▸ legal // privacy policy
Privacy Policy
Last updated: July 19, 2026
This policy explains what personal data we (FlowLogic, operated by Furkan Güven) collect when you use learnflowlogic.com and a hosted engine, why, where it is stored, and your rights. Contact for anything privacy-related: [email protected].
What we collect
- Account data — email, name, and authentication identifiers, managed by our sign-in provider (Clerk). We do not see or store your password.
- Learning progress — assessment answers, module status, and unit completion, so the curriculum can adapt to you.
- Billing data — handled by Lemon Squeezy as merchant of record; we receive subscription status and customer/subscription identifiers, never your card details.
- Engine data — the flows, connection credentials, and run data inside your dedicated engine. Credentials are encrypted at rest; engine telemetry to the upstream software vendor is disabled. This data is yours — we access it only for support you request, or operations (backups, restores, incident response).
- Operational logs— standard server logs and uptime checks on your engine’s public endpoint.
We do not run third-party advertising or sell personal data.
Where data lives
Hosted engines run on our managed servers in Germany (Hetzner). Portal traffic is routed through Cloudflare. Nightly encrypted-at-rest backups of engine databases are retained for 7 days on the engine server, with an off-site copy held by the operator.
Sub-processors
| Provider | Location | Purpose |
|---|---|---|
| Hetzner Online GmbH | Germany (EU) | Hosted engine servers & backups |
| Cloudflare, Inc. | USA (global network) | DNS, CDN, portal connectivity |
| Clerk, Inc. | USA | Authentication |
| Lemon Squeezy, LLC | USA | Merchant of record, billing |
| UptimeRobot (itrinity s.r.o.) | EU | Uptime monitoring of public endpoints |
We will update this list before adding sub-processors that touch personal data. Transfers outside the EEA rely on the providers’ EU-approved safeguards (standard contractual clauses or adequacy decisions).
Retention
Account and progress data: while your account exists, deleted on verified request. Engine data: for your subscription plus a 14-day grace period after cancellation, then permanently deleted with the server. Backups age out within 7 days of deletion.
Your rights
Under the GDPR and similar laws you may request access, correction, export, or deletion of your personal data, and object to or restrict processing. Email [email protected]; we respond within 30 days. If we process data on your behalf inside your engine, the Data Processing Agreement governs that relationship.
Cookies
The portal uses only cookies necessary for sign-in sessions (set by Clerk). No advertising or cross-site tracking cookies are set.