In effect from August 14, 2026
Privacy Policy
LouFlow LLC ("LouFlow", "we", "us") builds a digital adoption platform that lets people capture workflows and turn them into step-by-step guides ("Flows"). This Policy explains what personal information we collect, why, who we share it with, and what choices you have.
This Policy covers louflow.com, app.louflow.com, our browser extension, and related services (the "Platform"). It works alongside our Terms of Service at https://louflow.com/terms.
A note on how our product works. LouFlow captures screens and screenshots. That means personal information about other people — colleagues, customers, anyone whose name or data appears on a screen being recorded — can end up inside a Flow. Section 4 explains how we handle that and what responsibility rests with you.
1. Who is responsible for your data
When you use LouFlow for yourself or your team, we are the controller of your account information and how you interact with the Platform. We are also the controller of information you send us through our contact and sales enquiry forms, whether or not you go on to create an account.
When your employer or organization provides your LouFlow account, that organization is the controller of the content you create and of the data inside your Flows. We act as their processor. Their privacy policy governs, and requests about that data should go to them. We will refer you to them if you contact us directly.
Contact: LouFlow LLC, a Wyoming limited liability company, United States privacy@louflow.com
2. Information we collect
2.1 Information you give us
What | Examples | Why we need it |
|---|---|---|
Account details | First name, last name, email address, password (hashed) | To create and secure your account |
Profile | Optional job title, team name, avatar | To personalize the workspace |
Organization details | Company name, billing contact, seat assignments | To administer team accounts |
Payment details | Billing name, address, tax ID, last four digits and expiry of card | To process subscriptions and invoices. We never see or store full card numbers — see Section 5 |
Support communications | Messages, attachments, screenshots you send us | To answer your questions |
Contact form | Name, email address, company name, your message | To respond to your enquiry |
Sales enquiries | Name, email address, phone number, company name, country | To respond to Enterprise enquiries, prepare a quote, and determine applicable tax and data protection requirements |
Content | Flows, screenshots, recordings, annotations, uploaded files | To provide the core product |
2.2 Information we collect automatically
What | Examples |
|---|---|
Device and connection | IP address, browser type and version, operating system, device type, language, time zone |
Usage | Pages viewed, features used, buttons clicked, Flows created and published, session start and end, referring URL |
Session recordings | Mouse movement, clicks, scrolling, and page interactions within the Platform, captured by Microsoft Clarity — see Section 3 |
Diagnostics | Error reports, crash logs, performance timings |
Cookies and similar technologies | See Section 7 |
2.3 Information from third parties
If you sign in with Google or Microsoft, that provider sends us your name, email address, profile picture, and a unique account identifier. We do not receive your password. We do not access your Google Drive, Microsoft 365 files, calendar, or mailbox.
If your organization uses single sign-on, we receive the attributes your identity provider chooses to send.
2.4 What we do not collect
We do not knowingly collect information from people under 16. We do not buy personal information from data brokers. We do not use your Flows to train artificial intelligence models — LouFlow has no AI features. We do not collect biometric identifiers, precise geolocation, or the special categories of data listed in GDPR Article 9, unless you place such information inside a Flow yourself.
3. Session recording with Microsoft Clarity
We use Microsoft Clarity to understand how people use the Platform and where they get stuck.
What this means in practice. Clarity records your interactions with our interface — where you move your cursor, what you click, how far you scroll — and can replay these as a session recording. It also builds heatmaps showing where users concentrate their attention. Microsoft acts as a joint controller with us for this data and may use it in accordance with the Microsoft Privacy Statement at https://privacy.microsoft.com/privacystatement.
How we limit it. We configure Clarity to mask text content and form inputs, so the values you type — names, email addresses, anything inside a Flow — are obscured in recordings. Masking is applied at capture, before data leaves your browser.
Your choices.
In the EEA, UK, and Switzerland, Clarity does not load until you consent through our cookie banner. If you decline, no session recording occurs. You can change your choice at any time via the "Cookie Settings" link in our footer.
In the United States, you can disable Clarity through "Your Privacy Choices" in our footer, or through a Global Privacy Control signal, which we honor.
Clarity respects browser Do Not Track signals.
Microsoft offers its own opt-out at https://choice.microsoft.com/en-us/opt-out.
4. Flows, screen capture, and other people's data
This section matters more than any other in this Policy. Please read it.
