GardenBack to sign in

Legal

Privacy Policy

This policy explains what information Garden handles, why we use it, when it leaves your workspace, and the choices available to you.

Effective August 21, 2026

1. Who this policy covers

Garden is a workspace for people and AI agents, developed and operated by Flow Research (“Garden,” “we,” “us,” or “our”). This policy applies to the hosted Garden service, its websites, and related support interactions (together, the “Service”).

If you use Garden through an employer or another organization, that organization controls its workspace and may decide what information is added, who may access it, and how long it is kept. For workspace content we process on its instructions, your organization is normally the controller or business and Flow Research acts as its processor or service provider. Contact your workspace administrator first for requests about organization-controlled content.

2. Information we collect

We collect the following categories of information:

  • Account and profile information. Name, email address, profile image, authentication records, workspace memberships, invitations, roles, and account preferences. Passwords are stored as cryptographic hashes, not readable plain text.
  • Workspace content. Chats and prompts, agent outputs, issues, comments, documents, attachments, skills, automation settings, approval decisions, and other material you or your teammates submit to the Service.
  • Agent and activity records. Instructions, tool requests and outcomes, run state, token and latency measurements, audit events, and error details needed to operate and review agent work.
  • Connected-service information. When you connect a third-party service, we receive account identifiers, granted scopes, authorization tokens, connection status, and information returned by that service when you or an agent uses it. We only request access required for the features you enable.
  • Device and usage information. IP address, user agent, session identifiers, pages and product features used, approximate location inferred from IP, timestamps, performance data, and diagnostic events. Garden disables analytics session recording.
  • Communications. Information you provide when you ask for support, report a problem, join research, or otherwise contact us.

We receive information directly from you, from your workspace and its members, automatically from your device, and from services you choose to connect. Please avoid placing sensitive personal information in prompts or workspace content unless it is necessary and authorized.

3. How and why we use information

We use information to:

  • create accounts, authenticate users, and manage workspaces;
  • provide chat, agents, issues, documents, automations, integrations, permissions, and other requested features;
  • send service messages such as invitations, password resets, security notices, and material product updates;
  • maintain security, prevent abuse, enforce permissions, investigate incidents, and preserve audit history;
  • understand product performance, diagnose failures, and improve the reliability and usability of Garden; and
  • comply with law and establish, exercise, or defend legal claims.

Where applicable law requires a legal basis, we rely on performance of our contract with you or your organization, our legitimate interests in operating and securing the Service, compliance with legal obligations, and consent where we specifically ask for it. You may withdraw consent at any time, without affecting earlier processing.

4. AI processing and connected services

Garden sends the context needed to complete your request—such as prompts, selected workspace content, tool definitions, and relevant conversation history—to the AI model provider configured for the deployment. Agents may also send information to a connected service when you request an action or when an authorized automation runs.

Flow Research does not use private workspace content to train its own general-purpose AI models. Model and integration providers process information under their agreements with Flow Research or, for services you connect directly, under the settings and terms applicable to your account. AI output can be inaccurate. Garden records activity and approval decisions so workspace members can review consequential agent actions; Garden does not use AI to make legal or similarly significant decisions about individuals on Flow Research’s behalf.

5. When we disclose information

We may disclose information to:

  • Your workspace. Administrators and other members can access information according to workspace roles, sharing settings, and product behavior.
  • Infrastructure and service providers. Vendors that support hosting, databases, file storage, AI inference, analytics, error monitoring, email delivery, security, and customer support. They may process information only to provide contracted services to us.
  • Services you enable. Providers such as GitHub, Google, Discord, Slack, or other connector and MCP services, when you authorize a connection or ask Garden to use it.
  • Legal and safety recipients. Authorities, advisers, or other parties when reasonably necessary to comply with law, protect people and the Service, or investigate fraud or abuse.
  • Business transaction participants. A buyer, successor, investor, or adviser in connection with a financing, reorganization, merger, or sale, subject to appropriate safeguards.

We do not sell personal information for money. We do not share personal information for cross-context behavioral advertising, and we do not use workspace content to target advertisements.

6. Cookies and local storage

Garden uses session cookies and similar storage required to keep you signed in, protect requests, remember interface preferences, and operate the Service. When analytics is enabled, we use PostHog to measure page views, feature use, performance, and errors. Session replay is disabled. You can control cookies through your browser, but blocking essential storage may prevent sign-in or other features from working.

7. International data transfers

Garden and its providers may process information in countries other than the one where you live. Where required, we use recognized transfer mechanisms and contractual safeguards designed to protect personal information. Your organization may choose additional providers or self-host Garden, which can change where its workspace data is processed.

8. Retention

We keep account and workspace information while the applicable account or workspace remains active and as needed to provide the Service. We retain security, audit, backup, transaction, and support records for as long as reasonably necessary for their purpose, legal obligations, or dispute resolution. Retention may depend on workspace settings, contractual commitments, the nature of the information, and technical backup cycles. When information is no longer required, we delete or de-identify it. Connected providers retain information under their own policies.

9. Security

We use technical and organizational safeguards intended to protect information, including access controls, encryption in transit, secret-redaction practices, workspace isolation, and activity logs. No method of storage or transmission is completely secure. Keep your credentials confidential, use only trusted integrations, review agent permissions, and tell us promptly if you suspect unauthorized access.

10. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal information; withdraw consent; or appeal a decision about a request. You may also have the right to complain to your local data-protection authority. We will not discriminate against you for exercising a privacy right.

You can update some profile information in Garden, disconnect integrations from connection settings, and ask a workspace administrator to manage organization-controlled content. For a request to Flow Research, use the “Start a conversation” contact at flowresearch.tech and label your message “Privacy request.” We may verify your identity and authority before acting. Authorized agents may submit requests where permitted by law.

11. Children

Garden is a work service and is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided information to Garden, contact us so we can investigate and take appropriate action.

12. Changes to this policy

We may update this policy as Garden, our providers, or applicable law changes. We will post the revised policy with a new effective date and, when a change materially affects your rights, provide additional notice through the Service or by email where appropriate.

13. Contact

Flow Research is responsible for this policy. For privacy questions or requests, use the “Start a conversation” contact at flowresearch.tech and identify the message as a privacy matter. Do not post private account or workspace information in a public GitHub issue.