Privacy Policy

Effective date: 16 October 2026 · Last updated: 16 October 2026

This policy replaces all earlier versions. It covers flowlytix.co, all its subdomains and every Flowlytix product and service, now and in the future, including Flowlytix Money. It works together with our Terms and Conditions and Refund Policy.

1. Who we are

Flowlytix is a business name operated by Sompob Meeyanon, an individual in Samut Prakan, Thailand (“Flowlytix”, “we”, “us”). We are the data controller for the personal data described here under Thailand’s Personal Data Protection Act B.E. 2562 (PDPA), and we also follow the EU General Data Protection Regulation (GDPR) where it applies to you.

Flowlytix builds several products: personal money and planning apps, business dashboards and analytics, and market information such as school and fund data. Instead of describing each product separately, section 3 explains the three ways our products store data. Every Flowlytix product uses one or more of them, and tells you which on its sign-in or setup screen.

2. Information we collect

TypeWhat it includesWhen we collect it
Account detailsName and email address; for business products, also your job title and company. If you register with an email and password, the password is stored in hashed formWhen you sign in or create an account
Data you put into a productFor example budget, salary, tax, net worth and debt figures; saved lists, watchlists and settings; files, CRM exports and figures you upload for analysisWhen you use a product. Where it is stored depends on the product (section 3)
Payment detailsPlan, payment status and invoices. Card details are handled by Stripe and never reach usWhen you buy a paid plan
Technical dataIP address, browser and device type, pages visited and standard server logsWhen you use our website or products
MessagesWhat you send when you contact usWhen you contact us

We do not ask for sensitive data such as health, religion or biometric data. Please do not put it into our products.

Business data about other people. If data you upload includes personal data about your own customers, students or staff, you remain the data controller for it. We process it only to provide the service you ask for, as your data processor, and you confirm you have the right to share it with us.

3. How our products store your data

3.1 Saved in your own Google Drive. Some products, such as Flowlytix Money, save what you enter only in your browser and in a file that the app creates in your own Google Drive.

  • Our servers never receive or store those figures, and we have no copy of them.
  • The app asks only for Google’s drive.file permission: it can create and edit the files it creates, and cannot see or change any other file in your Drive. You can remove its access at any time at myaccount.google.com/permissions.
  • You can open, download or delete the file yourself at any time in Google Drive.

3.2 Saved in a Flowlytix cloud database. Some products need to keep data for you on our side, for example your account, saved lists, watchlists, dashboards or business data you upload for analysis.

  • It is stored with a cloud database provider listed in section 5 (currently Supabase or Cloudflare), in Singapore or the nearest region the provider offers.
  • It is encrypted in transit and at rest. Access rules let each account reach only its own records.
  • We do not look at what you store unless you ask us to (for example, for support), it is needed for security or to investigate abuse, or the law requires it.
  • You can delete it in the product where that option is offered, or by emailing us. It is deleted within 90 days of you closing your account (section 7).

3.3 Public information products. Some products show information compiled from public sources, for example school directories, fund and market data. These do not contain your personal money data. They may include public details about organisations. If information about you or your organisation is wrong, or you want it removed, email us (section 9).

Signing in and staying signed in. When you sign in with Google, Google gives the app your email address, a short-lived access token and, where you stay signed in, a long-lived sign-in key (a “refresh token”). The sign-in key is kept only in an encrypted, essential cookie in your own browser. Page scripts cannot read it, and we do not store it in any database. Our server uses it only to ask Google for a fresh access token when the app needs one. You stay signed in on a browser until you sign out. Signing out deletes the cookie and asks Google to cancel the key, so always sign out on a shared computer.

Plan checks and payments. To show which plan you have, the app sends your Google access token to our server. The server asks Google to confirm your email address, then looks up your subscription with Stripe using that email. Stripe processes card payments and stores your payment details. Flowlytix never sees your full card number.

New products. Every new Flowlytix product uses one of the models above and the providers in section 5. If we ever launch a product that handles personal data in a way this policy does not describe, or adds a new provider, we will update this policy before that product goes live.

Figures, forecasts and analysis in our products are for planning only and are not financial, tax or legal advice (see our Terms).

4. How we use information and why

PurposeLegal basis (PDPA)
Providing the products you use: dashboards, analysis, budgeting, saved lists and plan checksContract
Billing, receipts, refunds and handling payment disputesContract; legal obligation
Security, fraud prevention and keeping services runningLegitimate interests
Improving our products using anonymous, aggregated usage statisticsLegitimate interests
Measuring traffic on flowlytix.co with analytics cookiesConsent
Showing and measuring ads for Flowlytix on other sites, if we run them, using advertising cookies on flowlytix.coConsent
Product updates and newsletters, if you sign up (you can unsubscribe at any time)Consent
Meeting tax, accounting and other legal dutiesLegal obligation

We never sell personal data. We do not use what you put into our products (your figures, your Google Drive files, saved lists or business data you upload) for advertising, and we do not use it to train AI models.

