Privacy Policy

1. Introduction

Flywheel ("we," "our," or "us") operates the Flywheel ETL platform at flywheeletl.io. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

2. Information We Collect

2.1 Information You Provide

• Account Information: Email address, name, and profile information from your Google account
• Organization Data: Organization names, member information, and role assignments
• Data Processing Information: Data schemas, mappings, transformations, and configurations you create

2.2 Information Collected Automatically

• Usage Data: Log data, IP addresses, browser type, and access times
• Authentication Tokens: Firebase authentication tokens to maintain your session
• Performance Data: Application performance metrics and error logs

3. Google API Services Usage

Flywheel uses Google APIs to provide our ETL services. When you authorize our application, we request the following permissions:

3.1 BigQuery Access

• Scope: https://www.googleapis.com/auth/bigquery
• Purpose: To read data from and write data to your BigQuery datasets as configured in your ETL workflows
• Data Handling: We store workflow configurations, schemas, and transformed data records to enable exports and mutations. Source data is processed according to your configured pipelines.

3.2 Pub/Sub Access

• Scope: https://www.googleapis.com/auth/pubsub
• Purpose: To publish and subscribe to Pub/Sub topics for real-time data streaming
• Data Access: We only access topics and subscriptions you configure for data pipelines

3.3 Firestore/Datastore Access

• Scope: https://www.googleapis.com/auth/datastore
• Purpose: To read and write documents in your Firestore databases
• Data Handling: Used for importing and exporting normalized data to Firestore collections

3.4 Cloud Storage Access

• Scope: https://www.googleapis.com/auth/devstorage.full_control
• Purpose: To read and write files in your Google Cloud Storage buckets for data imports and exports
• Data Handling: We access only the buckets and objects you explicitly configure as data sources or destinations in your ETL workflows

3.5 GCP Project Access

• Scope: https://www.googleapis.com/auth/cloudplatformprojects.readonly
• Purpose: To list your Google Cloud Platform projects so you can select which project to connect
• Data Handling: Read-only access; we only retrieve project names and IDs to populate the project selector in the connection wizard

3.6 Firebase Project Access

• Scope: https://www.googleapis.com/auth/firebase.readonly
• Purpose: To list your Firebase projects so you can select which project to connect for Firestore access
• Data Handling: Read-only access; we only retrieve project names and IDs to populate the project selector

3.7 Google Drive Access

• Scope: https://www.googleapis.com/auth/drive
• Purpose: To read from and write to your Google Drive as a data source or destination in your ETL workflows
• Data Handling: We access only the files and folders you explicitly configure in your data pipelines. We do not access, scan, or index your entire Drive.
• Use Case: Enables importing data from Drive files, exporting processed data to Drive, and synchronizing files as part of automated workflows

3.8 Gmail Access

• Scopes:
  • https://www.googleapis.com/auth/gmail.readonly - Read email messages
  • https://www.googleapis.com/auth/gmail.send - Send email messages
  • https://www.googleapis.com/auth/gmail.modify - Modify email messages (archive, label, delete)
• Purpose: To enable Gmail as a data source for analytics and reporting, send automated emails as part of workflows, and manage inbox organization
• Data Handling: We read emails you configure as data sources for extraction and analysis. We send emails only as configured in your automation workflows. We modify emails (archive, label, delete) only when explicitly configured in productivity workflows.
• Use Cases:
  • • Extract email data for reporting and analytics
  • • Send automated notifications and alerts via email
  • • Archive or categorize emails based on workflow rules
• Data Access: We only access emails within the date ranges, labels, or search criteria you specify in your pipeline configurations

3.9 Profile Information

• Scopes: openid, email, profile
• Purpose: To authenticate you and display your profile information in the application
• Usage: Used only for account identification and user interface personalization

4. How We Use Your Information

• To provide, operate, and maintain our ETL services
• To authenticate and authorize your access to the platform
• To process data according to your configured workflows
• To communicate with you about service updates and support
• To monitor and analyze usage patterns to improve our service
• To detect, prevent, and address technical issues and security threats

5. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share information only in the following circumstances:

• Service Providers: With Google Cloud Platform services necessary to operate our platform
• Legal Requirements: When required by law, court order, or government regulation
• Organization Members: With other members of your organization as configured by your organization administrator
• Business Transfers: In connection with a merger, acquisition, or sale of assets (with notice to you)

5.1 Third-Party Service Providers

We use the following third-party service providers to operate our platform:

6. Data Retention and Security

6.1 Data Retention

We retain different types of data for varying periods based on their purpose:

6.2 Security Measures

• All data in transit is encrypted using TLS/SSL
• OAuth credentials are stored in Google Cloud Secret Manager
• Access to your data is controlled by entity-based access control (EBAC)
• Regular security audits and updates to maintain platform security

7. Your Rights and Choices

You have the following rights regarding your personal information:

• Access: Request a copy of your personal data
• Correction: Update or correct your account information
• Deletion: Request deletion of your account and associated data
• Export: Download your workflow configurations and schemas
• Revoke Access: Revoke OAuth permissions at any time through your Google Account settings
• Opt-out: Unsubscribe from marketing communications

8. Cookies and Tracking Technologies

We use essential cookies and similar technologies to:

• Maintain your authentication session
• Remember your preferences and settings
• Analyze usage patterns to improve our service

You can control cookies through your browser settings, though some features may not function properly if cookies are disabled.

9. Children's Privacy

Flywheel is not intended for use by children under the age of 13. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

10. International Data Transfers

Your data may be processed in the United States or other countries where Google Cloud Platform operates. We ensure appropriate safeguards are in place for international data transfers in compliance with applicable data protection laws.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. Continued use of the service after changes constitutes acceptance of the updated policy.

11.1 Policy Version History

12. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us at:

13. GDPR Compliance (European Users)

If you are located in the European Economic Area (EEA), you have additional rights under GDPR:

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent at any time

Our legal basis for processing your data includes: (1) your consent when you authorize our application, (2) performance of our contract to provide services, and (3) our legitimate interests in operating and improving our platform.

14. California Privacy Rights (CCPA)

If you are a California resident, you have the right to:

• Know what personal information is collected, used, shared, or sold
• Delete personal information held by us
• Opt-out of the sale of personal information (we do not sell your data)
• Non-discrimination for exercising your privacy rights