Privacy Policy

This Privacy Policy outlines how FLEX FLOW AI LLC ("we", "us", or "our"), operating out of Yerevan, Armenia, collects, processes, and protects information in connection with the website located at agent-ui.net and the Agent-UI customer support chatbot platform (the "Service").

For the purposes of applicable data protection regulations (including the EU General Data Protection Regulation / GDPR):

• Data Controller: We act as the Data Controller with respect to your account registration, administrative credentials, billing contact, and platform usage metrics.
• Data Processor: When you deploy Agent-UI on your website, you act as the Data Controller of your end-users' data and chat messages, and we process that data on your behalf in accordance with your instructions and settings.

We collect several categories of information across the platform:

We process your data for the following legitimate business purposes:

• To provision, maintain, and support your account and embedded chat widgets.
• To retrieve contextually relevant knowledge chunks via vector similarity search to formulate chatbot responses.
• To securely transmit prompts and knowledge snippets to LLM provider APIs (OpenAI, Google, Anthropic) to generate accurate completions.
• To monitor account security, detect anomalous traffic, prevent fraud, and mitigate prompt injection attacks.
• To relay live conversation handoffs, lead captures, and email notifications via Resend.
• To enforce plan message quotas and maintain operational stability via Upstash Redis.
• To respond to user inquiries and support requests.

Depending on the model configured in your chatbot settings (e.g., GPT-4o Mini, Gemini Flash, or Claude Haiku), user queries and relevant knowledge excerpts are transmitted securely via encrypted TLS connections to the respective provider for real-time inference.

We rely on vetted third-party subprocessors for hosting, database storage, authentication, email delivery, and AI inference:

Active Database Retention: We retain your personal information and Customer Content in our active database as long as your account remains active or as needed to provide, maintain, secure, and improve the Service.

Configurable Chat Retention: You can configure the message retention threshold for your chatbots (default 30 days). Once messages exceed this threshold, they are automatically purged from our active database.

Account Deletion: If you choose to delete your account or individual chatbots, we initiate the deletion of your Account Data, knowledge documents, and pgvector embeddings from our primary database.

Account Suspension & Legal Preservation: We may suspend, restrict, or terminate your account, and may delete or anonymize associated data, when reasonably necessary to protect the Service, enforce our Terms of Service, prevent fraud or abuse, address security incidents, comply with legal obligations, or discontinue the Service. Where required by applicable law, we will retain records we are legally obligated to preserve.

Residual Data in System Backups: Residual data may persist temporarily in automated system backups, database snapshots, security logs, or fraud-prevention records until such data is routinely overwritten and purged according to our automated backup rotation schedules (typically up to 30 to 60 days).

We implement technical and organizational safeguards designed to protect your data against accidental loss, unauthorized access, or disclosure:

• All network communications are encrypted in transit using TLS 1.2+ / TLS 1.3.
• Primary database records, documents, and vector embeddings are encrypted at rest using industry-standard AES-256 encryption.
• API keys and visitor IP addresses are hashed using strong cryptographic one-way hashing algorithms to protect identity and access credentials.
• Production database access is restricted to authorized operations engineers using multi-factor authentication (MFA).

While we implement rigorous technical safeguards, no internet-based system or database can be guaranteed to be 100% invulnerable to unforeseen security incidents or hardware failures. We continuously evaluate and enhance our controls to mitigate emerging risks.

FLEX FLOW AI LLC is headquartered and operates in the Republic of Armenia. However, the cloud hosting infrastructure, database instances, and third-party AI APIs (such as OpenAI, Google, Anthropic, Clerk, and Vercel) are located in other jurisdictions, predominantly within the United States and the European Union.

Consequently, your data may be transferred to, stored, and processed in locations outside of your country of residence. When we transfer personal information internationally, we do so in accordance with applicable data protection laws, utilizing standard contractual clauses and appropriate technical safeguards where required.

Depending on your jurisdiction, you may have specific statutory rights regarding your personal data, which include:

• Right to Access & Portability: You may request a copy of the personal data we hold about you in a structured, commonly used, and machine-readable format.
• Right to Rectification: You can update and correct inaccurate account information directly in your profile settings.
• Right to Erasure ("Right to be Forgotten"): You may request the permanent deletion of your account and all stored conversational data, subject to lawful retention requirements.
• Right to Restrict or Object to Processing: You may object to or request restrictions on certain processing activities grounded in legitimate business interests.

To exercise any of these rights, please contact us at support@flex-flow.ai. We will evaluate and process your request in accordance with applicable law within thirty (30) days.

We use standard technical mechanisms to maintain application state and monitor performance:

• Session & Security Cookies: Managed via Clerk to keep you authenticated and recognize your device across sessions.
• Vercel Analytics: Privacy-friendly application telemetry to monitor page response times, geographic routing, and error rates without tracking personal identities across third-party sites.
• UI State: Local browser storage to remember light/dark mode preferences and active chatbot tabs.

We do not sell your personal data or deploy cross-site tracking cookies for third-party advertising.

The Service is intended strictly for use by adults and business professionals. We do not knowingly collect personal information from individuals under the age of 18. If you become aware that a minor has provided us with personal information without proper authorization, please contact us immediately so we can take steps to remove it.

We reserve the right to modify, update, or replace this Privacy Policy unilaterally and without obtaining prior consent, subject to applicable law. Revisions may be introduced when necessary to reflect changes to the Service, our data processing practices, evolving legal requirements, security standards, or operational enhancements.

We will publish the revised policy on this page with an updated "Effective Date". Your continued use of the Service after the updated Privacy Policy becomes effective constitutes your acknowledgment of the revised policy, to the extent permitted by applicable law. Where applicable law requires additional notice or consent for particular changes, we will provide it accordingly.