The short version: we collect the little we need to run your account and your bots. We never sell your data. Bot tokens and model keys are encrypted at rest. You can access, export, or delete your data any time by emailing support@gramflow.io.
Who we are
Gramflow is a product of Nodeflow Labs ("we", "us"). This policy explains what data
we handle when you use the Gramflow website (gramflow.io) and app
(app.gramflow.io), and your rights over it. It applies to you as an account holder — not
to the end users of the Telegram bots you build (see Data your bots process).
What we collect
Account information
Your name and email address when you sign up, and — if you sign in with Google or GitHub — the basic profile they return. If you request beta access, we also store what you tell us on the form (your role, what you plan to build, and whether you run bots today) to prioritise invites.
Bot configuration
The flows you build, your bot's Telegram token, and any model-provider keys you add. Tokens and keys are encrypted at rest (AES-256) and are never shown back to you in full or shared.
Data your bots process
To run your bot, we process the Telegram updates it receives — messages, button taps, and per-chat state — and keep a short-lived log of each run so you can debug it. This data belongs to you and your bot's users; we process it on your behalf to operate the service, and you are responsible for telling your own users how their data is used.
Usage and technical data
Basic product analytics (which features are used, aggregated) and standard server logs (IP address, browser, timestamps) to keep the service secure and working.
Why we use it
- To provide the service — run your account, build and host your bots (performance of our contract with you).
- To keep it secure and prevent abuse, and to fix and improve it (our legitimate interests).
- To send you essential emails like verification and account notices.
- To respond when you contact support.
Who we share it with
We don't sell your data. We share it only with the service providers we use to run Gramflow:
- Google Cloud — hosting and databases.
- Cloudflare — content delivery and security.
- Resend — transactional email (verification, notices).
- Product analytics — aggregated usage, to understand what to improve.
- Your chosen AI provider (OpenAI, Anthropic, or Google) — only when an AI node runs, and only the prompt for that run, using your own key and under that provider's terms.
- Telegram — inherently, since your bot runs on Telegram, under Telegram's terms.
We may also disclose data if required by law, or to protect the rights and safety of our users.
How long we keep it
We keep account and bot data while your account is active. Run logs and transient state are kept for a limited period and then removed automatically. When you delete your account, we delete or anonymise your personal data within a reasonable period, except where we must keep it to meet a legal obligation.
How we protect it
Data is encrypted in transit (TLS) and bot tokens and model keys are encrypted at rest. Access is restricted and least-privilege. No system is perfectly secure, but we work to protect your data and will notify you of a breach where the law requires it.
Your rights
Depending on where you live (including under the GDPR and CCPA/CPRA), you may have the right to access, correct, delete, export, or restrict the use of your personal data, and to object to certain processing. We do not sell or "share" personal information as those terms are defined under California law. To exercise any right, email support@gramflow.io — we won't discriminate against you for doing so.
International transfers
We and our providers may process data in countries other than yours. Where we transfer personal data across borders, we rely on appropriate safeguards (such as standard contractual clauses) as required by law.
Cookies
The app uses a small number of essential cookies to keep you signed in. The marketing site sets no advertising or cross-site tracking cookies.
Children
Gramflow isn't intended for anyone under 16, and we don't knowingly collect their data.
Changes
We'll update this policy as the product grows and post the new "last updated" date here. If a change is significant, we'll let you know by email or in the app.
Contact
Questions or requests? Email support@gramflow.io or reach us on our Telegram channel.