1. Data we process
We process account details such as name, email and password hash, along with order and subscription information, technical data such as IP address, usage counters, gateway key identifiers and hashes, provider connection details, and encrypted provider credentials. Paddle handles card details entered in its checkout. We receive the order, customer and subscription information needed to provide access and support.
2. Provider credentials
Provider API keys are encrypted at rest using AES-256-GCM with a server-side key. They are used only to forward requests to the provider you selected. We never display a stored provider key again and never share it except by transmitting it to that provider as part of your request.
3. Purposes and legal bases
We process account, subscription and provider connection data to take steps you request before entering a contract and to deliver the service. We use limited technical data to protect accounts, prevent abuse and operate the service based on legitimate interests, subject to your rights. We retain or disclose information as necessary to meet legal obligations or exercise rights in legal proceedings.
4. Requests and provider data
The gateway processes your text requests to forward them to the provider you select and return the response. It does not save prompts or responses as conversation history. Your provider processes the content under its own terms, privacy policy and account settings. Send personal data only when you have a lawful basis and are authorized to do so.
5. Sharing and international transfers
Data may be processed by hosting and infrastructure suppliers, the API provider you select, and Paddle as the authorized reseller responsible for checkout, billing and payment support. These services may process data outside Brazil. Transfers subject to the LGPD must use a mechanism allowed by Article 33 and ANPD rules. Use the contact below for information about recipients and safeguards.
6. Retention
Sessions expire after seven days and monthly usage counters after 32 days from their first recorded request. Removing a provider connection removes its stored credential from the application database. We retain account data while needed to provide the service and retain billing, security and support information as necessary to meet legal obligations, resolve disputes or protect the service.
7. Your rights
Under the LGPD, you can request confirmation of processing, access, correction, information about sharing, and, where applicable, anonymization, blocking, deletion or portability. Where processing relies on consent, you can withdraw it and ask about the consequences of declining. You may object to noncompliant processing and petition the ANPD. Email the privacy contact below. We may verify your identity before disclosing or changing your data.
8. Cookies and local storage
A secure HTTP-only session cookie keeps you signed in. A preference cookie and local storage remember your language and currency. You can clear these through your browser. Paddle.js loads for localized price estimates and checkout, and Paddle may process IP, device or payment data under its own Privacy Notice.
9. Responsibility and contact
The HelloFlow service operator determines how account and service data are processed. Email contato@heelloflow.com.br for privacy requests or security reports. When a security incident poses relevant risk or harm, the controller will make the notifications required by law.
Questions? Contact us at contato@heelloflow.com.br