These terms apply to every use of Flowplane: the console at flowplane.eu, the MCP and API addresses we give you, the tunnel, memory and every other part of the service. When you create an account and tick the box under “Before you start”, you accept them, together with the privacy notice. While Flowplane is in its pilot phase, the pilot agreement applies on top of these terms.
1. Who we are
Flowplane is run by LMG OPTIMIZE BV, a Belgian private limited company with its registered office at Hollebekestraat 10, 8953 Wijtschate, Belgium, enterprise number 0785.858.168, VAT BE0785858168 (“we”, “us”).
You can reach us at hello@flowplane.eu or +32 472 71 46 37. Notices about these terms go to the same address.
2. Words we use
- Account: the sign-in of one person, through Google, Microsoft or an email code.
- Workspace: the space in which an organisation or a single person uses Flowplane. A workspace has an owner, may have admins and members, and holds its connectors, agents, rules, memory and log.
- Customer or you: the company or person a workspace belongs to. For a company workspace this is the company, and the person who creates it confirms that they may bind the company.
- User: anyone the customer lets into its workspace.
- Agent: an AI assistant, script or other software that calls Flowplane on behalf of a user or of the workspace.
- Connector: a link between the workspace and a third-party application or a system in your own network, such as Google Workspace, Microsoft 365, Odoo or a server reached through a tunnel.
- Customer data: everything that you, your users and your agents put into Flowplane or send through it, including stored credentials, memory entries and the activity log of your workspace.
- Plan: Personal, Personal Pro, Company or Custom, as described on https://flowplane.eu/pricing/ and in the console.
3. What Flowplane does
Flowplane gives your agents and your software one place to reach the applications and systems you connect to it. Each call passes through Flowplane, which checks who is calling, applies the rules you set (including approval by a person where you ask for it), uses the stored sign-in to the application, and writes the call in the activity log of your workspace. Depending on the plan, Flowplane also offers memory for agents, tunnels into your own network and Watchtower.
The features of each plan are those shown in the console at the time you use them. We keep developing Flowplane and may change, add or remove features. If a change takes away something important that you pay for, we tell you at least 30 days in advance and you may end your plan before the change takes effect, with a refund of what you paid in advance for the period after it.
Unless these terms say otherwise, our commitments are obligations of means: we do what a careful provider of a comparable service would do, but we do not guarantee a result.
We may use subcontractors to provide Flowplane. We remain responsible for them towards you.
4. Accounts and access
4.1 Each account belongs to one named person. Agents, service accounts and shared mailboxes do not get a person’s account; they work through the agent and connector features. Accounts may not be shared.
4.2 You keep your sign-in, connection codes, API keys and MCP addresses secret and limit them to the people and agents that need them. If you suspect that one has leaked, revoke it in the console and tell us at once.
4.3 The owner and admins of a workspace decide who gets in, which agents exist and what they may do. We act on their settings. You are responsible for what happens under your workspace’s accounts, keys and agents, unless it results from a failure on our side.
4.4 You must be at least 18 years old to create an account.
4.5 A company customer makes sure that the users it lets in follow these terms, and informs them that their use of Flowplane is recorded in the workspace’s activity log.
5. Connectors and third-party applications
5.1 When you connect an application, you do so under your own agreement with its vendor. We are not a party to that agreement and are not responsible for the application itself, its availability, its changes or what the vendor does with the data it holds.
5.2 You confirm that you are allowed to connect each application and to let your users and agents use it through Flowplane, and that doing so does not breach the vendor’s terms.
5.3 A vendor may change or close its interface, limit access or revoke our registration. A connector may then stop working, in whole or in part, and we will try to restore it within reason, but we cannot promise that every connector keeps working.
5.4 Systems you make reachable through a tunnel remain yours. You are responsible for their security, for keeping them up to date, and for choosing who in your workspace may reach them.
6. Agents and what they do
6.1 Agents act on your instructions. Flowplane only lets them do what your rules allow, but it does not judge whether an action allowed by your rules is wise or correct. You remain responsible for what your agents do through Flowplane, including the content they send, change or delete in connected applications.
6.2 AI models can be wrong. Check their output before you rely on it. Use the approval rules for actions you want a person to confirm.
6.3 We do not use customer data to train AI models, ours or anyone else’s.
6.4 You or your users choose the AI model behind each agent. What Flowplane returns to an agent is processed by that model’s provider under your own agreement with it, and possibly outside the European Union. Our commitments about where and how data is processed cover Flowplane itself, not those providers.
7. Fair use
You will not use Flowplane, or let anyone use it, to:
- break the law or the rights of others, including privacy, intellectual property and confidentiality;
- gain access to systems, accounts or data you are not authorised to reach;
- send spam or malware, or attack, overload or probe systems, including ours;
- get around the limits, rules or security of Flowplane or of a connected application;
- copy, resell or rent out Flowplane, or build a competing service from it, unless we agreed to this in writing;
- store or send content that is clearly illegal;
- engage in AI practices that the EU AI Act (Regulation (EU) 2024/1689) prohibits;
- reverse engineer Flowplane, except where the law allows it despite this clause.
If you find a security weakness in Flowplane, report it to security@flowplane.eu and give us reasonable time to fix it before you share it with anyone.
You confirm that neither you nor the users you let in are subject to sanctions of the European Union or the United Nations, and that you will not use Flowplane from, or for the benefit of, a person or country under such sanctions.
Anyone may report content stored in Flowplane that they consider illegal to abuse@flowplane.eu, stating where the content is and why it is illegal. We handle reports carefully and without undue delay. We may block or remove content that is clearly illegal, and we tell the customer concerned what we did and why, unless the law forbids it. This address is also our single point of contact for authorities, the European Commission and users under the Digital Services Act (Regulation (EU) 2022/2065). We communicate in English and Dutch.
8. Plans, prices and payment
8.1 Prices are in euro and exclude VAT. They are shown on https://flowplane.eu/pricing/ and in the console. A Company plan is priced per active person per month, as explained there: a person counts when they signed in or worked as themselves in the workspace that month. Agents, service accounts and invitations nobody took up never count.
8.2 Paid plans are billed in advance per month or per year. Usage above the pooled allowance of a plan (for example tool calls or tunnel traffic) is billed after the month in which it took place. We warn the owner and admins before an allowance runs out and we do not cut off a workspace because it went over. We may however slow down or pause a single agent or key whose traffic threatens the stability of Flowplane or other customers’ use of it. We tell the owner and admins at once, and lift the measure as soon as the traffic is back to normal.
8.3 You pay through the payment method you add in the console (SEPA direct debit, card, Bancontact or iDEAL, through our payment provider) or by bank transfer when we agree to that. Invoices are sent by email or Peppol and are due within 30 days of their date, unless the invoice states another term.
8.4 For business customers: if an invoice is not paid on time, the amount carries interest from its due date, without prior notice, at the rate of the Belgian law of 2 August 2002 on late payment in commercial transactions, plus a fixed compensation of 10% of the unpaid amount with a minimum of €40. If an invoice is still unpaid 14 days after a reminder, we may suspend paid features until it is paid. We do not delete data because of late payment without the notice in clause 13.
8.5 Complaints about an invoice must reach us in writing within 14 days of its date. After that the invoice counts as accepted, unless the error is one a careful customer could not have noticed.
8.6 We may change our prices. A change applies to you from your next billing period that starts at least 30 days after we told you about it. If you do not accept the change, you may end your plan before it takes effect.
8.7 Prices paid in advance are not refunded when you end a plan early, except where these terms or the law say otherwise.
9. Your data
9.1 Customer data stays yours. You give us the right to store, process and transmit it only as far as needed to run Flowplane for you, to keep it secure and to meet our legal obligations.
9.2 For personal data in customer data we act as your processor. The data processing agreement in schedule 1 applies and forms part of these terms. For the account, billing and website data we use for our own purposes we are the controller, as set out in the privacy notice.
9.3 Flowplane runs in the European Union. We do not transfer customer data outside the European Economic Area. Connectors and agents send data to the applications and AI providers you choose (clause 6.4); where those are located is between you and their vendors.
9.4 Owners can export a workspace and ask for its deletion in the console at any time. Deletion takes place 14 days after the request, unless the owner asks for it to happen at once. Backups age out within 35 days after that.
9.5 We may use anonymous, aggregated figures about how Flowplane is used (such as numbers of calls or connectors) to run and improve the service. These never identify you, your users or the content of your data.
9.6 You are responsible for having a legal basis for the personal data that you, your users and your agents send through or store in Flowplane, and for informing the people it concerns.
10. Availability and support
10.1 We aim to keep Flowplane available at all times, but we do not guarantee uninterrupted or error-free operation unless we agreed a service level in writing. We may interrupt the service for maintenance. We announce planned maintenance in the console or by email when we reasonably can, and carry it out at quiet hours where possible.
10.2 Support is given by email at support@flowplane.eu on Belgian business days, within reasonable time.
10.3 If a security incident significantly affects your workspace, such as unauthorised access to its data or a serious disruption of the service, we notify the owner and admins without undue delay, and at the latest within 24 hours after we became aware of it, also on weekends and public holidays. We send an update within 72 hours and a final report within one month, describing the cause, the impact and the measures taken. This lets customers that fall under the NIS2 Directive meet their own reporting deadlines. For personal data breaches, schedule 1 also applies.
