Privacy Policy

This Privacy Policy applies to all services provided by EverFlow Tech Limited, including:

(a) EverFlow AI Chat — an AI-powered conversational assistant for individual users; (b) Team Flowy — an enterprise AI agent platform for building custom AI employees, workflows, and automations; (c) API Services — unified AI model API gateway for developers and businesses; (d) Third-party integrations connected through our platform (e.g., Gmail, WhatsApp, WeChat).

We collect the following types of information:

Account Information — When you register, we collect your name, email address, and password (stored in hashed form). We verify your email through a one-time code sent to your address.

Usage Data — We log interactions with our AI agents, including conversation content, timestamps, token usage, and credit consumption. This data is used to provide the service and calculate billing.

Payment Information — Payment processing is handled by Stripe. We do not store your credit card details. We receive transaction confirmations and subscription status from Stripe.

Files and Knowledge Base — Files you upload to agent knowledge bases are stored securely and used solely to provide AI agent capabilities for your account.

Third-Party Integration Data — When you connect external services (such as Gmail), we access only the data necessary to provide the requested functionality. See Section 5 for details on specific integrations.

We use your information for the following purposes:

(a) To provide, maintain, and improve our services; (b) To process transactions and manage your account credits; (c) To send service-related communications (account verification, security alerts); (d) To enable AI agent functionality, including reading and processing data from connected integrations on your behalf; (e) To monitor service performance and prevent abuse; (f) To comply with legal obligations.

We do not sell your personal data to third parties. We do not use your data to train AI models.

Your data is stored on servers located in secure data centers. We implement industry-standard security measures including:

(a) Encryption of sensitive credentials and tokens at rest; (b) HTTPS/TLS encryption for all data in transit; (c) Access controls limiting data access to authorized systems; (d) Regular security reviews of our infrastructure.

Conversation data and uploaded files are stored as long as your account is active. You may request deletion of your data at any time by contacting us.

Gmail Integration — When you connect your Gmail account through our platform, we request access to read, send, and manage emails on your behalf via the Gmail API. Specifically:

- We use OAuth 2.0 for secure authorization. We store your access token and refresh token to maintain the connection. - We access your email data only when your AI agents need to read, search, or send emails as part of their assigned tasks. - Email data retrieved by agents is processed in real-time and used within your conversation context. We do not permanently store the full content of your emails beyond what appears in agent conversation logs. - You can disconnect Gmail at any time from your dashboard, which immediately revokes our access and deletes stored tokens. - Our use of Gmail API data complies with Google's Limited Use Requirements. We only use Gmail data to provide and improve the email-related features you explicitly requested. We do not use Gmail data for advertising, and we do not allow humans to read your emails unless required for security purposes, to comply with applicable law, or with your explicit consent.

Other Integrations (WhatsApp, WeChat, etc.) — Similar principles apply: we access only the data necessary to provide the integration, and you can disconnect at any time.

We may share your information only in the following circumstances:

(a) With AI model providers (e.g., Anthropic, OpenAI) — conversation content is sent to these providers to generate AI responses. These providers have their own data handling policies and do not use API-submitted data for model training. (b) With payment processors (Stripe) — to process your transactions. (c) When required by law — to comply with legal obligations, court orders, or government requests under Hong Kong law. (d) With your consent — when you explicitly authorize sharing with a specific third party.

We do not sell, rent, or trade your personal information.

Under the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486), you have the right to:

(a) Access your personal data held by us; (b) Request correction of inaccurate personal data; (c) Request deletion of your data and account; (d) Disconnect any third-party integrations at any time; (e) Export your data in a portable format.

To exercise these rights, contact us at support@everflowhk.com. We will respond within 30 days.

We use essential cookies and local storage to maintain your login session and language preferences. We do not use third-party tracking cookies or advertising trackers.

We retain your data for as long as your account is active. When you delete your account:

(a) Account information is deleted immediately; (b) Conversation logs and usage records are deleted within 30 days; (c) Uploaded files and knowledge base data are deleted within 30 days; (d) Third-party integration tokens are revoked and deleted immediately.

Anonymized, aggregated usage statistics may be retained for service improvement purposes.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through a notice on our platform. Continued use of our services after changes take effect constitutes acceptance of the updated policy.

If you have any questions about this Privacy Policy or our data practices, please contact us:

EverFlow Tech Limited Email: support@everflowhk.com Website: www.everflowhk.com