FLOWLITH
Privacy Policy
Flowlith and IRIS AI
Version date 1 October 2026
This Policy explains how Flowlith handles personal information in connection with Flowlith and the IRIS AI agent interface. It covers account holders, website visitors and people whose information is processed through customer-configured workflows. It explains the distinction between our own purposes and processing performed for a customer.
Flowlith provides the IRIS AI agent interface. References to 'Flowlith', 'we', 'us' and 'our' mean the legal operator identified at the end of this Policy. Our correspondence address is 1/266, THAMARASSERY VIA, Kudathai, Kozhikode, Kerala 673573, India. Website: www.flowlith.com. Privacy, support and grievance contact: Jubsan at jubsan@flowlith.com.
We determine the purposes of processing for account administration, subscriptions, usage billing, support, security of our service, legal records and our own permitted communications. For personal data in a business customer's configured workflows, we generally act on that customer's instructions as its processor or subprocessor. The customer determines why the information is used and is usually its controller or data fiduciary. Roles depend on what actually happens, not solely on contractual labels.
If an organisation uses IRIS to contact you, process your records or operate its workflows, its own privacy notice also applies. Contact that organisation about its purposes and instructions. You may contact us for help identifying the responsible customer or handling a request. We remain responsible for obligations that apply directly to our own processing.
Category | Examples and source |
|---|---|
Account and contact data | Email address, name or business details where supplied, account settings, subscription details, correspondence and records of authentication events. |
Billing and usage data | Razorpay payment references and status, invoice and tax details, purchased credits, expiry information, metered use and billing adjustments. Payment credentials are collected through the relevant payment flow. |
Customer Content | Prompts, conversations, uploaded files, agent instructions and memory, generated outputs, approval records and data retrieved from connected systems. |
Connected-service data | Authorised messages, social or messaging account details, repository or workflow information where enabled, CRM/customer records, integration tokens and other information needed for the selected integration. |
Voice data where enabled | Audio, recordings, transcripts, telephone numbers and call metadata, depending on the customer's enabled features and instructions. |
Technical and support data | IP address, device/browser information, request and event logs, errors, security events, support messages and relevant troubleshooting material. |
Not every category is processed for every account. The features you enable, content you provide, connected permissions and workflow instructions determine much of the information processed. Information may come directly from you, your organisation, connected services, people communicating with an agent, and service providers returning results or payment confirmations.
Customer Content may include confidential business information, health details, financial information or data about children even though account holders must be adults. Supply only what is needed and ensure the necessary authority and safeguards. Payment-card security codes, one-time passwords for other accounts and unrelated credentials should not be included in ordinary prompts or support messages. Integration credentials should be supplied only through the intended connection mechanism.
We use account and service information to authenticate users, operate the selected plan, maintain account preferences, meter and bill usage, manage credits, provide support, identify errors, prevent abuse, protect the service and meet legal obligations. We process Customer Content to execute the customer's authorised workflows, generate responses, perform approved actions and provide necessary operational support.
For processing subject to the EU or UK GDPR, our independent processing may rely on performance of a contract with an individual, compliance with a legal obligation, consent, or a legitimate interest where the law permits it and the interest is not overridden by the person's rights. Relevant interests include operating and securing the service, administering business relationships and resolving problems. Contract with an organisation does not automatically provide a contract basis for every employee's or end-user's data. Additional conditions apply to special-category information.
For Indian processing, we rely on the grounds permitted by the Indian law applicable to the activity at the relevant time. Where the Digital Personal Data Protection Act, 2023 applies and the relevant provisions have commenced, this means consent or the specific legitimate uses permitted by that Act, with applicable exemptions considered for the actual processing. GDPR 'legitimate interests' are not treated as a universal Indian permission. Requirements under the IT Act, applicable rules and sector-specific law are considered separately.
Where we act as a processor, we follow documented lawful customer instructions and the business data-processing terms in Schedule A of the Terms and Conditions. The customer must establish its lawful basis and give appropriate notices. We do not treat acceptance of our Terms, a customer's subscription payment or continued website use as blanket consent on behalf of everyone mentioned in its content.
IRIS uses AI to interpret instructions, process supplied information and produce outputs or actions. Necessary content may be sent to inference infrastructure and model providers. The model, route or version can change; a change of model does not remove restrictions on the use, recipients, security or retention of personal information.
The founder and authorised contributors or support personnel may access information where necessary to operate a configured service, troubleshoot a reported problem, investigate abuse or meet a legal duty. Such access must be limited to the task and subject to confidentiality obligations. Personal access is not authorised for curiosity, personal projects or unrelated use.
