Privacy Policy

Last Updated: November 13, 2025 Welcome to FlowPilot Studio ("FPS" or the "Service"), operated by FPS inc. LLC ("we," "us," or "our"). This Privacy Policy explains how we collect, use, disclose, and protect your information when you access or use our website at flowpilot.studio (the "Website"), our software-as-a-service (SaaS) application, and any related services (collectively, the "Service"). We are committed to protecting your privacy and handling your data responsibly. By using the Service, you consent to the practices described in this Privacy Policy. If you do not agree, please do not use the Service. This Privacy Policy is incorporated into our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service.

1. Information We Collect

We collect information to provide, improve, and secure the Service. The types of information we collect include:

1.1 Personal Information

• Account Information: When you create an Account, we collect details such as your name, email address, organization name, and payment information (processed via third-party providers).
• Contact Information: If you contact us for support or inquiries, we may collect your name, email, and any details you provide.
• Usage Information: We automatically collect data about your interactions with the Service, such as IP address, browser type, device information, pages visited, and timestamps.

1.2 User Data from Integrations

• The Service integrates with your Flow Production Tracking (FPT, formerly ShotGrid) instance via a REST API wrapper. When you connect your FPT account and submit natural language queries, we temporarily access and process data from your FPT database ("User Data") to generate visualizations, charts, and tables.
• Important Note on Data Storage: We do not store any of your production data or User Data on our servers or in our databases. All User Data is pulled directly from your FPT instance in real-time, processed transiently in memory to fulfill your queries, and discarded immediately after the visualization is generated. No copies or backups of User Data are retained by us.

1.3 Automatically Collected Information

• Cookies and Tracking Technologies: We use cookies, web beacons, and similar technologies to collect information about your preferences and usage patterns. This helps us remember your settings and analyze Service performance. You can manage cookie preferences through your browser settings.
• Analytics Data: We use third-party analytics tools (e.g., Google Analytics) to collect aggregated data on Service usage, such as session duration and feature interactions.

1.4 Other Information

• Feedback and Communications: Any feedback, suggestions, or other information you voluntarily provide.
• We do not collect sensitive personal information (e.g., racial or ethnic origin, political opinions) unless you provide it voluntarily, and we advise against doing so.

2. How We Use Your Information

We use the information we collect for the following purposes:

• To Provide the Service: To authenticate your Account, process payments, connect to your FPT instance, interpret natural language queries, and generate AI-powered visualizations.
• To Improve the Service: To analyze usage patterns, troubleshoot issues, and enhance features, including training AI models using anonymized and aggregated data (e.g., query patterns, not actual User Data content).
• To Communicate with You: To send service-related emails (e.g., updates, billing notifications) and respond to your inquiries. With your consent, we may send promotional materials.
• For Security and Compliance: To detect and prevent fraud, abuse, or security threats, and to comply with legal obligations.
• For Analytics and Research: To generate insights into Service usage, always in an anonymized form. We do not use your User Data for any purpose other than providing the requested visualizations. Since we do not store User Data, it is not used for training AI models or shared in any identifiable form.

2.1 AI and LLM Usage

FlowPilot Studio uses large language models (LLMs) to interpret your natural language queries and generate instructions for API calls to your FPT instance. Importantly:

• The LLM never receives or processes your actual User Data or customer data. It operates solely on metadata, API capabilities, and anonymized query structures provided by FPT's REST API wrapper.
• For tasks like creating charts, tables, webhooks, or other features, the LLM translates queries into API instructions, which are executed directly against your FPT instance without exposing any data to the LLM. This ensures complete segregation between your data and LLM interactions.

3. Sharing Your Information

We do not sell your personal information. We may share information as follows:

• Service Providers: With third-party vendors who assist us in operating the Service (e.g., payment processors like Stripe, hosting providers like AWS, analytics tools). These providers are contractually obligated to protect your data and use it only for the services they provide to us. Note that LLM providers receive only anonymized queries and metadata, never User Data.
• FPT Integration: When you authorize the connection, we access your FPT data solely through the API, but no data is shared back to FPT or any third party without your consent.
• Legal Requirements: If required by law, subpoena, or government request, or to protect our rights, safety, or property.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.
• With Your Consent: For any other purpose with your explicit permission. We ensure that any shared information is limited to what is necessary and protected by appropriate safeguards.

4. Data Security

We implement reasonable administrative, technical, and physical security measures to protect your information from unauthorized access, loss, or alteration. For example:

• Encryption of data in transit (e.g., via HTTPS).
• Access controls and regular security audits.
• Secure handling of API connections to your FPT instance.
• Strict segregation between customer data and LLM calls, ensuring LLMs query only FPT's API capabilities without accessing data. However, no method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. You are responsible for maintaining the security of your Account credentials and FPT API keys. Since we do not store User Data, the risk of data breaches involving your production data is minimized.

4.1 Upcoming Transparency Feature

To provide full transparency, we are introducing a feature that allows you to review all LLM calls directly within the FlowPilot interface. This will show the exact inputs and outputs of LLM interactions, confirming that no customer data or User Data is ever included—only anonymized queries, API metadata, and generated instructions. This update will be available soon to all users.

5. Data Retention

• Personal and Account Information: Retained for as long as your Account is active and as needed to comply with legal obligations (e.g., tax records). Upon Account deletion, we delete or anonymize your information within [X] days.
• User Data: Not retained at all; processed in real-time and discarded immediately.
• Usage and Analytics Data: Retained in anonymized form for up to [X] years for Service improvement.

6. Your Rights and Choices

Depending on your location (e.g., under GDPR, CCPA, or similar laws), you may have rights such as:

• Access: Request a copy of your personal information.
• Correction: Update inaccurate data.
• Deletion: Request deletion of your data (subject to legal exceptions).
• Opt-Out: Opt out of marketing communications or certain data processing.
• Portability: Receive your data in a transferable format.
• Do Not Sell: We do not sell data, but CCPA users can opt out of any potential future sales. To exercise these rights, contact us at [support@flowpilot.studio]. We may verify your identity before responding. Responses are provided within applicable legal timelines (e.g., 30 days under GDPR). You can also:
• Manage cookies via browser settings.
• Revoke FPT integration access at any time through your Account.

7. International Data Transfers

We operate in [Your Jurisdiction, e.g., the United States], and your data may be processed there. If you are in the EU/EEA or another region with data protection laws, we use mechanisms like Standard Contractual Clauses to ensure adequate protection for transfers.

8. Children's Privacy

The Service is not intended for children under 13 (or 16 in some jurisdictions). We do not knowingly collect information from children. If we learn we have collected such data, we will delete it promptly. Contact us if you believe we have child data.

9. Third-Party Links and Services

The Service may link to third-party sites or integrate with services like FPT. We are not responsible for their privacy practices. Review their policies separately.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted here with an updated "Last Updated" date. Significant changes may be notified via email or in-Service notices. Continued use constitutes acceptance.

11. Contact Us

For questions, requests, or concerns about this Privacy Policy or our data practices, contact us at: Email: [support@flowpilot.studio] Website: flowpilot.studio Thank you for trusting us with your information.