Privacy policy

Last updated: October 25, 2026

1. Controller and contact

WSAPP, Inc. operates flowtools and is responsible for the personal information described here. Contact: contact@wsappinc.com. Contact address: 1111B S Governors Ave, Suite 42567, Dover, Delaware 19904, United States.

This policy covers browsing the directory, accounts, submissions, paid promotions, visitor reports and support. It does not cover the independent practices of an external product you visit.

2. Information we collect and why

• Browsing and security: request information such as IP address, browser/device information, pages viewed, referrer and technical events helps us deliver pages, measure usage, troubleshoot and prevent abuse.
• Accounts: if you create or use an account, we process your email, name, profile information, authentication/session records and sign-in provider identifiers. Email links and codes support sign-in and recovery. An account is not required just to browse.
• Product submissions: we process the product name, direct website URL or X profile, icon/avatar, optional category and information you submit so we can display and manage the product. These product details, rank and aggregate paid bid total are public. A target can identify an individual, particularly an X profile.
• Bidding and payments: we process your email, optional account reference, product, bid amount and currency, checkout/payment references, payment status, refunds and disputes. We record the applicable published policy versions, acceptance of the terms, and your separate request for immediate performance with its wording, version and acceptance time. This lets us deliver promotion, provide private bid history, reconcile payments and handle complaints. We do not publish the payer's email or full payment details.
• Reports and correspondence: we process report reasons, details, moderation decisions and messages you send us. Anonymous visitor flags use a browser cookie and a hashed reporter identifier to limit abuse and repeated reports. A basic flag does not require your email; email notices and appeals include the contact information you provide.

Please do not include sensitive personal data in product descriptions, reports or support messages unless it is necessary to explain the issue. Never send us a full card number or security code.

3. Legal bases

Where data-protection law requires a legal basis, we use contract necessity for requested accounts, purchases and support; legal obligations for required accounting, payment and lawful-request records; and legitimate interests for proportionate security, abuse prevention, service improvement, moderation and establishing or defending claims. We rely on consent where required for optional tracking or marketing. Paying for promotion or agreeing to the terms does not subscribe you to marketing emails or constitute blanket tracking consent.

4. Service providers and disclosures

We use providers to operate flowtools, with access appropriate to their functions. These include AWS infrastructure for hosting, database and file storage; Resend for transactional email; Stripe for payment processing where enabled; and Google if you choose Google sign-in. Payment providers also process data under their own notices and regulatory obligations. We do not receive your full card number or card security code.

The website integrates Plausible and PostHog for usage analytics and Intercom for support/messaging where configured. These services can receive browsing events, device or network information and, depending on the service, cookies or similar identifiers. This is not a claim that all flowtools analytics are cookie-free. Browser privacy settings can limit cookies and tracking, but blocking necessary storage can prevent sign-in or checkout access.

Product previews can request website favicons from Google and X avatars from Unavatar. Loading these images can disclose the relevant hostname or handle, IP address and ordinary request metadata to that provider. Clicking an external product sends you to a separate service with its own privacy practices.

We may disclose information when legally required, to protect people or the service, to handle payment disputes, to professional advisers under appropriate confidentiality, or as part of a corporate transaction with appropriate safeguards. We do not sell payer email addresses or private bid histories.

5. Cookies and similar storage

Necessary storage supports sign-in, sessions, guest checkout access, security and report-rate limits. Analytics and messaging integrations may use additional storage. The purpose of necessary cookies is to deliver the feature you request, not to give other visitors access to your private bid history. You can clear or block cookies in your browser. This policy describes those integrations; reading it or accepting the terms does not itself grant tracking consent.

6. Retention and security

We retain information for the purpose for which it was collected and as needed for legal obligations, fraud prevention, disputes and claims. Account data is kept while needed to provide the account. Payment, policy-acceptance and moderation audit records may need to outlast account deletion or public removal of a product. Temporary access codes, sessions and rate-limit records expire according to their security purpose. Contact us to request deletion or details about a particular record.

We use access controls and other technical and organizational measures to protect information. No system is completely secure. Publicly submitted product information may also remain in search-engine caches or copies made by others outside our control.

7. International processing

WSAPP, Inc. is based in the United States and our providers may process information in other countries. Where the law requires safeguards for international transfers, we use the applicable adequacy mechanism or contractual safeguards. Contact us for information about safeguards relevant to your data.

8. Your rights and choices

Depending on your location, you may request access, correction, deletion, restriction or a portable copy of your information, object to processing based on legitimate interests, or withdraw consent without affecting earlier lawful processing. You may also complain to your local data-protection authority. We may need proportionate identity verification before disclosing private data. Some records must be retained for legal or payment-dispute reasons; we will explain an applicable exception.

Email contact@wsappinc.com to exercise rights or ask a privacy question. We respond within the period required by applicable law. We do not use visitor flag counts alone to make an automatic final moderation decision: reports are reviewed before action.

9. Children and updates

flowtools purchases are for adults. We do not knowingly collect children's account or payment information. Contact us if you believe a child has provided personal data.

We may update this policy as the service changes. The date above identifies this revision; material changes will be communicated as required. See also our Terms of service and Promotion rules.