Service operation may include reviewing failures and adjusting the customer's own workflows. Reuse of identifiable Customer Content for training general-purpose models, unrelated demonstrations or independent product-development purposes is not authorised merely by these Terms. A separate use requires clear information about that purpose and an appropriate lawful basis, including a separate opt-in where consent is needed. We may use genuinely anonymised statistics that cannot reasonably identify a person; aggregation or removal of names alone is not assumed to achieve anonymisation.
External AI providers can have different logging, retention and training practices. We must select routes and contractual settings consistent with the permissions and restrictions applicable to the data. We do not make a blanket representation that every model provider has zero retention. Provider-specific processing or retention that affects a customer's data must be disclosed as required before that processing. Contact jubsan@flowlith.com for the current provider information relevant to your deployment.
Provider or category | Relevant role |
|---|---|
Cloudflare | Application delivery, cloud functions, databases, storage, security and AI services to the extent used by the enabled feature. |
Modal | Execution of AI workloads and related runtime infrastructure, including data handled by the selected Modal product. |
OpenRouter and downstream model providers | Routing and running model inference. The receiving provider depends on the approved route; changes remain subject to applicable authorisation and disclosure obligations. |
GitHub and GitHub Actions | Development/deployment workflows and any customer-authorised repository or automation integration. GitHub does not receive all Customer Content merely because it hosts our code. |
Meta | WhatsApp, Instagram, Facebook or other Meta integrations enabled by the customer, subject to the applicable product and permissions. |
Razorpay | Processing payments, recurring-payment mandates where authorised, refunds and relevant fraud/compliance checks. |
Other necessary providers | Email/authentication delivery, telecommunications where enabled, and other disclosed operational providers. Applicable notice and authorisation requirements must be met before sharing covered data. |
Only information relevant to the provider's role and configured service should be transmitted. A recipient may act as our processor, the customer's directly contracted provider or an independent controller, depending on the arrangement. The business processing schedule requires appropriate contractual protection and any necessary customer authorisation. We will provide the identities, roles and relevant processing locations needed for that process; proprietary model details do not justify withholding legally required recipient information.
We may disclose information to professional advisers bound by appropriate duties, in response to a valid legal requirement, to investigate or address unlawful conduct or threats where legally permitted, or in a genuine corporate transaction with suitable confidentiality and continued protection. We will provide legally required notices. This Policy does not authorise sale of identifiable Customer Content or its disclosure for unrelated third-party advertising.
Flowlith operates in India. Cloud and AI processing may occur in other countries depending on the product, provider and approved route. We do not promise India-only storage, a dedicated VPS for each account or customer-hosted deployment. A selected compute region does not by itself establish the location of every log, backup or downstream provider.
For a restricted transfer governed by the EU or UK GDPR, the relevant parties must establish the appropriate legal mechanism, such as an applicable adequacy decision or properly completed contractual safeguards, and any required assessment or supplementary measures before transfer. For Indian data, applicable Indian transfer restrictions and any sector-specific conditions apply separately. We will provide information about relevant safeguards and how to obtain a copy, subject to lawful redaction of unrelated confidential information, on request to jubsan@flowlith.com.
While an account is active, Customer Content is kept as needed for its configured service, saved history and lawful instructions, subject to applicable deletion rights and any more specific disclosed feature setting. Seven days is the account-deletion period; it is not a statement that all active-account content automatically expires seven days after creation. You may request earlier deletion of specific information where the applicable right or feature permits it.
When the account holder confirms account deletion in the dashboard, we close access, stop future renewals and automatic top-ups, disable future agent activity, and delete ordinary account-associated Customer Content from systems and copies under our control within seven days. This covers stored conversations, uploaded content, agent memory, recordings/transcripts where held and linked integration credentials. We also instruct relevant processors to delete covered copies. Stop-renewal alone does not trigger account deletion.
The seven-day period applies to our ordinary storage and backup copies. Any necessary provider-specific retention beyond that period must be identified before the affected processing, with its reason and duration, and be lawfully agreed. Where retained backup information cannot yet be removed under an agreed lawful exception, it must be protected and excluded from normal use until deletion. Restoring a backup must not permanently resurrect a completed deletion request.
Narrow exceptions apply for records genuinely required by law, a valid legal hold or the establishment, exercise or defence of legal claims. These can include invoices, tax/payment records, evidence of consent or cancellation, and mandatory security logs. Statutory accounting records may require retention for eight financial years, subject to the record and applicable law. Where the CERT-In directions apply, relevant ICT logs must be retained for at least the required rolling 180-day period in India. A legal obligation affecting a limited record does not justify retaining the entire conversation history.