11. Intellectual property
11.1 Flowplane, its software, documentation, name and logos belong to us or our licensors. During your plan you get a non-exclusive, non-transferable right to use Flowplane for your own organisation’s purposes, within these terms. Open source components come with their own licences, which take precedence for those components.
11.2 If you send us ideas or suggestions, we may use them freely and without obligation to you.
11.3 We will only name you as a customer, or use your logo, with your written consent.
12. Confidentiality
Each party keeps the other’s non-public information it receives under these terms confidential, uses it only to perform these terms, and shares it only with staff, subcontractors and advisers who need it and are bound to the same confidentiality. This does not apply to information that is or becomes public without fault of the receiving party, that it already had or developed independently, or that it must disclose by law or court order (after warning the other party where the law allows). This duty lasts for five years after the end of the agreement, and for as long as the information remains a trade secret.
13. Term, suspension and termination
13.1 These terms apply from the moment you accept them until your last workspace is deleted and your account is closed.
13.2 Monthly plans renew each month and yearly plans each year. You may end a plan or move to another plan in the console; the change takes effect at the end of the current billing period. Consumers may end a yearly plan after its first year at any time with one month’s notice.
13.3 We may end a plan by giving 30 days’ notice by email to the owner and admins.
13.4 Either party may end the agreement with immediate effect by written notice if the other party seriously breaches it and does not remedy the breach within 30 days of a written notice describing it, or if the other party is declared bankrupt or stops its activities.
13.5 We may suspend a workspace, an account, an agent or a key without notice if this is needed to stop a security incident, abuse or a serious breach of clause 7, or if the law or an authority requires it. We limit the suspension to what is needed, tell you why as soon as we can, and lift it once the reason is gone.
13.6 After the end, you have 30 days to export your data, unless the end follows a deletion request. After those 30 days we delete the workspace as described in clause 9.4.
13.7 We may delete a free workspace in which nobody has signed in for 12 months, after warning its owner and admins by email at least 30 days in advance. Signing in during that period keeps the workspace.
13.8 Clauses 8 (for amounts still due), 12, 14, 17 and 18 continue to apply after the agreement ends, and so does schedule 1 for as long as we hold your data.
14. Liability
14.1 Our total liability under or in connection with these terms is limited, per calendar year, to the amount you paid us for Flowplane in the twelve months before the event that caused the damage. If you use Flowplane for free, on a free plan or in the free pilot, we are not liable for damage arising from that use.
14.2 We are not liable for indirect damage, such as lost profit, lost revenue, lost business or goodwill, or claims of third parties, nor for loss of data that a backup on your side would have prevented.
14.3 We are not liable for damage caused by connected applications or their vendors, by the actions of your users or agents that your rules allowed, by your failure to keep sign-ins and keys secret, or by events outside our reasonable control such as the failure of networks, power or providers we depend on, war, strikes or acts of authorities.
14.4 These limits do not apply to fraud, intentional misconduct or gross negligence, to death or personal injury, or where the law does not allow liability to be limited. If you are a consumer, clause 14 applies only as far as Belgian consumer law permits.
14.5 You must tell us of any claim in writing within 12 months of becoming aware of the damage.
14.6 Business customers will hold us harmless against claims of third parties that result from their customer data, from actions of their users or agents within the rules they set (clause 6.1), or from their or their users’ or agents’ breach of clauses 5.2, 5.4 or 7.
15. Changes to these terms
We may change these terms. We tell you about a change at least 30 days before it takes effect, by email to the owner and admins and in the console, which then asks you to accept the new version. If you do not accept it, you may end your plan before the change takes effect, with a refund of what you paid in advance for the period after it. Changes that a law requires, or that only concern new features, may take effect sooner.
16. Consumers
These terms are written mainly for business use. If you use Flowplane as a consumer, the mandatory rules of Belgian and European consumer law apply and prevail over anything in these terms. In particular, you have 14 days after taking out a paid plan to withdraw from it without giving a reason, by telling us at hello@flowplane.eu. If you asked us to start the service within those 14 days, we may charge the part of the price that corresponds to the days you used.
17. Other provisions
17.1 These terms, with the privacy notice, the pilot agreement while it applies, and any order or offer we agreed in writing, are the whole agreement between us about Flowplane. Your own purchase or general conditions do not apply, even if you refer to them in an order.
17.2 If these documents conflict, a written agreement signed by both parties comes first, then the pilot agreement, then schedule 1 for personal data, then these terms.
17.3 If a provision is invalid or cannot be enforced, the rest stays in force and we replace the provision with a valid one that comes as close as possible to its purpose.
17.4 Not exercising a right is not a waiver of it.
17.5 You may not transfer the agreement to someone else without our written consent. We may transfer it to a company that takes over Flowplane, including a company we set up for Flowplane, after telling you; if you object, you may end your plan.
