Privacy Policy

We collect information that is necessary to provide and operate the Services.

Account Information

When you create a FlowSig account, we may collect:

• Name
• Email address
• Account information
• Organization information, where applicable
• Authentication information
• Account creation and login information

You may create an account using email and password or through supported third-party authentication providers such as Google.

Passwords

If you create an account using an email address and password, FlowSig does not store your password in plain text.

Passwords are processed using secure password hashing mechanisms before being stored. We store the resulting password hash and related authentication information necessary to authenticate your account.

We do not have access to your original password.

You are responsible for maintaining the confidentiality of your account credentials.

Google Authentication

If you choose to authenticate through Google, Google provides us with certain account information necessary to create and authenticate your FlowSig account, which may include your name, email address, and a unique account identifier.

We do not receive or store your Google password.

Your use of Google authentication is also subject to Google's own terms and privacy practices.

FlowSig provides API keys that allow authenticated access to our APIs and market data services.

We may store information associated with API keys, including:

• API key identifiers
• Creation and expiration information
• Permissions or scopes
• Usage information
• Associated account or organization
• Security and authentication events

API keys are credentials and should be treated as confidential.

You should not expose FlowSig API keys in publicly accessible source code, client-side applications, public repositories, browser applications, logs, or other locations where unauthorized parties could obtain them.

Unless explicitly stated otherwise for a particular FlowSig service, a FlowSig API key provides access to FlowSig services and does not provide us with access to your brokerage accounts, bank accounts, trading accounts, or other financial accounts.

When you use the FlowSig API, we log information about API requests.

Depending on the request and the configuration of the Services, logs may include:

• API key or account identifier
• Endpoint requested
• Request timestamp
• IP address
• HTTP method
• Response status
• Usage and rate-limit information
• User agent and technical information
• Requested market-data symbols or parameters
• Error and diagnostic information

We use API logs to:

• Provide and operate the Services
• Calculate usage and enforce subscription limits
• Monitor system performance
• Detect abuse and unauthorized access
• Protect the security of our infrastructure
• Diagnose errors and technical issues
• Improve the Services
• Comply with legal obligations

We do not use API request logs to sell personal profiles or personal information to third parties.

API request logs may contain information that could be considered personal data under applicable privacy laws, particularly when associated with an account, IP address, or identifiable user.

FlowSig provides real-time and historical market data, normalized feeds, and related financial information obtained from exchanges, data providers, and other sources.

Market data itself generally does not identify individual users.

However, information associated with your use of the Services, such as API requests, account information, IP addresses, and usage records, may constitute personal information.

FlowSig does not claim ownership of customer-generated strategies, applications, or other materials that customers create using the Services, except where otherwise agreed in applicable terms.

Paid FlowSig subscriptions are processed using Stripe.

When you subscribe to a paid service, payment information may be transmitted directly to Stripe for payment processing.

FlowSig generally does not store complete payment card numbers on its own servers.

Stripe may process payment and related information in accordance with its own privacy policy and applicable data protection obligations. Stripe may act as a data processor or data controller depending on the particular processing activity.

We may receive information from Stripe such as:

• Customer identifier
• Subscription status
• Subscription plan
• Payment status
• Billing information
• Transaction identifiers

We use this information to manage subscriptions, billing, access to paid Services, fraud prevention, and accounting.

We use Google Analytics to understand how visitors use our website and to improve the Services.

Google Analytics may collect information such as:

• Browser and device information
• Approximate geographic information
• Website interactions
• Pages viewed
• Referring information
• Technical information
• Pseudonymous identifiers and cookies, where applicable

We configure Google Analytics using the privacy controls available to us and do not intentionally send passwords, API keys, or other confidential credentials to Google Analytics.

Google states that Google Analytics does not log or store individual IP addresses for users in the European Union, Switzerland, or United Kingdom, although IP information may be used temporarily to derive approximate geographic information.

Where required by applicable law, we will obtain consent before using non-essential analytics cookies or similar technologies.

If you contact us by email or through our support channels, we may collect:

• Your name
• Email address
• Organization information
• The content of your communication
• Information necessary to respond to your request

We use this information to provide customer support, respond to requests, troubleshoot problems, and maintain our relationship with customers.

Our contact and email services may be provided through third-party service providers, including Postale.io, where applicable.

We may use personal information to:

• Create and manage accounts
• Authenticate users
• Provide access to FlowSig APIs and market data
• Process subscriptions and payments
• Monitor API usage
• Enforce rate limits and subscription limits
• Provide customer support
• Maintain and secure our infrastructure
• Detect fraud, abuse, and unauthorized access
• Monitor service reliability and performance
• Diagnose technical problems
• Improve our products and Services
• Communicate important service-related information
• Comply with legal obligations
• Establish, exercise, or defend legal claims

We do not sell personal information.

