This Privacy Policy explains how Flowerplot ("Flowerplot," "we," "us," or "our") collects, uses, and shares information when you use our website and platform (the "Service").

1. Information We Collect

Account information. When you create an account, we collect your name and email address.

Survey and dataset content. Flowerplot's core function is to help you analyze, visualize, and publish content from survey data you upload. This data is provided by you and belongs to you (see Section 5). Flowerplot does not require or request personally identifiable information (PII) about your survey respondents as part of normal use. If your uploaded datasets contain identifying fields, that data stays associated with your account and is not exposed to other customers.

Usage data. We collect information about how you interact with the Service — pages visited, features used, chart and report creation activity, and similar log data — for product improvement and support purposes.

Payment information. If you're on a paid plan, billing details are processed by our payment processor, Stripe. We do not store full payment card numbers.

Cookies and similar technologies. See Section 8.

2. How We Use Information

We use the information above to:

• Provide, maintain, and improve the Service

• Process transactions and manage billing

• Generate AI-assisted insights from your uploaded data (used only for your own account — see Section 5)

• Communicate with you about your account, updates, and support requests

• Monitor for security issues and prevent abuse

• Comply with legal obligations

3. AI Features

Flowerplot uses AI to surface insights from your survey data. Your data is not used to train models that generate insights for other customers, and analysis results are not shared across accounts. Each customer's data and derived insights remain isolated to that customer's account.

4. How We Share Information

We do not sell your personal information. We share information only in these circumstances:

• Service providers. Vendors who help us operate the Service (hosting, payment processing, customer support tools, email delivery), bound by confidentiality obligations.

• Legal requirements. If required by law, subpoena, or to protect the rights, safety, or property of Flowerplot, our users, or the public.

• Business transfers. In connection with a merger, acquisition, or sale of assets, with notice to you.

• With your direction. When you explicitly choose to share or export content (e.g., publishing a chart, exporting a report).

5. Your Data Stays Yours

Datasets and content you upload to Flowerplot remain your property. We act as a data processor for this content — we don't use it for our own marketing claims, and we don't use it to train models for other customers.

6. Data Security

We follow security practices aligned with SOC 2 and ISO 27001 frameworks. Data is encrypted at rest and in transit, and Enterprise plans support SSO for controlled access. Your data is never used to train AI models for other customers.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Data Retention

We retain account and dataset information for as long as your account is active. After account closure, we retain data for 90 days before deletion, except where longer retention is required for legal, tax, or backup purposes.

8. Cookies and Tracking

We use cookies and similar technologies for the following purposes:

• Essential cookies. Required for the Service to function — keeping you logged in, remembering security settings, and enabling core features. These cannot be disabled.

• Analytics cookies. We use Google Analytics on our marketing website and PostHog within the app to understand how the Service is used and to improve it. These are not essential. If you'd like to withdraw consent to analytics cookies, email us at accounts@flowerplot.com.

9. Your Rights

If you are located in the European Economic Area, the UK, or Switzerland, you have the right to:

• Access the personal data we hold about you

• Correct inaccurate personal data

• Request deletion of your personal data

• Restrict or object to certain processing

• Receive your data in a portable format

• Withdraw consent at any time, where processing is based on consent

We will respond to verified requests within 30 days.

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose

• Delete personal information we've collected from you

• Correct inaccurate personal information

• Opt out of the sale or sharing of your personal information

• Non-discrimination for exercising these rights

We will respond to verified requests within 45 days. 

To exercise any of these rights, contact us at accounts@flowerplot.com. We may need to verify your identity before completing your request.

10. Subprocessors

We share information with the following categories of service providers to operate the Service:

Each subprocessor is bound by a data processing agreement consistent with applicable law.

11. International Data Transfers

If you access the Service from outside the United States, your information will be transferred to and processed in the United States, where our servers and service providers are located. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for transfers of personal data from the EEA, UK, or Switzerland.

12. Children's Privacy

The Service is not directed to individuals under 18, and we do not knowingly collect personal information from children.

13. Changes to This Policy

We may update this policy from time to time. We'll notify you of material changes via email or a notice on the Service. Continued use after changes take effect constitutes acceptance.

14. Contact Us

Questions about this policy or how we handle your data:

Flowerplot LLC 16 John H. Finley III Way, Suite 304 Framingham, MA 01701

accounts@flowerplot.com