Your information, in context

Privacy policy

Effective: 17 October 2026 · Operator: Fırat · Flow Atelier

Flow Atelier is a privately operated workspace for AI-assisted workflows and digital product research. This policy covers the public information site and the separate, limited-access workspace.

1. Who operates Flow Atelier

Fırat operates Flow Atelier for a small, authorized team. Questions, access requests, corrections and deletion requests can be sent to kplanfrat@gmail.com. Flow Atelier is independent of Google, Etsy, Canva and OpenAI.

2. Information the workspace handles

• Account and workflow information: account identifiers, agent configurations, task instructions, workflow definitions, execution records and saved results supplied or generated by authorized users.
• Connected-service credentials: API credentials and OAuth access/refresh tokens that a user supplies or authorizes for a connection. These are stored encrypted in the account's private server records.
• Operational information: timestamps, task status, errors and connection metadata needed to operate and troubleshoot the workspace.

3. Google data accessed and its purpose

When the owner authorizes the Google Ads connection, Flow Atelier requests Google's https://www.googleapis.com/auth/adwords OAuth scope. The current integration lists accessible Google Ads customer account identifiers and requests historical Google Search keyword metrics, such as monthly search estimates, seasonality and advertising competition where Google provides them.

This information supports the owner's topic and keyword research for digital products. The interface identifies these as Google Search signals rather than Etsy search or sales data. The current integration does not create or publish Google Ads campaigns. Access depends on the owner's permission, Google's API approval and service limits.

Flow Atelier does not use this connection to access Gmail messages, Google Drive files or Google Contacts.

4. How information is used and shared

Information is used to execute authorized tasks, display workflow activity, retain requested results and troubleshoot failures. Connected-service tools are limited by the agent's current assignments and the workflow's tool permissions.

Research responses and other task-relevant content may be included in instructions to the AI model provider selected for that task, including OpenAI when that is the configured provider. Such transfers are for the user-requested workflow. OAuth tokens and service secrets are used by the server for authentication and are not intentionally included in model prompts or public page content.

Workspace accounts have separate private records. Sharing a connection or other supported content with another account requires an explicit sharing request and recipient acceptance. Connection sharing grants supported use; it does not display the underlying secret to the recipient.

Flow Atelier does not sell Google user data, use it for advertising targeting, or use it to train its own general-purpose AI models. Flow Atelier's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The operator may access records when needed for support, maintenance, security or legal obligations.

5. Storage, retention and security

Workspace records and saved files are stored on the operator's server with account-based access controls. Service credentials and OAuth tokens are encrypted at rest. Public information pages do not contain account records, tokens or workflow results.

Workflow histories and results are retained until removed through supported controls or by the operator following a deletion request; they are not subject to an automatic expiry schedule. Operational backups can retain earlier copies until those backups are replaced or deleted during maintenance. The operator can explain the scope of a deletion request, including remaining backups. No method of storage or transmission is completely secure.

6. Your choices and deletion requests

You can remove local Google authorization using the connection's Revoke authorization control and revoke Google's grant through Google Account connections. Removing authorization prevents future authorized access but does not automatically erase previously saved research or results.

To request deletion of saved Google-derived records, credentials, results or your workspace account, email kplanfrat@gmail.com with the account and information concerned. The operator will verify the request and coordinate deletion, subject to necessary security, legal and backup retention considerations. Never send an API secret or password with the request.

7. Public website and service providers

This public site is hosted by GitHub Pages. Hosting providers may process technical request information such as IP addresses, browser details and access logs under their own policies. This site does not add advertising trackers, analytics scripts or contact forms. Contact links open your email application.

The separate workspace uses a session cookie for authentication and may store interface preferences in the browser. Connected services and selected AI providers process data under their applicable terms and privacy policies; their own account settings and data controls remain relevant.

8. Changes

Material changes to these practices will be reflected on this page with an updated effective date. New data uses will require an updated disclosure and any permissions required by the relevant service.