Where the GDPR applies, we process personal information under one or more of the following legal bases:

Performance of a contract

We process information where necessary to provide the Services you requested, including account management, authentication, API access, subscriptions, and customer support.

Legitimate interests

We may process information where necessary for our legitimate interests, including:

• Securing our infrastructure
• Preventing fraud and abuse
• Monitoring API usage
• Improving our Services
• Maintaining service reliability
• Protecting our legal rights

We consider and balance our legitimate interests against applicable privacy rights.

Consent

Where required, we rely on your consent for activities such as certain analytics or non-essential cookies.

You may withdraw consent where processing is based on consent.

Legal obligations

We may process information when necessary to comply with applicable laws, regulations, legal proceedings, or lawful requests.

We may share personal information with service providers that help us operate FlowSig.

These providers may include:

• OVHcloud — cloud hosting and infrastructure
• Stripe — payment processing and subscription management
• Google — authentication and analytics services
• Postale.io — email and communication services
• Other infrastructure, security, monitoring, or technical service providers necessary to operate the Services

We only provide service providers with access to information reasonably necessary for them to perform their services.

We may also disclose information:

• When required by law
• In response to valid legal requests
• To protect the rights, property, or safety of FlowSig, our users, or others
• To investigate fraud, security incidents, or abuse
• In connection with a merger, acquisition, financing, reorganization, or sale of assets

We do not sell your personal information.

We use reasonable technical and organizational safeguards designed to protect personal information.

These measures may include:

• Encryption in transit
• Secure password hashing
• Access controls
• Authentication controls
• API-key management
• Security monitoring
• Infrastructure security measures
• Logging and auditing

However, no Internet service can guarantee absolute security.

You are responsible for protecting your account credentials and API keys.

If you believe your account or API key has been compromised, revoke the affected API key and contact us as soon as possible.

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy.

Different types of information may be retained for different periods.

For example:

• Account information may be retained while your account remains active and for a reasonable period afterward.
• Billing and transaction information may be retained for the period required by accounting, tax, and legal obligations.
• API and security logs may be retained for a period necessary for security, abuse prevention, troubleshooting, service operation, and legal purposes.
• Support communications may be retained for as long as reasonably necessary to provide support and maintain appropriate business records.

When information is no longer required, we may delete or anonymize it, subject to legal, security, and operational requirements.

Some of our service providers may process personal information outside the European Economic Area ("EEA").

Where personal information is transferred outside the EEA, we take appropriate measures required by applicable data protection laws.

These measures may include adequacy decisions, Standard Contractual Clauses, or other legally recognized transfer mechanisms.

Some service providers, including Stripe and Google, maintain their own privacy and data-transfer frameworks and contractual safeguards.

If the GDPR applies to you, you may have the right to:

• Access your personal information
• Correct inaccurate or incomplete information
• Request deletion of your personal information
• Request restriction of processing
• Object to certain processing
• Receive certain personal information in a portable format
• Withdraw consent where processing is based on consent
• Lodge a complaint with a supervisory authority

You may exercise these rights by contacting us using the contact information below.

We may need to verify your identity before fulfilling certain requests.

You may request deletion of your FlowSig account by contacting us.

When an account is deleted, we will take reasonable steps to delete or anonymize associated personal information, subject to information that we are required or permitted to retain for:

• Legal or regulatory obligations
• Accounting and tax requirements
• Security purposes
• Fraud prevention
• Dispute resolution
• Enforcement of agreements
• Establishment or defense of legal claims

Associated API keys may be revoked when an account is deleted.

FlowSig may use cookies and similar technologies for:

• Authentication
• Security
• Maintaining sessions
• Remembering preferences
• Analytics
• Measuring website usage

Essential cookies may be used where necessary to provide the Services.

Where required by law, non-essential cookies will only be used after obtaining the appropriate consent.

You can also manage cookies through your browser settings.

FlowSig is not intended for children under the minimum age required to independently use online services under applicable law.

We do not knowingly collect personal information from children in violation of applicable law.

The Services may contain links to or integrations with third-party services.

Third-party services operate under their own terms and privacy policies.

We are not responsible for the privacy practices of third-party services that we do not control.

We may update this Privacy Policy from time to time to reflect changes in our Services, technology, business practices, or applicable laws.

When we update this Privacy Policy, we will change the "Last updated" date at the top of the page.

Where required by applicable law, we will provide additional notice of material changes.

If you have questions about this Privacy Policy, your personal information, or your privacy rights, please contact: