Privacy Notice — flowgo-map.com
What personal data flowgo-map.com processes, why, on what legal basis, how long we keep it, and what you can do about it. Information under Art. 13/14 GDPR.
Last updated: 8 August 2026 · Applies to the hosted service at flowgo-map.com only.
Scope. This notice covers the hosted flowgo service at flowgo-map.com, and it is the only privacy notice that applies to it. The company website exaptation.eu is a separate service with different processing and its own notice. If you run flowgo yourself from the open-source project, none of this applies — you are then your own controller.
- 1. Who is responsible
- 2. Short version
- 3. What we process, why, and on what legal basis
- 4. Cookies and local storage
- 5. How long we keep things
- 6. Who else sees the data
- 7. Transfers outside the EU/EEA
- 8. Your rights
- 9. Doing it yourself
- 10. Security
- 11. Changes to this notice
1. Who is responsible (controller, Art. 4(7) GDPR)
- Controller
- Exaptation GmbH
- Address
- Osterbrooksweg 35–41, 22869 Schenefeld, Germany
- Managing Director
- Lasse Alexandros Diercks
- Register
- Amtsgericht Pinneberg, HRB 19637 · VAT ID DE462036981
- Contact for data-protection matters
- legalexap.product172@passmail.net
Full company details are on the Legal Notice (Impressum).
Data protection officer: none appointed. Exaptation GmbH is below the thresholds in Art. 37 GDPR / § 38 BDSG that would require one. Use the contact address above for any data-protection request.
2. Short version
- You can use the editor without an account and without giving us any personal data. An anonymous session cookie holds your draft for 24 hours.
- If you create an account, the only personal detail we ask for is your email address. There are no passwords — we sign you in with a one-time link.
- We do not use analytics, tracking pixels, advertising, third-party fonts or third-party CDNs. There is nothing to consent to, so there is no cookie banner.
- We never sell or rent your data and do not use your email address for marketing.
- Maps you share via a
/m/<id>link are public to anyone who has the link. Do not put personal or confidential information in a shared map. - You can change your email or delete your account yourself at /account.
3. What we process, why, and on what legal basis
Art. 6(1)(b) below means "necessary to perform the contract with you or to take steps at your request" — i.e. actually delivering the service you asked for. Art. 6(1)(f) means "legitimate interests", which we state explicitly in each row.
| Processing | Data | Purpose | Legal basis |
|---|---|---|---|
| Anonymous editing | A random session identifier in the flowgo_session cookie; the draft map
you are editing, held in the server's memory |
Letting you use the editor without signing up, and keeping your draft across page loads | Art. 6(1)(b) — providing the service you requested |
| Account creation & magic-link sign-in | Email address; a SHA-256 digest of the one-time sign-in token (never the token itself); the IP address the sign-in request came from; timestamps (account created, last verified, last sign-in) | Creating and authenticating your account | Art. 6(1)(b) — the IP address specifically on Art. 6(1)(f), see the abuse row |
| Sending the sign-in email | Your email address; the sign-in link | Delivering the link you asked for | Art. 6(1)(b) |
| Changing your email address | The new email address; a SHA-256 digest of the confirmation token | Confirming you control the new address before we switch it | Art. 6(1)(b) |
| Abuse prevention & rate limiting | The IP address of sign-in requests (stored alongside the sign-in token record); the IP address of calls to our API endpoint (counted in memory only, never written to the database) | Stopping someone from spamming a person's inbox with sign-in links, mass account enumeration, and API flooding | Art. 6(1)(f) — our legitimate interest in keeping the service available and not turning it into a spam vector. We consider this low-impact: the IP is used only for counting, is never enriched or profiled, and is deleted quickly (see §5) |
| Saved maps (account) | The content of each map you save, its title, and created/updated/last-opened timestamps | Storing and serving back the maps you asked us to keep | Art. 6(1)(b) |
Shared snapshots at /m/<id> |
The map content at the moment you shared it, plus created/last-viewed timestamps. No account link is stored — a snapshot has no owner record | Publishing a map at a link you can pass around. Note that pasting the link into a chat app (Slack, WhatsApp, Discord, LinkedIn and similar) makes that app fetch a preview from us, which sends the map's title and a rendered image of it to that platform | Art. 6(1)(b) |
| Live collaboration sessions | The shared document, held in memory while the session is open, and auto-saved to the database roughly every 30 seconds. Joining requires an invite secret that lives only in the invite link; our database stores only a digest of it, never the secret itself, and it is revoked when a participant leaves | Letting several browsers edit the same map at once and surviving a page reload | Art. 6(1)(b) |
MCP endpoint (/api/mcp) |
The map content an AI agent or MCP client sends or requests; a short-lived in-memory workspace; the caller's IP address for rate limiting | Letting AI agents and MCP clients create and edit maps programmatically | Art. 6(1)(b) for the map operations; Art. 6(1)(f) for the rate limiting |
| Agent account linking | A short-lived pairing code and an agent-session identifier, both stored only as SHA-256 digests, linked to your account once you approve the pairing in your browser. Maps and snapshots the linked agent creates record your account as owner | Letting you tie an AI agent's MCP session to your account, so its maps land in your account instead of being anonymous | Art. 6(1)(b) |
| Server-side operational logs | Diagnostic log lines for authentication and collaboration events. Email addresses in
these lines are masked (e.g. la***@example.com) and
session identifiers are truncated. Some lines contain the requesting IP address |
Debugging, security incident investigation, keeping the service running | Art. 6(1)(f) — our legitimate interest in operating and securing the service |
Map content
A map is whatever you type into it. If you put someone's name, email address or other personal data into a map, we process it as part of storing and serving that map back to you — we do not read, index, analyse, moderate or use map content for any other purpose, and we never use it to train models. You decide what goes in.
