Privacy notes

What stays local

Credentials configured in your local MCP server, such as downstream API keys and service tokens, are not intentionally collected by flowifai. The broker runs beside that MCP server and uses a separate flowifai enrollment credential to talk to the backend.

What the cloud can store

The backend may store account, organization, authentication, billing, registered tool metadata, tool descriptions, input schemas, policy, approval tickets, audit records, setup lifecycle events, call arguments, execution results, and coarse analytics needed to operate and improve the service.

Any value your MCP server exposes in tool metadata, call arguments, or execution results can be sent to the backend. Avoid routing secrets or highly sensitive payloads through ungroomed tool arguments and results.

Analytics

Product analytics are intentionally coarse and allowlisted. Browser and backend analytics are designed to exclude raw commands, hostnames, paths, server names, tool labels, schemas, predicates, arguments, execution results, user-entered text, and email addresses. Account, authentication, billing, and support systems may still store email addresses as ordinary account or customer data.

Retention and deletion

Approval and audit records are retained so operators can review what happened. Public launch retention controls are still simple; if your evaluation requires a specific retention period, deletion workflow, or data-processing commitment, contact the team before using flowifai with sensitive production workflows.

Third-party services

flowifai may use third-party providers for authentication, billing, infrastructure, analytics, and communications. Those providers receive only the data needed for their role in the service.

Who operates flowifai

flowifai is a product of Last Ridge LLC. Privacy questions can be sent toarmen@flowif.ai.