5. Sharing and service providers

We share data only with providers who help us run Flowlytix, under contracts that protect it:

ProviderWhat they doData involvedWhere
GoogleSign-in; Google Drive and Sheets for products that save to your own Drive; Google Analytics for flowlytix.coEmail address, the files our apps create in your Drive, website usage dataUSA and other countries
StripeCard payments and subscriptionsEmail, payment details, subscription statusUSA and other countries
CloudflareHosting Flowlytix apps and their server functions (such as sign-in and plan checks); domain name (DNS) and network security for flowlytix.co and its subdomains; storage for some products in section 3.2Technical data and server logs; the encrypted sign-in cookie passes through it but cannot be read without our key; data you store in those productsGlobal; stored data in Singapore or the nearest available region
SupabaseCloud database for products in section 3.2 and public information productsAccount details, data you save or upload in those productsSingapore
VercelHosting some Flowlytix sites and toolsTechnical data and server logsGlobal
HostNeverDie (Endit Solution Co., Ltd.)Hosting the flowlytix.co website and its accountsAccount details, technical dataThailand
Email delivery providers (only if we send account or receipt emails ourselves)Sending emails you need, such as sign-in links or noticesEmail address and the messageVaries by provider; we will name them on request
AI and analytics processing providers (business products only)Running analysis you requestBusiness data you upload, only for that analysisVaries by provider; we will name them on request
Advertising platforms such as Google Ads and Meta (only if we run ads, and only with your consent)Showing and measuring our adsCookie and usage data from flowlytix.coUSA and other countries

We update this list before we start using a new provider for personal data. We may also disclose data when the law requires it, or to a buyer if Flowlytix is sold or merged, under the same protections.

6. Google API data (Limited Use)

Flowlytix’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

  • We use Google data only to provide and improve the features you use, such as saving your plan to your own Google Sheet.
  • We do not sell it, use it for advertising, or use it to train AI models.
  • No person reads it unless you ask us to (for example, for support), it is needed for security or abuse investigation, or the law requires it.

7. International transfers, security and retention

Transfers. Google, Stripe, Cloudflare, Vercel and advertising platforms may process data outside Thailand, including in the United States. Supabase, and Cloudflare where it stores data for our products, keep it in Singapore or the nearest available region. Where the PDPA requires it, transfers rely on the provider’s standard contractual clauses or equivalent safeguards.

Security. We use encrypted connections (HTTPS), encryption at rest for data in our cloud databases, access rules that keep each account’s records separate, restricted access to our systems and our providers’ security controls. No online service is completely secure, so we cannot guarantee absolute security. If a breach puts your data at risk, we will notify the Office of the Personal Data Protection Committee within 72 hours, and tell you where the law requires.

How long we keep data:

DataKept for
Data saved in your own Google Drive (section 3.1)Not kept by us: it stays in your browser and Google Drive until you delete it
Data saved in a Flowlytix cloud database (section 3.2)While your account is active, or until you delete it; then deleted within 90 days of closing your account
Sign-in cookieIn your browser for up to 180 days, or until you sign out
Account detailsWhile your account is active, then deleted or anonymised within 90 days of closing it
Business data you upload for analysisOnly as long as needed for the analysis, or as set by your plan
Payment recordsAs long as Thai tax and accounting law requires, generally 5 years (Stripe also keeps its own records)
Analytics dataUp to 14 months
Server logsUp to 30 days, as set by our hosting providers
Backups of our databasesUp to 30 days, then overwritten
Support messagesUp to 2 years

8. Your rights and deleting your data

Under the PDPA (and the GDPR where it applies) you can ask us to:

  • give you access to, or a copy of, your personal data
  • correct data that is wrong or incomplete
  • delete or anonymise your data
  • stop or limit how we use it, or object to it, including direct marketing
  • move your data to another service (data portability)
  • withdraw consent at any time, without affecting earlier use

Email us (section 9) and we will reply within 30 days. We may need to confirm your identity, and we cannot delete payment records the law requires us to keep. You can also complain to Thailand’s Personal Data Protection Committee (PDPC) at pdpc.or.th.

To delete data from a product that saves to your own Google Drive (such as Flowlytix Money):

  1. Delete the file the app created in your Google Drive (Flowlytix Money’s Sheet is named “Flowlytix Money”, or “Flowlytix Finance” if you joined early).
  2. Remove Flowlytix at myaccount.google.com/permissions.
  3. Sign out of the app to clear that browser and delete the sign-in cookie.
  4. To stop paying, cancel your subscription in the app (in Flowlytix Money: Setup › Your plan › Manage subscription).

To delete data we keep for you (section 3.2), use the delete option in the product where one is offered, or email us and we will delete it within 30 days.

9. Cookies, age, changes and contact

Cookies and browser storage. flowlytix.co uses essential cookies for sign-in sessions and, only with your consent, analytics cookies for traffic statistics and advertising cookies if we run ads. You can manage them in the consent banner or your browser. Flowlytix apps (on our subdomains, such as money.flowlytix.co) use only essential cookies: one to keep you signed in, which holds an encrypted sign-in key, lasts up to 180 days and is deleted when you sign out, and a short-lived security cookie (about 10 minutes) that protects the sign-in step. Our apps use no advertising or tracking cookies, and use your browser’s local storage to keep your figures, language and settings on that device. Because these are strictly necessary for the service you ask for, they do not need consent. Stripe sets its own cookies on its checkout pages to process payments and prevent fraud.

Age. Our services are for people aged 20 or over, or younger with a parent’s or guardian’s consent.

Third-party services. Integrations such as Google, Stripe, Salesforce or LinkedIn follow their own privacy policies.

Changes. We will post updates here with a new effective date, and tell users by email or in the app before significant changes take effect.

Contact and data protection requests. Sompob Meeyanon (Flowlytix), Samut Prakan, Thailand · [email protected]

Decision Intelligence Apps — turning complex data into clear decisions for industries where every call matters.

Signal feed active
Company
Legal
FlowLytix
Logo
Register New Account