Retained exception records are restricted to the relevant purpose and deleted or irreversibly anonymised once that purpose and mandatory period end. Technical and support records are kept only for their documented operational, security, complaint or legal purpose, with minimisation of unnecessary content. We will explain the relevant retention period or criterion for your data on request. Independent recipients may have their own lawful records; we will explain our role and assist where appropriate.
Export or ask for return of information you need before confirming account deletion. Completed external actions and recipients' independently held copies cannot necessarily be recalled by deleting a Flowlith account. Deletion does not extinguish a refund entitlement, and limited billing records may be used to complete an outstanding refund or resolve a payment dispute.
Flowlith uses email one-time passwords for customer sign-in. Protect access to your email account and do not share codes. Account authentication works alongside the safeguards and responsibilities described below.
We are responsible for implementing reasonable technical and organisational safeguards appropriate to the information and risk, including restricting administrative access, protecting connected credentials, managing authorised personnel and service-provider access, and maintaining deletion and incident procedures. The security of an integrated workflow also depends on customer permissions and the connected provider. No system is entirely free of risk; this does not reduce our applicable security obligations.
If we become aware of a breach affecting data processed for a business customer, we will notify that customer without undue delay and within the contractual deadline in Schedule A, without waiting for a significant-risk finding or a completed investigation. We will investigate and provide updates. Where law requires reporting to a regulator, CERT-In or affected individuals, we will meet the applicable trigger and deadline. Different reporting regimes have different requirements; a single generic risk threshold does not replace them.
Depending on the law and our role, you may have rights to information and access, correction, deletion, restriction, objection, portability, withdrawal of consent, grievance redressal or nomination. These rights have different conditions and exceptions; portability is not represented as a universal Indian statutory right. Statutory rights under phased legislation apply when the relevant provisions commence. Additional contractual choices, including dashboard account deletion, remain available as described.
Send requests to jubsan@flowlith.com and identify the account, interaction or record concerned. We may request proportionate information needed to verify identity or authority, using the least intrusive method reasonably available. Do not send identity documents unless requested through an appropriate channel. Where a business customer controls the data, we will route the request and assist it; we will address our own legal duties directly.
We will respond without undue delay and within the applicable legal period. Where the GDPR applies, the usual period is one calendar month, with an extension only where permitted and with the required timely explanation. We acknowledge consumer complaints within 48 hours and address them within one month, or sooner where law requires. Complaints may also be made to the competent data-protection authority, consumer authority or court. Contacting us does not waive those rights.
You may stop subscription renewal, disconnect integrations, change available approval settings or withdraw optional consent. Withdrawal does not retrospectively invalidate lawful earlier processing. If information or permission is necessary for a requested feature, withholding it may prevent that feature from working; we will explain the consequence. Marketing messages, if sent, must offer a practical opt-out and comply with applicable consent requirements.
Authentication, session and security technologies support essential service functions. Where optional analytics, advertising or similar tracking is used, we will identify its purposes and obtain consent before activation where required. Relevant controls must allow refusal and later withdrawal as required by law. Continuing to browse is not treated as consent to optional tracking. Browser controls may also be used, although disabling essential storage can prevent sign-in or other requested functions. The current website controls or accompanying cookie information identify the technologies actually deployed.
Flowlith accounts are for people aged 18 and above. Business workflows may nevertheless contain information about children. The responsible customer must have the required authority, parental or guardian consent where needed and appropriate safeguards; we must comply with duties applying to our own processing. If such information appears to have been processed without the required basis, contact us so we can restrict the relevant processing and arrange correction or deletion as appropriate.
IRIS can perform automated actions under customer-configured permissions and approval rules. This Policy does not authorise a solely automated decision with legal or similarly significant effects where the applicable legal conditions are not met. The responsible organisation must provide required notices, review mechanisms and human involvement. Contact that organisation or jubsan@flowlith.com about an affected workflow.
We will publish revisions with an updated version date and give appropriate notice of material changes. Where practicable, material adverse changes receive at least 30 days' notice. Urgent legal or security changes may take effect sooner with prompt explanation. New purposes or disclosures requiring consent or other authorisation will not be justified solely by posting a revised Policy or by continued use. Questions about this Policy should be sent to Jubsan at jubsan@flowlith.com or the company address in section 1.
Legal operator: Mantiq Private Limited, trading as Flowlith, CIN U62020KL2026PTC102848, incorporated in India on 28 April 2026.