Privacy Policy

This Privacy Policy explains how A Produle Systems Pvt Ltd, the company that makes MockFlow ("MockFlow", "we", "us"), collects, uses, shares and protects personal data when you visit mockflow.com or use MockFlow: the web app, the desktop, Mac App Store and mobile apps, browser extensions, apps and add-ins for other products, connectors, MockFlow Bridge, the MCP servers and the API. Words such as "your content" have the meaning given in the Terms of Service.

1. Who is responsible for your data

In short: MockFlow is responsible for your account data. For a team workspace, your organisation decides how its content is used.

A Produle Systems Pvt Ltd is responsible for the personal data described in this policy (the "controller" under data protection laws). Our contact details are in section 14.

When an organisation buys a team license, it controls the content its members create in its workspace, and MockFlow processes that content on the organisation's behalf and under its instructions. If you use MockFlow through your employer or school, questions about that content may be best answered by them. Organisations that need data processing terms can write to support@mockflow.com.

2. What we collect

In short: what you give us, what MockFlow records as you use it, and what services you connect send us.

What you give us

• Account details: your name, email address, password (stored encrypted), profile picture, preferences, and the answers you give when you sign up, such as your role, industry and team size.
• Your content: boards, projects, spaces, items, text, comments, chat messages, files and images you upload, audio and video comments, and the prompts, attachments and AI output from AI features.
• Billing details: your plan, invoices, billing name and address, and tax details. Paddle, our reseller, collects and holds your card or other payment details. We do not receive full card numbers.
• Messages to us: what you send to support, through in-app chat, email or forms, and your answers to surveys.

What MockFlow records as you use it

• Sign in and device data: IP address, browser and device type, operating system, time zone, language, and the times you sign in. We keep a record of sign in IP addresses to protect accounts.
• Usage data: the features you use, the pages and boards you open, activity on shared spaces, AI credits used, ratings you give AI output, and errors and performance data.
• Meetings: when you join an audio or video meeting on a board, your audio and video stream through MockFlow's servers to the other participants. MockFlow does not record meetings.
• Boards without an account: when you use a board without signing in, we keep a random identifier in a cookie and your IP address, to keep your temporary board working and to apply fair use limits.
• Website visits: pages viewed and how you arrived. Analytics and marketing data is collected as our cookie choices allow. See Cookies.

What others send us

• Sign in providers: when you sign in with Google, Microsoft, Apple or your organisation's single sign-on, we receive your name, email address and an account identifier. With SCIM, your organisation's identity provider tells us who should have a license.
• Your team: a teammate may invite you by email address, or a license admin may add you to a license.
• Connected services: when you connect a service such as Slack, Jira, Notion, Gmail, Google Drive or GitHub, we receive access to read the data you choose, as limited by that service's permissions. Connectors only read data from the service you connect.
• Apps inside other products: when you use MockFlow in Jira, Confluence, Trello, Microsoft Teams, Office, Google Meet or another product, that product tells us who you are, such as your name, email address and account or site identifier, so we can sign you in and show the right board.
• Apps on your device: the mobile app asks for the camera, microphone and photo library only when you use a feature that needs them, such as adding a photo or joining a meeting. The browser extension sends a page to MockFlow only when you choose to capture it.

What stays on your device. Board files you keep in the desktop app's file mode stay on your computer and never reach MockFlow's servers. AI in file mode works through MockFlow Bridge or the desktop app's own MCP server. With MockFlow Bridge, the AI agent runs on your computer and the files it reads are not uploaded. Only the result is saved to your board.

3. How we use it

In short: to run MockFlow for you, keep it secure, support you and improve it. Marketing only where you allow it.

We do not sell your personal data, and we do not use the content of your boards for advertising.

4. AI and your data

In short: your data is never used to train AI. It goes to an AI model only to answer a request you make.

MockFlow never uses your boards, prompts, files, chats or other content to train AI models, and never gives them to anyone for AI training, not even in an anonymised form. This applies to every plan, including Basic, and to boards made without an account.

When you use Mida or another AI feature, MockFlow sends the AI model only what it needs to answer that request, such as your prompt, the items you selected, your attachments and data from connected tools you included. Our AI providers process it to answer the request and may not use it to train their models. The AI Policy explains what is sent, which providers are used, and how chats and Concept Builder memory are kept.

5. Who we share it with

In short: people you share with, your team admins, our service providers, and the services you connect. No one else, unless the law requires it.

