This Privacy Policy explains how Rowflare ("we", "us") handles personal data in Rowflare Cloud, the hosted edition at app.rowflare.com (the "Service"), and on this website. If you run open-source Rowflare on your own infrastructure, your data stays there and we never receive it.
Summary
- We collect only what we need to run the Service and bill for it.
- Your bases, records and files are yours. We do not sell them, use them for advertising, or use them to train AI models.
- The Service runs on Cloudflare. Payments go through Creem. AI requests go only to the model service you choose.
- You can export your data at any time and ask us to delete your account.
1. Data we collect
Account data
Your email address and name. If you sign in with Google or GitHub, we receive your email address, name and account id from that provider; we do not receive your password. Sign-in codes and sessions are stored only as hashes.
Workspace content
Everything you and your team put into the Service: workspaces, bases, tables, records, attachments, views, dashboards, automations, and the output of AI fields. We call this "Customer Content". We process it only to provide the Service to you.
Credentials you save
API keys for AI model services and mail server settings that a workspace owner saves are stored encrypted and used only to make the requests you set up.
Billing data
When you subscribe, Creem collects your payment details, billing address and tax information as merchant of record. We receive the customer and subscription ids, plan, status, amounts and billing email from Creem. We never see or store your full card number.
Technical data
A session cookie that keeps you signed in, and a short-lived cookie during Google or GitHub sign-in. Our hosting provider processes IP addresses and request logs to deliver the Service and protect it from abuse. We also count usage (records, storage, automation runs, AI calls) to apply plan limits.
Website
This website (rowflare.com) sets no cookies and has no advertising or cross-site tracking. Our hosting provider may keep standard request logs.
2. How we use data
- To provide, maintain and secure the Service, including backups and abuse prevention (performance of our contract with you, and our legitimate interest in keeping the Service safe).
- To send sign-in codes, invitations, billing and service notices (contract).
- To process payments, refunds and tax (contract and legal obligation).
- To answer support requests you send us.
- To enforce our Terms and Acceptable Use Policy and to comply with the law.
We only look at Customer Content when you ask us to for support, when needed to investigate abuse or a security problem, or when the law requires it.
3. AI features
When an AI field, automation step or MCP tool runs, the prompt and the record values it refers to are sent to the model service configured for the workspace:
- Your own key (for example Anthropic or an OpenAI-compatible service): the data goes to that provider under your agreement with it. Read its privacy terms before you add the key.
- Workers AI: the request runs on Cloudflare's network, operated by Cloudflare as our processor.
We do not use your prompts or AI output to train models, and we do not send Customer Content to any AI service you have not configured.
4. Service providers
We share data only with providers that help us run the Service, and only what each one needs:
| Provider | Purpose | Data |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, file storage, Workers AI, sending email | All Service data |
| Creem | Payments, invoices and tax as merchant of record | Billing data, email |
| Google, GitHub | Sign-in, only if you choose it | Sign-in data from that provider |
| AI model services you configure | Generating AI output | Prompts and the record data they include |
We may also disclose data when required by law or to protect the rights and safety of users and others. If Rowflare is sold or merged, data may transfer to the new operator under this policy, and we will tell you first.
5. International transfers
Our providers operate worldwide, so your data may be processed outside your country. Where the law requires it, transfers rely on safeguards such as the European Commission's Standard Contractual Clauses offered by those providers.
6. Retention and deletion
- Customer Content stays until you delete it or your account is closed. Deleting a record, base or workspace removes it from the Service; files that are no longer used are removed by a weekly cleanup.
- To close your account, email support@rowflare.com from the account's address. We delete the account and the workspaces it owns within 30 days.
- Billing records are kept for as long as tax and accounting law requires.
- Expired sessions and sign-in codes are removed automatically.
7. Security
Data is encrypted in transit with HTTPS and stored on Cloudflare's infrastructure. Sessions, sign-in codes and API tokens are stored hashed, and saved third-party credentials are encrypted. Access to production systems is limited to the operator. No system is perfectly secure; if a breach affects your personal data we will notify you as the law requires.
8. Your rights
Depending on where you live, you can ask to access, correct, export or delete your personal data, object to or restrict certain processing, and complain to your local data protection authority. Most of this you can do in the app; for the rest email support@rowflare.com and we will answer within 30 days.
If your organization uses Rowflare Cloud and invited you to a workspace, the organization controls that workspace's content. Contact them first; we will help them answer your request.
9. Children
The Service is not intended for anyone under 16 and we do not knowingly collect their data.
10. Changes
We will post updates on this page and change the date at the top. For material changes we will email account owners before they take effect.
11. Contact
Privacy questions and requests: support@rowflare.com.