1. Overview & Commitment to Privacy
Inov8ing Tech ("we", "us", or "our") operates Autoflow (including the Chrome Web Store extension and web portal at autoflow.inov8ing.io). We take your digital privacy seriously and adhere to strict privacy-by-design engineering principles. This Privacy Policy discloses what data we collect, why we collect it, and how your personal information is protected.
Autoflow does NOT collect, inspect, upload, or store your text prompts, generation recipes, images, videos, or downloaded media. All automation scripts execute 100% locally in your active browser session directly against Google Flow.
2. Information We Collect
We collect only the minimum required information necessary to provide authentication and manage active license slots:
- Account Credentials: Your email address and a salted, cryptographically hashed representation of your password (via bcrypt). We never store plaintext passwords.
- Device Identifiers: A pseudo-anonymous random device identifier generated on your browser to enforce your plan's browser profile allowance (3 browser profiles for standard tiers, up to 5 for Lifetime Pro). 1 browser profile + extension equals 1 login slot.
- Billing & Transaction References: Transaction reference IDs, receipts, and optional notes submitted via our manual payment verification flow (Upaisa, FirstPay, SadaPay, Meezan Bank, Binance Crypto).
- Usage Quota: Aggregate daily prompt counts for Free Tier accounts (50 prompts daily limit) to enforce anti-abuse limits.
3. Chrome Extension Permissions & Data Handling
Autoflow requests the following Chrome permissions solely for functional workflow automation:
storage: Used to store your active authentication session token, user preferences, and Local Prompts Bank locally inside your browser profile.activeTab/ Host Permissions (*://flow.google.com/*,*://labs.google/*): Used exclusively to interact with the Google Flow web user interface, automate queue dispatch, and download completed video files directly to your device.tabCapture(Pro Tiers): Used exclusively for headless background execution when explicitly activated by paid Pro users.
4. Authentication & Two-Factor Security (2FA)
To protect accounts against unauthorized access and credential stuffing, our system employs dynamic device-aware 2FA. When you log in from a new browser, an encrypted 6-digit one-time code is dispatched via authenticated transactional SMTP. Verification codes automatically expire after 10 minutes and are permanently invalidated once used.
5. Third-Party Disclosures & Analytics
We do NOT sell, rent, monetize, or trade your personal data with third-party brokers, advertisers, or analytics aggregators. We do not use third-party behavioral tracking cookies or fingerprinting trackers.
6. Data Retention & Deletion Rights (GDPR & CCPA)
You have the complete legal right to request an export or permanent erasure of your account, device activations, and transaction records at any time. Simply contact us from your registered email address, and our data protection team will purge your data within 48 business hours.
7. Contacting Us
If you have any questions or inquiries regarding this Privacy Policy, please reach out to our team: