Studio FlowsStudio Flows

Privacy Policy

Last updated: 12 October 2026

This policy explains what information Studio Flows (“the Service”) collects, how it is used, and the choices you have. Studio Flows is an independent product operated by its developer as a sole proprietorship; no company has been incorporated at this time. This policy reflects how the product actually works today.

Information we collect

  • Account information. Your email address and an encrypted password (handled by our authentication provider), and the studio name you set at signup.
  • Content you create. Projects, clients and contacts, leads and deals, briefs, assets and file uploads, comments, approvals, call sheets, budgets, agreements, documents, and related production records you enter or upload.
  • Connected accounts. If you connect Google (Gmail, Calendar, Drive, Chat), Slack, or Figma, we store access tokens and the specific data you choose to link (for example an email thread or a file) so it can appear inside your projects. You can disconnect these at any time in Settings.
  • Usage and technical data. Basic log and device data needed to operate and secure the Service, including error reports when something goes wrong.

How we use information

  • To provide, maintain, and improve the Service.
  • To operate features you invoke, including optional AI features that generate summaries and drafts from your project content.
  • To secure the Service and prevent abuse.
  • To communicate with you about your account.

AI features, and what leaves the Service

Several features are powered by a third-party AI provider: the project summary, the client update and outreach drafts, the composer’s polish button, invoice and document reading, and the in-app assistant.

These run only when you invoke them. When you do, the relevant project content is sent to the AI provider so it can produce an answer. Under that provider’s API terms, content sent this way is not used to train their models. If you would rather no content left the Service, simply do not use those features; nothing runs on its own in the background.

Google user data

Studio Flows’ use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If you connect Google, we ask for the following access and use it only to run the features named beside it:

  • Gmail, read. To show a conversation you have linked to a project inside that project, so a job’s correspondence sits with its brief, assets and approvals. We read a thread only because you linked it.
  • Gmail, send. To send the reply you have written and pressed Send on. Nothing is ever sent on your behalf automatically.
  • Drive, read. To let you browse your Drive and import a file into a project, and to attach a file you pick to an email you are writing. We read a file only when you choose it.
  • Calendar, events. To show your events on the dashboard, and to create or delete the ones you make in the app.
  • Chat. To show messages in a space you have linked to a project, and to post the message you write.

We do not use Google user data for advertising, and we do not sell it. We do not use it to develop, improve or train any generalized AI or machine learning model, ours or anyone else’s. No person at Studio Flows reads your Google data except where you have explicitly asked us to (for example to investigate a problem you reported), where it is necessary for security, or where the law requires it.

Google data and the AI features

Two of the optional AI features can send Google data to our AI provider, and only at the moment you press the button that runs them:

  • The project summary fetches the Gmail threads you have linked to that project when you generate it, and includes a short gist of them, so the summary can say where the conversation stands.
  • Reading an emailed invoice or document sends that attachment, so its amounts and dates can be filled into a form for you to check before you save anything.

This is inference only. The content is sent so the provider can produce an answer, and under that provider’s API terms it is not used to train their models. If you would rather no Google content left the Service, do not use those two features; neither runs on its own.

Keeping and removing Google data

We store the access tokens for your connection, and for a linked conversation the identifier and subject needed to find it again. Message bodies and Drive files are read live and are not copied into our database, except where you deliberately import one (an attachment filed as a project document, or a Drive file imported as an asset), which then lives in your project until you delete it. Disconnecting Google in Settings, Connections deletes the stored tokens. You can also revoke our access directly from your Google account permissions.

Who processes your data

We do not sell your personal information. The Service runs on the following providers, acting on our instructions:

  • Supabase, for the database, file storage, and authentication.
  • Vercel, for hosting, application delivery, and privacy-friendly page analytics (see below).
  • OpenAI, for the AI features described above.
  • Resend, for transactional email such as invitations and review requests.
  • Sentry, for error reporting.

Separately, and only if you choose to connect them, Google, Slack, and Figma receive requests on your behalf to read or send the specific content you link.

Cookies and analytics

We do not use advertising or tracking cookies, and we do not show a cookie banner because the only cookies we set are the ones the Service needs to work:

  • Sign-in cookies, set by our authentication provider, which keep you logged in.
  • Your active studio, which remembers which studio you are working in if you belong to more than one.
  • A reviewer key on client review links, a random value that lets the person who left a comment edit or delete it later. It identifies a browser, not a person.
  • A short-lived sign-in redirect, which returns you to the page you asked for after you log in, and expires within minutes.

Some preferences, such as your theme or whether the sidebar is collapsed, are kept in your browser’s own storage and never sent to us. We measure page visits with Vercel Web Analytics, which does not use cookies and does not identify or follow you across sites.

Where your data is stored

Data is stored in the United States. If you are located elsewhere, using the Service involves transferring your information there.

Sharing you control

When you create a public share or review link (for a client review, a call sheet, or a document), anyone with that link can view the shared content without signing in. Those links can be revoked in the app. Team members and project collaborators you invite can access the projects you share with them. Information may also be disclosed where required by law or to protect rights and safety.

Data retention and deletion

We retain your data for as long as your account is active. There is no self-service delete button during the beta. Email studioflows1@gmail.com and your studio’s data, including uploaded files, will be exported or permanently deleted within 30 days of the request.

Security

Access to studio data is restricted to members of that studio through database row-level security, and file access is gated by signed, time-limited links. Passwords are handled by our authentication provider and are never visible to us.

No system is perfectly secure, and this is early-access software. Please keep your own copies of anything critical rather than relying on the Service as the only place it exists.

Your choices

  • Disconnect any connected account in Settings at any time.
  • Update or delete content you have created.
  • Revoke any share or review link you have issued.
  • Request account deletion or a data export by email.

Contact

Questions about this policy? Email studioflows1@gmail.com.