17.6 Electronic records, such as the acceptance stored when you tick a box, emails and the logs of the console, count as evidence between us.
17.7 These terms exist in English and Dutch. If the versions differ, the English version prevails, unless you are a consumer and the Dutch version is more favourable to you.
18. Law and disputes
Belgian law applies. We will first try to settle any dispute amicably. If that fails, the courts of the judicial district of our registered office have exclusive jurisdiction for business customers. Consumers may also go to the court of their own place of residence, and may contact the Belgian consumer mediation service (https://consumentenombudsdienst.be).
Schedule 1: Data processing agreement
This schedule is the agreement required by Article 28 of the General Data Protection Regulation (GDPR) between you as controller and us as processor for the personal data in your customer data. Where you are yourself a processor for someone else, we are your sub-processor and you pass on these commitments.
1. Subject, duration, nature and purpose. We process personal data only to provide Flowplane to you under the terms, for as long as you use it and until deletion under clause 9.4 of the terms.
2. Categories of data and data subjects. Your users (names, email addresses, roles, sign-in records), people whose data passes through your connectors or is stored in memory (any category you or your agents choose to send), and the activity log (who or which agent called which tool, when, with which result; call arguments only as a keyed fingerprint, never their content). You decide what passes through Flowplane. Do not send special categories of data (Article 9 GDPR) through Flowplane unless your own legal basis covers it and you have checked that our measures fit that data.
3. Your instructions. We process the data only on your documented instructions: these terms, your settings in the console and your written requests. If we believe an instruction breaks the GDPR, we tell you. If the law requires us to process data in another way, we tell you first unless that law forbids it.
4. Confidentiality. Only staff who need access to run Flowplane have it, and they are bound to confidentiality.
5. Security. We take the measures in appendix A and keep them at a level that fits the risk. We may change them as long as the overall level of protection does not go down.
6. Sub-processors. You give general authorisation for the sub-processors listed at https://flowplane.eu/subprocessors/. We tell you at least 30 days before we add or replace one, by email to the owner and admins. You may object on reasonable grounds within that period; if we cannot address the objection, you may end the affected plan without penalty. We impose on every sub-processor obligations equivalent to these, and remain responsible for them.
7. Transfers. We do not transfer personal data outside the European Economic Area, and we choose no sub-processor that would.
8. Assistance. Taking into account what we can see and do, we help you answer requests from data subjects (the console lets you export, correct and delete), carry out data protection impact assessments and consult authorities. Assistance beyond the console’s features may be charged at cost if it takes significant time.
9. Personal data breaches. We tell you without undue delay, and in any case within 48 hours, after we become aware of a breach affecting your personal data. We give you what we know about its nature, the data and people concerned, its likely consequences and the measures taken, and add to it as we learn more.
10. End of processing. When your workspace is deleted, we delete the personal data as described in clause 9.4 of the terms, unless the law requires us to keep it. You can export it first. We confirm the deletion with a receipt listing what was deleted and when.
11. Audits. We make available the information needed to show that we meet this schedule, including documentation of our measures and of our sub-processors. You may have an audit carried out once a year, or after a breach, by yourself or an independent auditor bound to confidentiality, at your cost and with at least 30 days’ notice, during business hours and without access to other customers’ data.
12. Liability. Clause 14 of the terms applies to this schedule, except where the GDPR does not allow it.
Appendix A: Technical and organisational measures
- Flowplane runs in data centres in the European Union, on infrastructure operated for us in Belgium, with encrypted backups stored in the European Union.
- All traffic from and to Flowplane is encrypted with TLS. Services inside Flowplane talk to each other over TLS with certificates from our own authority.
- Stored credentials are encrypted with a key that belongs to your workspace alone, held in a separate key management system whose master key is protected by an external key management service in the European Union. Memory entries are sealed with keys per vault before they are stored. Disks and volumes are encrypted.
- Agents and users reach applications only through the rules you set. Approval by a person can be required per action.
- Every call and every change in the console is recorded in a hash-chained activity log, so later changes to the log can be detected. Call arguments are stored only as a keyed fingerprint.
- Each service has its own identity and only the rights it needs, in the cluster, in the database, in the key service and in the network (default deny).
- Access by our staff to production requires personal accounts, strong authentication and approval by a second person for sensitive operations, and is logged.
- Backups are made daily, with continuous archiving of the database, stored in a separate location with a retention lock, and kept for at most 35 days.
- On deletion of a workspace, its keys are destroyed first, which makes its stored credentials and memory unreadable, including in backups; then its records are removed and a receipt is kept.
- Our own logs and error reports carry no names, arguments or secrets.