Privacy Policy

1. Information We Collect

We collect the following information:

• Information you give us: your email address, your answers when you apply for access, and the messages and feedback you send us.
• Information from X: when you sign in with X, X shares your X user ID, username, and display name with us. If we ask for it and you allow it, X also shares the email address confirmed on your X account.
• Account and usage information: your account status, your API keys (stored only as one-way hashes), the requests your agent sends through Flovia, the answers returned by data providers, usage amounts, credits, and your data-use choices.
• Payment information: if you buy credits, your wallet address, the amount, and the transaction identifiers.
• Technical information: cookies that keep you signed in and protect sign-in, records of recent requests that we use to limit abuse (including one-way hashes of IP addresses), and aggregated visit statistics for flovia.dev collected with Vercel Web Analytics, which does not use cookies.

2. Sign In with X

We use X only to confirm that you control an X account and to sign you in. We request read-only access with the tweet.read and users.read permissions, which X requires to look up your own profile, and the users.email permission when we ask for your email address. We do not read your posts, and we do not post, like, follow, or send messages on your behalf. We do not request offline access to your X account, and we store the access token X issues in encrypted form.

We do not sell information we receive from X or use it for advertising. You can remove Flovia's access at any time under Connected apps in your X settings. X describes how it handles your information in the X Privacy Policy.

3. How We Use Information

• To provide and operate our services, including sign-in, API requests, free access, credits, and refunds.
• To confirm that each account belongs to a real person and to prevent duplicate, shared, or abusive accounts.
• To review applications for access and send invitations.
• To send account, billing, and service emails, and other emails, such as product news, only if you choose to receive them.
• To improve Flovia and, where you agree, to help our data partners improve their data, as described in the data-use notice shown before you use the API.
• To meet our obligations to data providers, including reporting registrations and usage and applying their eligibility rules, such as the countries where they do not allow use.
• To keep our services secure, comply with the law, and enforce our Terms of Service.

4. How We Share Information

We do not sell your personal information. We share it only as follows:

• Data providers: when your agent makes a request, we send the data provider the lookup needed to answer it, such as a token, an address, a method, or a search term. For Nansen requests, your request, its purpose, and Nansen's answers are also shared with Nansen so that Flovia and Nansen can improve their data for agents. The data-use notice you accept before using the API describes what each provider receives.
• Reporting to data providers: to operate our partnerships and meet the terms of the APIs we provide, we may report to each data provider that you registered and how much you used its API, under an ID specific to that provider. Where a provider's terms or our agreement with it require, we may also give that provider identifying details, such as your name, email address, or country, including in response to its written request.
• Service providers that process information for us: Cloudflare (hosting, storage, and email), Vercel (hosting and analytics for flovia.dev), AgentMail (email), Coinbase and blockchain infrastructure providers (payment processing and confirmation), and OpenAI (text generation, when we offer it).
• Legal and safety: when required by law or legal process, or when needed to protect the rights, property, or safety of Flovia, our users, or others.
• Business transfers: as part of a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy.

5. Data Retention

Flovia keeps data-lookup request texts, purposes, conditions, stored Nansen answers and feedback for 90 days, or 30 days after you withdraw sharing, whichever comes first. Other lookup replies are available to you alone for about 15 minutes; public CoinGecko and QuickNode answers may also be reused for others for about a minute at most. For OpenAI text generation, Flovia does not keep your input text: it keeps a keyed retry fingerprint for 90 days and your reply for you alone for about 15 minutes, plus counts and costs. Safety refusals record only the event and time, kept for 30 days or until Flovia lifts a stop. Counts, costs and payment records are retained for accounting after texts are deleted. We keep one-way hashes of email addresses that received free access for up to two years to prevent repeated claims. These are Flovia retention periods, not deletion guarantees for upstream providers: OpenAI may keep inputs and replies for up to 30 days for abuse monitoring and does not use them for training; Firecrawl uses its standard index and cache without Zero Data Retention, and Flovia has not confirmed its deletion deadline or a no-training guarantee. The data-use notice describes the providers separately.

We keep account information, including information from X, while your account or application is active, and delete it when you ask us to, unless we must keep it to comply with the law, resolve disputes, or prevent abuse. Transactions on a public blockchain are public and cannot be deleted.

6. Your Choices and Rights

• You can answer no to the data-use question at any time: data lookups and text generation stop and your referral code is paused, but no records are deleted by that answer alone. You can change your answer to yes. Separately, you can ask your agent to stop sharing with Flovia; lookups and generation then stop, and the retained request texts, answers and feedback are deleted after 30 days, or at their ordinary expiry if sooner. Neither action removes an OpenAI safety stop or guarantees deletion of upstream providers' records.
• You can choose which optional emails, such as product news, you receive.
• You can remove Flovia's access to your X account in your X settings.
• You can ask us to access, correct, export, or delete your personal information by emailing [email protected]. We may need to confirm your identity first. Depending on where you live, you may have additional rights under applicable law.

7. Security

We protect information with measures such as encryption in transit, encrypted sign-in tokens, and hashed API keys, and we limit access to the Flovia team members who need it. No method of transmission or storage is completely secure.

8. International Transfers

Flovia is based in the United States. We and our service providers may process your information in the United States and other countries, whose data protection laws may differ from those where you live.

9. Children

Our services are not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy. We will post the updated version on this page with a new date, and we will give additional notice where required by applicable law.

11. Contact

For questions or requests about this Privacy Policy, email [email protected] or contact us through https://flovia.dev/contact.