.

Your content stays until you delete it or delete your account. Journal entries are periodically compressed into dated summaries so that older detail is reduced rather than kept indefinitely. Deleting your account removes your profile, conversations, journal, memory, sketches, plans and authentication record; backups age out within 30 days.

Under the GDPR you can request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it at any time without affecting prior processing.

You can exercise most of these directly in the app: edit or delete individual memories in the Memory Centre, edit your profile, and permanently delete your account from Settings. For anything else, email us. You also have the right to complain to your local supervisory authority.

Access to your data is protected by authentication and row-level database policies, so your records are only readable by your own account. Traffic is encrypted in transit.

FlowSpace is not intended for anyone under 16.

If we make a material change we will update this page and the date above, and notify you in the app before the change takes effect.