Privacy Policy & Google User Data Disclosures

Last Updated: July 5, 2026

At Flow Me (operated by CNPJ: 49.858.359/0001-93 - Rayan Barbieri Consultoria em Tecnologia), we are committed to protecting your privacy. This Privacy Policy explains how our virtual assistant, Balys, and the Flow Me platform access, use, store, share, and protect your personal information, specifically focusing on the data accessed through Google API Services.

1. Google User Data Accessed and Actions Requested

To deliver our core productivity features, Flow Me asks you to connect your Google account. We only access Google user data within the permissions you approve on Google's consent screen. Depending on the connectors you choose to use, Flow Me may access or act on the following Google user data:

• Google Calendar (https://www.googleapis.com/auth/calendar and https://www.googleapis.com/auth/calendar.events): calendar lists, event titles, event descriptions, dates, times, attendees, locations, recurrence rules, and reminders. Flow Me uses this access to list, read, create, update, reschedule, and delete calendar events only when you ask Balys or the Flow Me app to manage your schedule.
• Gmail (https://www.googleapis.com/auth/gmail.modify): message metadata such as sender, recipients, subject, dates, thread information, snippets, labels, and message body content. Flow Me uses this access to search, open, read, summarize, and create draft replies at your request. Balys does not send email for you.
• Google Docs (https://www.googleapis.com/auth/documents): document titles, metadata, structure, text content, comments or formatting context available through the Docs API. Flow Me uses this access to find, read, create, draft, edit, and format documents based on your instructions.
• Google Sheets (https://www.googleapis.com/auth/spreadsheets): spreadsheet titles, sheet names, cell values, formulas, formatting context, and table structure. Flow Me uses this access to read, analyze, create, update, and organize spreadsheet data when you request spreadsheet work.
• Google Drive (https://www.googleapis.com/auth/drive.readonly): file and folder names, metadata, MIME types, search results, and text-readable file contents for files you ask Flow Me to find or read. Flow Me uses Drive access to locate files by natural names such as "Finance 2026" and to route Docs or Sheets work to the proper Google connector without asking you for technical IDs.

2. Data Usage and Purpose

We use Google user data exclusively to provide and improve user-facing Flow Me features that you can see in the app: Balys assistant responses, calendar management, email reading and draft assistance, document editing, spreadsheet analysis, and Drive file discovery. Data is retrieved and processed only in response to your direct, user-initiated commands or settings you enable, such as asking "What is scheduled for tomorrow?", "Read my last email", "Create a new document with my meeting notes", or "Analyze my finance spreadsheet".

The assistant processes your natural language inputs, searches your connected Google account internally, resolves file names, spreadsheet names, messages, and folders without exposing IDs to you, and retrieves only the relevant information needed to answer your question or complete your requested task. We do not use Google user data for advertising, retargeting, personalized ads, data brokerage, credit-worthiness decisions, or unrelated marketing profiles.

3. Data Sharing and Third-Party Disclosures

Flow Me does not sell, rent, lease, broker, or disclose Google user data to advertisers, data brokers, information resellers, or surveillance services. We share Google user data only in the limited cases needed to provide the product you requested:

• AI API service providers: User commands and relevant Google content, such as text from an email, document, spreadsheet, or readable Drive file, may be sent to secure AI model API providers such as OpenAI, Anthropic, or Google Gemini so Balys can understand your instruction, summarize content, draft text, edit documents, or analyze spreadsheet data for you.
• Infrastructure and database providers: We use secure hosting, database, logging, and storage vendors only to operate Flow Me, authenticate users, store encrypted credentials, run the app, and protect the service.
• Legal and security purposes: We may process or disclose data only when required to comply with applicable law, enforce our rights, investigate abuse, or protect the security of Flow Me and its users.

We do not allow AI providers or infrastructure vendors to use your Google user data to train their own models or to build unrelated products. Flow Me's use and transfer of information received from Google APIs is limited to providing or improving user-facing Flow Me features and complies with the Google API Services User Data Policy, including the Limited Use requirements.

4. Data Storage and Protection

We take the security of your data seriously and apply the following protective measures:

• Secure Token Storage: Your Google OAuth credentials (access tokens and refresh tokens) are encrypted at rest and stored securely in our databases for as long as the connector remains connected.
• Encryption in Transit: All data transmitted between Google APIs, our backend servers, and your clients (WhatsApp interface or the Web App dashboard) is encrypted in transit using HTTPS/TLS.
• Access Isolation: We enforce strict PostgreSQL Row Level Security (RLS) and app-level controls to ensure that only the authenticated account owner can trigger operations on their connected integrations.
• Limited Logs: We do not intentionally log Google OAuth tokens, passwords, or full Google document, spreadsheet, file, or email bodies. Diagnostic logs are limited to operational metadata needed to debug and secure the service.
• Human Access Limits: Flow Me personnel do not read Google user data unless you ask for support involving specific content, access is needed for security or abuse investigation, or access is required by law.

5. Data Retention, Deletion, and Revocation

We retain Google OAuth credentials only while your Flow Me account is active and the relevant Google connector remains connected. Google content retrieved to answer a command is used for that assistant workflow and may be reflected in the conversation, document, spreadsheet, event, draft, or app record you asked Flow Me to create or update.

• Self-Service Disconnection: You can disconnect your Google account from Flow Me at any time through the Integrations dashboard in the web panel. Disconnecting deletes the stored OAuth credentials and access tokens for that connection from our database and stops future access through that connector.
• Full Account Deletion: You can request the complete deletion of your Flow Me account and all stored history at any time. To request deletion, you can use the account settings inside the web application or contact us at support@flow-me.online. We will permanently delete all your data within 30 days.
• Revoking Consent via Google Settings: You can also revoke Flow Me's access to your Google account at any time via the Google Security settings page at myaccount.google.com/permissions.

After disconnection or deletion, Flow Me will not continue accessing your Google account. Residual copies may remain for a limited period in encrypted backups or security logs and are removed according to our backup rotation and legal obligations.

6. Compliance with Google API Services User Data Policy

Flow Me's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Contact Information

If you have any questions about this Privacy Policy or how we handle your data, please contact our support team:

Email: support@flow-me.online
Operator: Rayan Barbieri Consultoria em Tecnologia (CNPJ: 49.858.359/0001-93)
Address: Brazil