4.1 What ends up in a Flow. When you record a workflow, LouFlow captures images of your screen. Whatever is visible is captured: customer names in a CRM, email addresses in an inbox, patient identifiers in a records system, account numbers in a banking portal. We do not inspect or filter this content.
4.2 Your responsibility. You decide what to record. If a Flow contains personal information about other people, you are the controller of that information and you are responsible for having a lawful basis to capture it, for informing those people where the law requires it, and for honoring their rights. Our Terms of Service §3.4 sets out this obligation in full.
4.3 Tools we give you. The Platform includes blurring and redaction tools. Use them before sharing. Redaction applied in the editor is destructive — the underlying pixels are removed from the stored image, not merely covered.
4.4 Published Flows are public. When you publish a Flow to a shareable link, anyone with that link can view it without signing in, and search engines may index it. We record aggregate view counts for published Flows and the approximate country of viewers. We do not identify individual viewers to you, and we do not build profiles of them.
4.5 If you appear in someone's Flow. If your personal information appears in a Flow published through LouFlow and you want it removed, contact us at privacy@louflow.com with the link. We will forward the request to the account holder who controls that content, and where we are able to act as processor we will assist them in responding. If the content is unlawful, we may remove it directly.
4.6 Our access. We do not routinely view your Flows. Our staff may access Flow content only when you ask us to for support, when we are investigating a security incident or a violation of our Terms, or when required by law. Such access is logged and limited to personnel who need it.
5. Why we use your information, and our legal basis
If you are in the EEA, UK, or Switzerland, GDPR requires us to identify a legal basis for each purpose.
Purpose | Legal basis |
|---|---|
Creating and administering your account | Performance of a contract (Art. 6(1)(b)) |
Providing the Platform's features, hosting and displaying your Flows | Performance of a contract |
Processing payments and preventing payment fraud | Performance of a contract; legal obligation (Art. 6(1)(c)) |
Providing customer support | Performance of a contract; legitimate interests (Art. 6(1)(f)) |
Responding to contact and sales enquiries | Steps taken at your request prior to entering a contract (Art. 6(1)(b)); legitimate interests in responding to business enquiries |
Securing the Platform, detecting abuse, maintaining logs | Legitimate interests in operating a secure service |
Product analytics and improvement | Consent where required (Art. 6(1)(a)); otherwise legitimate interests |
Session recording via Microsoft Clarity | Consent in the EEA, UK and Switzerland; opt-out elsewhere |
Sending service notices — billing, security, changes to terms | Performance of a contract; legal obligation |
Sending marketing emails | Consent, or legitimate interests for existing customers with opt-out |
Meeting tax, accounting, and legal obligations | Legal obligation |
Establishing, exercising, or defending legal claims | Legitimate interests |
Where we rely on legitimate interests, we have assessed that our interest does not override your rights. You may object at any time — see Section 10.
6. Who we share information with
We do not sell personal information for money. We do share it with the service providers below, each bound by contract to process it only on our instructions.
Provider | What they do | Where | Data involved |
|---|---|---|---|
Amazon Web Services, Inc. | Cloud hosting and storage | United States | Account data, Flows, screenshots, logs |
Microsoft Corporation (Azure) | Cloud hosting and storage | United States | Account data, Flows, screenshots, logs |
Microsoft Corporation (Clarity) | Product analytics and session recording | United States | Usage and interaction data |
Stripe, Inc. | Payment processing | United States | Billing details, card data (processed by Stripe, not us) |
Resend, Inc. | Transactional email delivery | United States | Email address, message content |
Google LLC / Microsoft Corporation | Authentication, if you use social sign-in | United States | Name, email, account identifier |
This list is current as of the date at the top of this Policy. If we engage a new sub-processor that handles customer content, we will update this section and notify account administrators by email at least 30 days before that provider begins processing, so that you have an opportunity to object.
We may also disclose information:
To your organization's administrator, if your account is part of a team or corporate workspace — including your Flows, account details, and usage data.
In a corporate transaction — a merger, acquisition, financing, or sale of assets. We will notify you if your information becomes subject to a different privacy policy.
For legal reasons — to comply with law, a subpoena, or a court order; to enforce our Terms; or to protect the rights, safety, or property of LouFlow, our users, or the public. Where legally permitted, we will notify you before disclosing your data in response to a government request.
With your direction — when you publish a Flow, share a link, or connect a third-party integration.
