Privacy Policy

This Privacy Policy explains how Value Flow Sweden AB (“we”, “us”) handles personal data when you use the Value Charts Team app, the Value Charts web app at apps.valueflowsoft.com, and related services (together, the “Service”).

We are the data controller under the EU General Data Protection Regulation (GDPR).

• Company: Value Flow Sweden AB (Swedish org. no. 559064-9116)
• Address: Synnerby Sånnatorp 6, 532 95 Skara, Sweden
• General contact: contact@valueflowsoft.com
• Privacy and data protection: privacy@valueflowsoft.com

Data you give us

Data from sign-in providers

If you choose to sign in with another account, we receive:

• Google — your name, email address and profile picture.
• Apple — your name and email address. If you choose “Hide My Email”, we only receive Apple’s relay address.
• Facebook — your name, email address and public profile ID. We do not request your friends, posts or any other permission.
• LinkedIn (web) — your name, email address and profile picture.

We never receive your password for these accounts.

Purchase data

Card payments on our website are handled by Stripe. If you choose to save a card, Stripe stores it so you can pay again or renew without re-entering it. We never see or store your full card number; we keep your Stripe customer ID, what you bought, the amount and your plan status.

Technical data collected automatically

• Server logs: your IP address, browser or app user-agent, the time and the request made. We use them to run, debug and protect the Service.
• Signed-in devices: each device gets a random ID when the app is installed or the browser first signs in. We record that ID, the platform, a device label (for example “Android device”), when it was last active, and a hashed (non-reversible) form of its IP address and user-agent. This lets you see and sign out your devices, and lets us enforce the device limit.
• Sign-in alerts: when your account is used on a new device, we notify you and include that device’s IP address and browser so you can spot unauthorised access.
• Sign-up source: whether you first joined on the web, Android or iOS, which app, and which sign-in method.
• Cookies and local storage: only what the Service needs — your sign-in session (1 day, or 30 days if you choose “remember me” or social sign-in), a device cookie (about 13 months) and preferences such as your selected workspace and view mode.

We only send service emails — we do not send newsletters or marketing emails. We do not sell or rent personal data, share it for advertising, or make decisions with legal or similarly significant effects about you by automated means alone.

Value Charts has two AI features. Both are used only when you start them.

AI assistant (chat)

The assistant runs on Google Gemini. With each message we send your message, the recent conversation (up to the last 20 messages) and a summary of your account so it can answer questions about it: your plan and subscription status, flow and project names, team names and roles, and usage counts. We do not send your name or email address to the AI. If you upload a document (PDF, Word or text, up to 10 MB), we extract its text, send part of it to the model, and store the text in your conversation. The file itself is not saved.

AI diagram generation

When you ask the AI to create or edit a diagram, we send your request, recent conversation context and — when editing — the current diagram. Simple requests go to Google Gemini; on paid plans, more complex requests go to Anthropic Claude.

Your choices

• The app asks for your consent before you first use the AI assistant. We record the consent with the time and IP address. Inside a team workspace, the team owner’s AI consent applies to the whole team.
• We use the providers’ business APIs and send only what the request needs. We do not use your content to train our own models.
• Please do not put sensitive data (for example health information) or other people’s confidential information into AI requests.
• Download your AI data as a file, or delete it, at any time: Settings → Danger Zone → Delete AI Data removes your AI conversations, requests and consent, and keeps your account and credit balance.

Other users

• Your personal workspace is private to you.
• In a team workspace, members can see the team’s flows, projects and chat. The team owner and admins can also see the member list (name, email, photo, role and Pro status) and every flow created in the team workspace together with who created it.
• Share links: when you share a flow by link, anyone who has the link can view that flow, read-only, without signing in. Only share links with people you trust.

Our staff

A small number of authorised staff can access accounts and content when needed to provide support you ask for, investigate security or abuse, or meet a legal obligation. Access is limited to those who need it.

Service providers (processors)

These providers process data only on our instructions and under a data processing agreement:

Independent third parties

• Sign-in providers (Google, Apple, Meta/Facebook, LinkedIn) process your data under their own policies when you sign in with them.
• Authorities, when the law requires us to disclose data, or to protect the rights and safety of users or the Service.
• A buyer or successor, if our business is merged or sold. Your data would stay protected by this policy, and we would tell you before any different policy applied.

When personal data is processed outside the EU/EEA, we rely on the EU–US Data Privacy Framework where the provider is certified under it, or on the European Commission’s Standard Contractual Clauses, with additional safeguards where needed. Your data is hosted in AWS data centres. You can ask for a copy of the safeguards at privacy@valueflowsoft.com.

1. Open Value Charts Team and go to Settings → Danger Zone.
2. Choose Delete Account and confirm with your password, or type DELETE if you use social sign-in.

This immediately deletes your account, personal workspace, diagrams, chat messages, AI data, credit balances, devices and notifications — on every device and on the web. Uploaded files are removed from storage straight after. Any active website subscription is cancelled and your Stripe customer record is deleted.

What remains:

• Purchase records required by law, no longer linked to you.
• Flows you created inside another person’s team workspace stay with that team, without your name on them.

If you own a team that still has other members, remove them or delete the team first. Uninstalling the app does not delete your account.

You can also email contact@valueflowsoft.com with the subject “Data Deletion Request”. See our data deletion page for details.

Under the GDPR and similar laws, you have the right to:

• Access — a copy of the personal data we hold about you.
• Rectification — correct your data. You can edit most of it yourself in Settings.
• Erasure — delete your data (see above).
• Portability — your data in a machine-readable format. You can export any diagram (XML, SVG, PNG, JPEG, PDF) and download your AI data yourself; for everything else, email us.
• Restriction and objection — limit or stop processing based on our legitimate interests.
• Withdraw consent for AI at any time, from Settings.

Email privacy@valueflowsoft.com to use these rights. We reply within one month, may ask you to confirm your identity, and do not charge for requests.

California and other US states

You can ask to know, correct and delete your personal information, and you will not be treated differently for doing so. We do not sell or “share” personal information as the CCPA/CPRA defines those terms.

Complaints

You can complain to your local data protection authority. Our lead authority is the Swedish Authority for Privacy Protection (IMY), imy.se. Please contact us first — we would like the chance to fix it.

• All traffic uses HTTPS (TLS).
• Passwords, device sign-in keys and session tokens are stored only as hashes.
• Every workspace is isolated — data is scoped to your account and the team you are working in.
• Purchases are verified by our server with Stripe, never trusted from the device.
• Each app allows up to three signed-in devices. You can see them and sign any of them out in Settings; signing out another device requires a code sent to your email.
• New sign-ins trigger an alert so you can react quickly.

No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify IMY within 72 hours and tell you without undue delay.

The Service is meant for professionals and is not directed at children. You must be at least 16 years old to use it. We do not knowingly collect data from children under 16; if you believe a child has given us personal data, contact privacy@valueflowsoft.com and we will delete it.

We will update this policy when our practices change; the date at the top shows the current version. For significant changes we will tell you by email or in the app before they take effect. Our Terms and Conditions set out the rules for using the Service.