Privacy Policy

Account data: your name, email address, and a securely hashed password. We never store your password in plain text.

Project data: the projects, documents, and pipeline outputs you create within AgentFlow.

Provider keys: any AI provider API keys you add are stored encrypted at rest and are never exposed through our APIs.

Usage data: aggregate token usage and operational metrics used for billing limits and reliability.

To operate the service: authenticate you, run the generation pipeline, and display your projects.

To enforce fair-use limits and prevent abuse.

To improve reliability and diagnose errors. We do not sell your personal data.

When you run a generation, your prompt and the relevant project context are sent to the AI provider you select (for example Anthropic, OpenAI, Google, or DeepSeek) using your own API key. Those providers process the request under their own terms and privacy policies.

If you use the local CLI bridge, generation runs on your own machine and content is not sent to a third-party cloud provider by us.

We retain your data for as long as your account is active. You can permanently delete your account at any time from Settings → Account, which cascades to your projects, generated documents, jobs, notifications, and usage records.

Deletion is irreversible. Some records may persist briefly in backups before being rotated out.

Passwords are hashed with bcrypt. Provider keys are encrypted at rest. Access to authenticated routes is protected by signed, httpOnly session tokens.

Depending on your jurisdiction, you may have rights to access, correct, export, or erase your personal data. You can exercise erasure directly via account deletion; for other requests, contact us through the in-app feedback hub.

We may update this policy from time to time. Material changes will be reflected by updating the effective date above.