Legal

Privacy Policy

Last updated: 3 October 2026

Flownato is operated by UI JOURNEYS, a sole proprietorship based in Kota, Rajasthan, India ("we", "us"). This policy explains how we handle personal data through the Flownato website and its integrations, including the ChatGPT and Codex plugin, and the choices you have. Learn more about Flownato and UI JOURNEYS.

1. What we collect

Accounts: Google account email, display name, profile image, and your onboarding preferences. Google verifies your identity; we do not receive or store your Google password.
Access and billing: membership status, referral redemptions, and the payment provider subscription, payment, plan, currency, status, and billing-period identifiers needed to provide access and support. Razorpay (India) and Dodo Payments (international checkout, when available) process payment credentials; we do not receive or store your full card number, CVV, or UPI PIN.
Usage: Our self-hosted OpenPanel on Microsoft Azure records page visits, clicks, feature usage, referral sources, signup steps, and technical failure events. It uses a browser identifier and, after sign-in, our internal user identifier to help us understand product usage. We attach your account display name to your analytics profile so our team can recognize your activity when providing support and improving the product. Your email is not sent to OpenPanel. OpenPanel automatically reconstructs interactions on eligible pages to help us understand navigation and usability problems. Recordings show page content and styling, catalog images, search and filter input, selections, saved items, account display names, and research workspace interactions. Email fields and displayed email addresses, passwords, authentication and transfer credentials, and payment forms are blocked or redacted. Authentication callbacks and billing pages are excluded. Access tokens are removed from recorded URLs. OpenPanel uses connection information to derive approximate country or region. Raw events expire after 90 days and replay after 30 days, with private backups expiring after 30 days (plus 7 days of soft-delete recovery). Historical data in our previous Azure analytics workspace is soft-deleted with a 14-day recovery period; our Clarity project has been deleted. Aggregate statistics and profile summaries may remain longer; you can request deletion. Reports distinguish known testing from other activity.
Figma transfers: when you create an export, we retain your user identifier, the selected Flownato resource identifiers, an immutable export manifest, a cryptographic digest of the temporary token, its expiry, and access and completion metadata. We do not store the raw transfer token. The plugin does not read or upload content already present in your Figma file.
ChatGPT and Codex plugin: connecting Flownato authorizes access to your Flownato account and library entitlements. Research tools receive the search terms and app, flow, or screen references needed for your request, rather than your full conversation history. Account controls can return your account identifier, display name, and email to the host. We record tool usage to enforce account limits. Separate product analytics record bounded tool and interface events, catalog references, outcomes, and timing with your internal account identifier in our self-hosted OpenPanel. When ChatGPT or Codex supplies an approximate location hint, optional plugin analytics may also include country, region, and city. Location is marked unknown when it is not supplied; we do not collect precise coordinates or use the host proxy’s IP as your location. These analytics do not include raw search terms or conversation text. The plugin interface does not use session replay. Your use of ChatGPT or Codex is also subject to the host's own data practices.

2. What we use it for

To run the service: signing you in, remembering your preferences, managing access, and understanding which parts of the library are useful. We do not sell or rent personal data, and we don't run third-party advertising.

3. Processors and where data lives

Data is stored with established cloud infrastructure providers, with our primary database hosted in India. Razorpay processes India payments. For international checkout, we share your account email, display name, selected plan, billing country, and an internal checkout reference with Dodo Payments, which handles payment, tax, invoicing, and subscription management as merchant of record. Microsoft processes the limited analytics data described above. When you explicitly import a transfer, the selected reference images and their source metadata are added to your Figma file and are then handled under your agreement with Figma. Access is restricted and all data is encrypted in transit.

4. Service messages

We may send essential account or service messages. Any optional email will include a clear way to unsubscribe.

5. Your rights

You can ask us at any time to show, correct, or delete the personal data we hold about you, or to close your account. Write to hi@uijourneys.com and we'll act within 7 days. This policy is intended to meet India's Digital Personal Data Protection Act, 2023; the same contact serves as our grievance channel.

6. Cookies and local storage

We do not enable advertising storage. The site remembers your signed-in session and an anonymous analytics identifier in browser storage. Session replay is enabled by default on eligible pages, and OpenPanel connects these recordings with your analytics session. Ordinary page content, form interactions, search, and workspace content remain visible. Email, passwords, payment details, and access credentials are blocked or redacted as described above. Website and plugin-interface analytics respect supported Do Not Track and Global Privacy Control signals exposed by the browser. ChatGPT and Codex do not necessarily forward those browser preferences to Flownato's server. In the plugin's connected-account view or native Flownato settings, you can turn off Optional plugin analytics. This choice applies across your account's plugin connections and stops new optional tool and interface analytics, including events still waiting to be sent. Turning analytics back on does not send that earlier queue. This control does not change website analytics or delete records already collected. Records needed for account access, security, and usage limits remain active. You can block site storage in your browser or contact hi@uijourneys.com about analytics collection and deletion. Disconnecting Flownato in plugin settings revokes that connection; it does not delete your account or previously collected records. Contact us to request account or data deletion.

7. Children

The service is not directed at children under 18, and we don't knowingly collect their data.

8. Changes

If this policy changes materially, we'll say so on the site or by email.