Version 1.0 · In force since 21 October 2026
Privacy Policy
This policy explains how FlowCensus Desenvolvimento de Software Não Customizável Ltda. (“FlowCensus”, “we”) processes personal data on the flowcensus.com website and on the app.flowcensus.com platform. It applies to anyone who visits the website, requests a free scan, buys a plan or uses the platform.
1. Who we are and how to reach us
| Item | Information |
|---|---|
| Legal name | FlowCensus Desenvolvimento de Software Não Customizável Ltda. |
| Brazilian tax ID (CNPJ) | 69.406.614/0001-74 |
| Address | Rua Pais Leme, 215, Conj. 1713, Pinheiros, São Paulo – SP, CEP 05424-150, Brasil |
| Data protection officer | Paulo R. Barbosa |
| Privacy contact | privacy@flowcensus.com |
The privacy contact handles data subject requests, questions about this policy and communications from authorities. It is answered by our data protection officer.
2. Our role: controller or processor
FlowCensus takes a census of a customer company’s automations: it reads the file that describes each flow, rebuilds what it reaches and who built it, and classifies the risk.
- We are the controller for the data of people who visit the website, request a free scan, buy a plan or administer a customer account. This policy describes that processing.
- We are a processor (GDPR) and operador (Brazil’s LGPD) for the data we process on behalf of a customer company during scans: the name and work email of whoever built each flow, and user names that appear in the structure of the automations. The customer company is the controller, and the rules for that processing are in the Data Processing Agreement. Requests about that data should preferably go to the customer company; if they reach us, we forward them and support the response.
What we never process. We do not process personal data of the customer company’s own customers — consumers, end users, people in its databases. The content of the flows (the raw JSON) exists only in memory during the scan and is never written. Secret values and the content of pinnedData are never stored, in any form.
3. Data we process, why, and on what legal basis
| Activity | Data | Purpose | Legal basis — GDPR | Legal basis — LGPD |
|---|---|---|---|---|
| Visiting the website | The website collects no personal data; the hosting provider records IP address and browser in technical security logs | Protect the website from abuse | Art. 6(1)(f) | Legitimate interest (art. 7, IX) |
| Requesting a free scan or contacting us | Name, work email, company, job title and the content of your message | Reply, create the account and run the scan | Art. 6(1)(b) | Pre-contractual steps (art. 7, V) |
| Platform account | Name, work email, company, role, credentials (password stored only as a hash) and second factor | Provide secure access to the platform | Art. 6(1)(b) | Performance of contract (art. 7, V) |
| Scan authorization | Email, date, time and IP address of acceptance | Prove the scan was authorized by someone who controls the instance | Art. 6(1)(c) and (f) | Exercise of rights and legitimate interest (art. 7, VI and IX) |
| Payment and invoicing | Legal name, tax ID, billing address, billing contact | Charge, invoice and meet tax obligations | Art. 6(1)(b) and (c) | Contract and legal obligation (art. 7, II and V) |
| Platform security | Access logs, IP address, authentication events | Prevent fraud and abuse, investigate incidents | Art. 6(1)(c) and (f) | Legitimate interest and legal obligation (art. 7, II and IX) |
| Business outreach | Name, work email, company and job title | Introduce FlowCensus to security and automation professionals | Only with consent — art. 6(1)(a) | Legitimate interest (art. 7, IX, and art. 10) |
We do not process sensitive personal data, do not ask for identity documents and do not use customer data to train artificial intelligence models.
4. Cookies
The flowcensus.com website sets no cookies and loads no fonts, scripts or analytics from third parties.
The app.flowcensus.com platform uses a single essential session cookie, needed to keep you securely signed in. We use no advertising or tracking cookies. If that changes, we will ask for your consent first.
5. Who we share data with
We do not sell personal data. We share it only with providers that make the service possible, under contract and with data protection obligations. The full list, with each provider’s function and location, is on the Subprocessors page.
We may also share data when the law requires it, under a court order or a request from a competent authority, or to defend our rights in legal, administrative or arbitration proceedings. If the company is sold or reorganized, data may be transferred to the successor, which remains bound by this policy.
6. International transfers
The platform is hosted on Amazon Web Services, in the us-east-2 region (Ohio, United States). Data processed on the platform is therefore transferred to the United States.
- From the European Union to the United States: we rely on the European Commission’s standard contractual clauses or another mechanism under Chapter V of the GDPR.
- From Brazil to the United States: we rely on the standard contractual clauses approved by the ANPD (Resolution CD/ANPD No. 19/2024).
The scope of these transfers is small by design: names and work emails of customer employees, never consumer databases. You can ask the privacy contact which mechanism applies to each transfer.
7. How long we keep data
| Data | Retention |
|---|---|
| Contact and free scan requests that did not become an account | 12 months after the last contact |
| Platform account | For the term of the contract; afterwards, as described under offboarding below |
| Free scan report | 7 days |
| Scan authorization record | 5 years, to defend potential claims |
| Platform access logs | 6 months (Brazilian Internet Act, art. 15) |
| Billing data and invoices | 5 years, under tax law |
| Redacted finding excerpts | 90 days |
| Finding state | Contract term + 30 days |
| Event log | Contract term + 12 months, or less if the customer company decides |
Offboarding. When a customer company ends its contract, we drop its dedicated database, delete its data key, revoke its API key and issue a dated deletion certificate. Encrypted backups expire within 14 days.
8. How we protect data
The measures are described in detail on the Security page. In short:
- a separate database for each customer company;
- field-level encryption, with a key unique to each customer company, of flow, node and credential names;
- the customer’s API key encrypted in an envelope with AWS KMS;
- mandatory multi-factor authentication on every account;
- administrative access without SSH, through a recorded channel;
- infrastructure described as code, reviewed and applied by pipeline.
Incidents. If a security incident may create relevant risk or harm, we notify affected customer companies without undue delay, and the competent authorities and data subjects within the legal deadlines (72 hours under the GDPR).
Security researchers can report vulnerabilities through the address in flowcensus.com/.well-known/security.txt.
9. Your rights
At any time and free of charge, you can:
- confirm whether we process your data and access it;
- correct incomplete, inaccurate or outdated data;
- ask for anonymization, restriction or deletion of unnecessary data or data processed unlawfully;
- receive your data in a structured format (portability);
- know who we share your data with;
- withdraw consent, where processing relies on it;
- object to processing based on legitimate interest, including business outreach;
- lodge a complaint with your data protection authority — in the European Union, the authority of your country; in Brazil, the ANPD.
How to ask. Email privacy@flowcensus.com from the address you registered. If the request comes from another address, we may ask for a simple identity check. We reply within one month, as the GDPR requires, and within 15 days under Brazilian law.
If your data appears on the platform because you built an automation at your employer, that employer is the controller (section 2). We will forward your request to them.
10. Minimum age
FlowCensus is intended for companies and professionals and must not be used by anyone under 18.
11. Changes to this policy
We may update this policy when the service or the law changes. The current version and the date of the last update are always on this page. Relevant changes will be emailed to customer companies before they take effect.
This policy is also available in Portuguese. In case of conflict, the Portuguese version prevails for customers in Brazil.