• People you share with. When you share a board or space, invite people, use a public link or embed a board, those people can see its content and your name and profile picture on what you contributed.
• Your organisation. On a team license, the license owner and License Admins can see who is on the license and manage access to it. They see your boards only when the boards are shared with them, and your boards move to a teammate only when you both confirm by email.
• Service providers. Companies that host, secure and support MockFlow for us, listed in section 6. They may use personal data only to provide their services to us and must protect it.
• Services and AI tools you connect. When you connect an integration, MCP client or AI tool, or use MockFlow inside another product, data you choose to send goes to that service, and its own privacy policy applies.
• Embedded content. When a board shows content embedded from another provider, such as a video or a design file, your browser loads it from that provider, which receives the usual details of a web request, such as your IP address, under its own privacy policy.
• Legal reasons. We may disclose data if we believe in good faith that the law, a court order or a valid government request requires it, or to protect the rights, safety or property of our users, the public or MockFlow. Where the law allows, we will tell you first.
• Business changes. If MockFlow is involved in a merger, acquisition or sale of assets, personal data may transfer as part of it. This policy will continue to protect it, and we will tell you before it becomes subject to a different policy.

6. Our service providers (subprocessors)

In short: these companies, our subprocessors, help us run MockFlow. Each sees only the data its job needs.

Each subprocessor works under a written agreement with us, may use personal data only to provide its service to MockFlow, and must protect it.

We keep this list up to date. Before a new subprocessor starts processing customer content, we add it here at least 30 days in advance, unless it is needed sooner to keep MockFlow secure or running. Organisations that want an email when this list changes can ask at support@mockflow.com.

7. Where your data is processed

Your data is stored in the United States on Amazon Web Services and MongoDB. Some providers, including AI providers, may process data in other countries. Wherever your data is processed, we protect it as this policy describes. Where data protection laws require it, such as for data from the European Economic Area, the United Kingdom or Switzerland, we rely on safeguards such as the standard contractual clauses in our providers' data processing terms.

8. How long we keep it

In short: as long as your account is open, with shorter limits for temporary data. Deleting your account removes it for good.

9. How we protect it

All data travels over HTTPS. Sensitive data such as passwords is encrypted, backups are encrypted and stored in separate locations, and MockFlow runs on SOC 2 certified infrastructure such as Amazon Web Services and MongoDB. Access to personal data is limited to the people at MockFlow who need it to run and support the Service, and they must keep it confidential. MockFlow was previously certified for SOC 2 Type II and ISO 27001, and a new SOC 2 Type II audit is under way. See Security at MockFlow for details.

No service can be perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.

10. Your rights and choices

In short: you can see, fix, export and delete your data, and say no to marketing. Ask us for anything you can't do yourself.

• Access and portability: ask for a copy of the personal data we hold about you, and export your boards and projects from MockFlow.
• Correction: change your name, email address and password in My Account, or ask us to correct other data.
• Deletion: delete boards at any time, and delete your account from My Account. If you have a paid plan, cancel it first. You can also ask us to delete your data.
• Objection and restriction: object to processing based on our legitimate interests, or ask us to limit how we use your data.
• Withdrawing consent: change your cookie choices with Cookie settings, and unsubscribe from marketing emails with the link in each email or in your email settings.
• Complaints: write to us as section 14 explains.

To use any of these rights, write to support@mockflow.com from the email address on your account. We may need to confirm your identity, and we will reply within the time the law requires, usually within 30 days. If your account belongs to an organisation's license, we may refer your request to that organisation.

11. Cookies

In short: necessary cookies keep MockFlow working. Where the law asks for consent, analytics and marketing cookies stay off until you say yes. Everywhere, you can turn them off.

Cookies are small files a website stores in your browser. MockFlow also uses similar technology such as local storage. We use three kinds:

If you visit from a country where the law asks for consent, a banner asks for your choice when you first visit. Wherever you are, you can change it at any time with Cookie settings, which is also in the website footer. You can also block or delete cookies in your browser settings, though some parts of MockFlow may stop working. Inside the MockFlow app, Intercom uses cookies to keep your support conversations.

12. Children

If you are a parent or guardian and believe your child has given us personal data without your consent, write to support@mockflow.com and we will delete it.

13. Changes to this policy

We may update this policy as MockFlow and the law change. The date at the top shows the current version, and the version history below lists each change with its highlights and keeps earlier versions to read. If we make a significant change, we will tell you by email or in the app before it takes effect.

14. Contact

For privacy questions, requests and complaints, email support@mockflow.com, or write to A Produle Systems Pvt Ltd, 13 Bharathi Park, 8th Cross, Saibaba Colony, Coimbatore 641011, India.

Version history

• 14 October 2026 Current
  • Rewritten to cover what MockFlow collects today, including AI requests, meetings, connectors, apps and boards made without an account.
  • Promise that your data is never used to train AI, on any plan.
  • Paddle, not FastSpring, is named as our reseller.
  • Added the full list of service providers, where data is stored (the United States) and how long each kind of data is kept.
  • New cookie section with cookie choices, asked for by a banner where the law requires consent.
  • Your privacy rights, with the extra rights that apply where you live.
• 19 May 2020

A Produle Systems Pvt Ltd. support@mockflow.com