Is providing data required?
No, for anonymous use — you can use the editor without providing anything. If you want an account, an email address is required: it is the only way we can identify you and send you a sign-in link. Without it, an account cannot be created.
Automated decision-making
There is no automated decision-making or profiling within the meaning of Art. 22 GDPR. Rate-limit counters are simple thresholds, not profiling.
5. How long we keep things
The periods below are the ones our systems actually enforce. Deletion jobs run on a schedule (every six hours), so the real deletion point can be up to six hours after the period expires — the outer bounds stated here already include that.
| Data | Kept for | Then |
|---|---|---|
| Anonymous editing draft (server memory) | 24 hours from last activity | Discarded. Also lost whenever the server restarts, and the oldest drafts are discarded early if the server is holding an unusual number of them |
| Sign-in link record — email address + IP address + token digest | Until 24 hours after the link is used or expires, so at most about 30 hours and never more than 48 hours after the sign-in request | Row deleted, including the IP address. The 24-hour tail is what makes the rate limiting work |
| Email-change confirmation record (new address + token digest) | The confirmation link is valid for 15 minutes; the record is kept for a further 24 hours, so at most about 30 hours in total | Deleted |
| Account (email address, timestamps) | Until you delete the account | Deleted immediately on request — see §9 |
| Signed-in session records | 30 days from last use (sliding) | Deleted. Signing out deletes the record immediately |
| Agent pairing codes (digest only) | Valid for 10 minutes, single-use | Deleted after use or expiry |
| Linked agent sessions (digest only) | 30 days | Deleted. Ending the agent session or deleting your account removes it immediately |
| Saved maps | Until you delete them | Marked deleted immediately and hidden from you at once; the underlying row is permanently erased 30 days later |
Shared snapshot at /m/<id> |
90 days after it was last opened | Deleted. Every view resets the 90 days, so a snapshot people keep visiting stays alive |
| Auto-saved live-collaboration snapshot | 14 days after the last change | Deleted |
| Live collaboration document in memory | 30 minutes after the last participant leaves (checked every 5 minutes) | Dropped from memory |
| In-memory API rate-limit counters | Rolling one-minute window | Discarded; never written to disk |
| Operational logs | 7 days | Deleted. See the note below |
Two things we want to be straight about.
Who a shared snapshot belongs to depends on how it was created.
A /m/<id> link shared anonymously stores no link back to you — good
for your privacy, but it means neither you nor we can automatically find "your"
snapshots later, and deleting your account does not delete them. A link shared
while signed in, from one of your saved maps is associated with that map: its
share links are listed in the map's settings, and deleting the map or your account
deletes the snapshots behind them. A snapshot created through an
account-linked agent session (§3, MCP) records you as its owner; deleting
your account removes that attribution, and the snapshot then behaves like an anonymous
one. For any snapshot you cannot remove yourself, send us the link (§9) and we will
delete it. Snapshots otherwise expire on the 90-day schedule above.
Logs. Our application deliberately writes as little personal data to logs as possible (masked email addresses, truncated session identifiers). Logs are retained for 7 days, then deleted.
