Privacy Policy

1. Who we are and what this covers

FlyWheel1 (“we,” “us,” or “our”) provides flywheel1, software that helps business teams review engineering documents and prepare risk assessments. This Privacy Policy explains how we collect, use, disclose, and retain personal information through flywheel1.com, our application, and related services.

We are responsible for personal information we use to manage our website, accounts, business relationships, and service security. When a customer uploads information about other people or manages a team workspace, we process that information on the customer’s behalf under our agreement with that customer. Contact your organization first about information it controls; we can help route your request.

2. Information we collect

Account and organization information: your name, email address, profile image when provided, authentication identifiers, organization membership, roles, and invitations.
Customer content: documents, drawings, project details, prompts, messages, comments, assessments, and other material you or your organization submit, together with generated results and related activity. Engineering documents may contain names, signatures, contact details, or other personal information.
Communications and business records: information you send when requesting a demonstration, contacting support, or discussing an agreement, including contact and billing details provided for that relationship.
Technical and usage information: IP address, browser and device information, timestamps, pages or features used, request and error logs, and information needed to authenticate sessions, prevent abuse, and troubleshoot the service.

We receive information directly from you, from your organization and authorized users, from authentication providers you choose, and automatically when you use our services. Please submit only information you are authorized to share and that is needed for your work.

3. Google sign-in

If you choose Sign in with Google, we and our authentication provider, Clerk, receive the basic identity information authorized by Google: your Google account identifier, email address and verification status, name, and profile image when available. We use this information to authenticate you, link your account, display your profile, and protect account access.

Our Google sign-in connection requests only basic identity, email, and profile permissions. It does not request access to Gmail messages, Google Drive files, Calendar events, or your Google password. Signing in does not automatically import your Google documents.

You can remove the connection through your Google Account connections settings. Revoking access stops future access through that connection; it does not by itself delete information already held in your flywheel1 account. Contact us or your organization to request deletion.

4. How we use information

Provide accounts, authentication, organization access, document storage, collaboration, and requested engineering analysis.
Process prompts and customer documents to generate, display, and save results.
Respond to requests, provide support, administer agreements, and send service or security communications.
Maintain, debug, secure, and improve the reliability and usability of our services.
Detect misuse, enforce our agreements, meet legal obligations, and protect legitimate rights.

Where applicable law requires a legal basis, we rely on performance of a contract, our legitimate interests in operating and securing our business, compliance with legal obligations, or consent where required. Where we act on behalf of a customer, that customer determines the relevant legal basis.

5. Customer documents and AI processing

AI features send the relevant documents, document extracts, prompts, conversation context, and related project information to the AI and processing providers used for that feature. Those providers process this information to perform the requested work. Avoid including personal or confidential information that is unnecessary for the task.

Our service uses providers such as Anthropic and, for configured workflows, OpenAI. The provider and processing environment can vary by feature or customer configuration. Provider retention and processing terms depend on the applicable service and contract; contact us for information relevant to your deployment.

Google sign-in information is used for account and security purposes, not to train AI models. Access to customer content by our personnel is limited to authorized service, support, security, and legal purposes. Additional confidentiality, data-use, or retention commitments may be set out in your organization’s agreement.

Service providers: providers supporting authentication, hosting, storage, databases, background processing, AI features, communications, and technical operations. These include Clerk, Vercel, Amazon Web Services, Trigger.dev, and the AI providers described above, as applicable to the service you use.
Your organization and authorized collaborators: administrators and other users may access information according to their roles and the content you share. Your organization controls its workspace access.
At your direction: when you authorize an integration, export, or other disclosure.
Legal and security purposes: when reasonably necessary to comply with law or lawful process, investigate misuse, enforce agreements, or protect rights, safety, and security.
Business transactions: in connection with a merger, financing, acquisition, reorganization, or transfer of assets, subject to appropriate confidentiality protections.

We do not sell personal information or share it for cross-context behavioral advertising. We do not make customer documents public merely because they are uploaded to the service.

7. Cookies and similar technologies

Our application and service providers use cookies or similar storage for functions such as sign-in, session management, security, and remembering settings. Hosting services also receive technical request information when you visit our website. You can manage cookies in your browser, but disabling necessary cookies may prevent parts of the service from working. We do not use advertising cookies on our marketing website.

8. Retention and security

We retain information for as long as reasonably needed to provide the service, fulfill our agreements, support security and operations, resolve disputes, and comply with legal obligations. The period depends on the type of information, the customer’s instructions and agreement, and applicable requirements.

After a deletion request or account closure, some information may remain for a limited period in backups, security records, or records that must be retained for legal reasons. Backup information is removed through the applicable retention cycle. Contact us for retention details relevant to your account.

We use technical and organizational measures designed to protect information, including access controls and authentication. No system or transmission method is completely secure.

9. International processing

We and our service providers may process information in the United States and other countries where we operate. Those countries may have different data protection laws from your country. Where required, we use legally recognized safeguards for international transfers, such as contractual protections. Contact us for information about the safeguards applicable to your data.

10. Your choices and privacy rights

Depending on where you live and the law that applies, you may have rights to access, correct, delete, or receive a copy of your personal information; restrict or object to certain processing; or withdraw consent where processing relies on consent. Withdrawal does not affect processing already lawfully performed. You may also have a right to complain to your local data protection authority or appeal a decision on a privacy request.

Send requests or appeals to info@flywheel1.com. Tell us the account or organization involved and what you would like us to do. We may need to verify your identity and authority before fulfilling a request. Authorized agents may contact us on your behalf where permitted by law. We will respond within applicable legal time limits and will not discriminate against you for exercising your rights.

If the information is controlled by your organization, we may refer your request to its administrator or assist it with the request. You can also manage available profile settings in the application, revoke Google access as described above, and opt out of promotional emails using an unsubscribe option or by contacting us. Essential service messages may still be sent.

11. Children

Our services are designed for business users and are not directed to children under 18. We do not knowingly collect personal information from children under 18. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

12. Changes and contact

We may update this policy as our services or legal requirements change. We will post the revised policy with an updated date and provide additional notice of material changes where required. This policy does not override a separate data processing agreement that applies to customer-controlled information.

For questions about this policy or our handling of personal information, contact FlyWheel1 at info@flywheel1.com.