7. Cookies and similar technologies
Category | Purpose | Consent needed? |
|---|---|---|
Strictly necessary | Keeping you signed in, session management, load balancing, CSRF protection, remembering your cookie choices | No |
Analytics and session recording | Microsoft Clarity — understanding feature usage and interface problems | Yes, in the EEA, UK and Switzerland |
We do not use advertising cookies, retargeting pixels, or third-party ad networks.
You can manage cookies through the "Cookie Settings" link in our footer or through your browser settings. Blocking strictly necessary cookies will prevent you from signing in.
8. Where your data is stored and transferred
Your data is stored in the United States.
If you are in the EEA, UK, or Switzerland, this means your personal information is transferred outside your home jurisdiction. We rely on the European Commission's Standard Contractual Clauses, and the UK International Data Transfer Addendum, together with supplementary technical measures including encryption in transit and at rest. You may request a copy of the relevant transfer mechanism by writing to privacy@louflow.com.
9. How long we keep data
Data | Retention |
|---|---|
Account information | For the life of your account |
Flows and screenshots | Until you delete them, or 30 days after account deletion |
Backups | Purged on a rolling cycle, no longer than 90 days after deletion from live systems |
Billing records and invoices | 7 years, to meet tax and accounting requirements |
Security and access logs | 12 months |
Microsoft Clarity data | Retained by Microsoft according to its retention schedule, generally up to 13 months |
Support tickets | 3 years after resolution |
Contact and sales enquiries that do not become customers | 24 months from last contact |
Marketing preferences and suppression lists | Until you withdraw consent, plus a record of the withdrawal |
When you delete your account, we remove your data from live systems within 30 days and from backups within 90 days, except where we must keep it to meet a legal obligation or to resolve a dispute.
10. Your rights
10.1 Everyone. Whatever your location, you can access and correct most of your information directly in account settings, export your Flows, delete individual Flows or your entire account, and unsubscribe from marketing email using the link in any such message. Service messages about billing, security, and legal changes cannot be unsubscribed from while your account is active.
10.2 EEA, UK, and Switzerland. Under GDPR and UK GDPR you have the right to access your data, correct inaccuracies, request erasure, restrict processing, object to processing based on legitimate interests, receive your data in a portable format, and withdraw consent at any time without affecting prior processing. You may also lodge a complaint with your national supervisory authority, or with the UK Information Commissioner's Office at ico.org.uk. We would appreciate the chance to address your concern first.
10.3 California. Under the CCPA as amended by the CPRA, you may request disclosure of the categories and specific pieces of personal information we collected in the preceding 12 months, deletion of your personal information, correction of inaccurate information, and that we limit the use of sensitive personal information. We do not sell personal information. Our use of Microsoft Clarity may constitute "sharing" for cross-context behavioral advertising purposes under California law; you may opt out via "Your Privacy Choices" in our footer, and we honor Global Privacy Control signals. We will not discriminate against you for exercising these rights. You may use an authorized agent, with proof of authorization.
10.4 Other US states. Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have comparable rights of access, correction, deletion, and portability, and may opt out of targeted advertising and profiling. Colorado, Connecticut, and Virginia residents may appeal a denied request by replying to our decision; if the appeal is denied, you may contact your state Attorney General.
10.5 How to exercise your rights. Email privacy@louflow.com. We will respond within 30 days (45 days in California, extendable once where permitted). We may need to verify your identity, usually by confirming control of the account email address. There is no charge unless a request is manifestly unfounded or excessive.
11. Security
We protect your information with encryption in transit (TLS 1.2 or higher) and at rest, role-based access controls with least-privilege defaults, multi-factor authentication for staff, logging of administrative access, regular patching and dependency scanning, and periodic third-party security testing.
No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant regulator as required by law — within 72 hours of becoming aware, where GDPR applies.
Report a vulnerability or a suspected incident to security@louflow.com.
12. Children
The Platform is not directed to children. You must be at least 16 to create an account. If you believe a child under 16 has provided us personal information, contact privacy@louflow.com and we will delete it.
13. Changes to this Policy
We may update this Policy. For material changes we will give at least 30 days' notice by email or in-app notice before they take effect, and we will update the date at the top. Continued use after the effective date means you accept the updated Policy. Where a change requires consent under applicable law, we will ask for it.
14. Contact
Questions, requests, or complaints: privacy@louflow.com Security: security@louflow.com Postal: LouFlow LLC, Wyoming, United States