6. Who else sees the data
Very few parties, because we host flowgo ourselves.
| Party | Role | Where |
|---|---|---|
| Exaptation GmbH's own infrastructure | Hosting: application servers and the database run on hardware we operate ourselves, at our registered business address | Schenefeld, Germany |
| Our own mail server | Sends sign-in and email-change messages. It is our machine, not a third-party mail service. Once a message leaves it, delivery passes through your email provider, which is outside our control | Schenefeld, Germany |
| Hetzner Online GmbH | Offsite backup storage (processor under Art. 28 GDPR) | Nuremberg, Germany |
| INWX GmbH & Co. KG | DNS for flowgo-map.com. No personal data of users flows here | Germany |
| Let's Encrypt / ISRG | Issues our TLS certificate. Sees only domain-validation data, never user data | USA |
We do not use any analytics provider, advertising network, third-party
font or icon CDN, customer-data platform or A/B-testing service. The editor itself loads
nothing from anywhere but this domain. Every page's footer carries a "built by Exaptation"
attribution badge; the script behind it (/badge.js) is vendored into this
service and served from this domain, not fetched from exaptation.eu at
request time, so viewing a page makes no request to any other domain on its account.
We do keep a small number of anonymous, server-side counters — for example how many times our start page was opened — which record nothing but a running total and cannot be linked to you, your device or your IP address.
Beyond the above, we disclose personal data only where we are legally obliged to (e.g. a valid order from a competent authority).
7. Transfers outside the EU/EEA
None. All processing of your personal data happens on infrastructure located in Germany. Let's Encrypt is US-based but receives no personal data of flowgo users — only the domain name being certified.
8. Your rights
Under the GDPR you have the right to:
- Access (Art. 15) — get confirmation of whether we process data about you and a copy of it.
- Rectification (Art. 16) — have inaccurate data corrected.
- Erasure (Art. 17) — have your data deleted.
- Restriction (Art. 18) — have processing limited in certain circumstances.
- Data portability (Art. 20) — receive the data you provided in a structured, machine-readable format.
- Object (Art. 21) — object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 6(1)(f) — i.e. the abuse-prevention and logging rows in §3).
Write to legalexap.product172@passmail.net or to the postal address in §1. We answer within one month (Art. 12(3) GDPR). Several of these rights you can exercise yourself, instantly — see §9.
Right to lodge a complaint (Art. 77)
You can complain to a supervisory authority, in particular in the member state of your residence, place of work, or of the alleged infringement. The authority competent for us is:
Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD)
Holstenstraße 98, 24103 Kiel, Germany
www.datenschutzzentrum.de
9. Doing it yourself
- Change your email address: /account. We send a confirmation link to the new address; nothing changes until you click it.
- Delete your account: /account → Delete account.
This immediately and permanently deletes your account record, your saved maps, your
sign-in sessions and any pending email-change request. It cannot be undone. Note the
carve-outs: share links created from your saved maps are deleted with the account, but
anonymously shared
/m/<id>snapshots are not linked to your account and are not covered (see §5); an auto-saved live-collaboration snapshot created from a different browser than the one you delete from expires on its own 14-day schedule rather than being removed at that moment; and any recent sign-in-link record (which holds your address and the request's IP) is keyed to the email rather than the account, so it is not deleted at that moment either — it ages out on the schedule in §5, within 48 hours. - Get a copy of your maps: /account →
Download all maps gives you a single zip archive containing every
map you have saved plus a manifest listing each map's title, timestamps and public
share links. Each map is a
.flowgofile — plain text and machine-readable. For one map at a time, use Export .flowgo in the editor menu. If you prefer, or if the download doesn't work for you, email us (§8) and we will send you a complete export. - Sign out everywhere: signing out deletes that session record on the server, not just the cookie.
- Take down a shared snapshot: if it was shared from one of your saved
maps, revoke it yourself in that map's settings (each listed share link has a Revoke
button; deleting the map revokes all of them). For snapshots shared anonymously —
which are not linked to any account — email us the
/m/<id>link and we will delete it.
10. Security
Measures we take (Art. 32 GDPR):
- All traffic is served over HTTPS.
- No passwords exist — there is no password database to leak.
- Sign-in tokens, session tokens and email-change tokens are stored only as SHA-256 digests. A copy of our database does not let anyone sign in as you.
- Session cookies are
HttpOnlyandSameSite=Lax, and markedSecurein production, so page scripts cannot read them. - Sign-in links are single-use and expire after 15 minutes.
- Rate limits on sign-in requests (per email address and per IP address) and on the API endpoint.
- Application logs mask email addresses and truncate session identifiers.
- Shared snapshot pages carry
noindexand are excluded inrobots.txt, so well-behaved search engines do not index them. This is not a security control — anyone with the link can open it. - Infrastructure is operated by us, in Germany, with access limited to the managing director.
No system is perfectly secure. flowgo-map.com is an early-stage service — please read the Terms of Use as well, and keep your own copies of maps that matter to you.
11. Changes to this notice
We update this notice when the service changes. The date at the top always reflects the current version. Where a change materially affects how we handle your data, we will make a reasonable effort to tell account holders directly.