Evokoa Inc. (“we,” “us,” or “our”) operates FlashDrive, a shared drive for teams and their AI agents, with built-in tools for finding files. This policy covers FlashDrive. Our Trust Center brings together our privacy, security and service policies. The Service includes the website at https://flashdrive.space, the application at https://app.flashdrive.space, API endpoints, developer SDKs, a command-line interface (CLI), Model Context Protocol (MCP) integration, and related services (collectively, the “Service”).
This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use the Service.
1. Information We Collect
We collect information to provide, maintain, and improve the Service:
Account Information: When you create an account, we collect your email address and authentication information. We may also receive a name from you or your identity provider and maintain information about your organization, workspace membership, and permissions.
Billing Information: We use Stripe for payment processing. Payment-card details are collected and processed directly by Stripe. We receive information needed to administer billing, such as customer identifiers, transaction records, and payment status.
Service Telemetry and Log Data: We collect technical information about API requests, performance, resource consumption, errors, and authentication activity. This may include request identifiers, IP addresses, browser and device information, and timestamps.
Product Analytics: We use PostHog to understand use of the Service and improve usability. Analytics may include account email and name, user and workspace identifiers, feature usage, interaction events, and session replay data. Section 4 explains these practices.
Customer Content: We process files, folder and file names, metadata, queries, filters and other information you submit or connect to the Service. Storage, collaboration and finding files may require processing file contents, extracted text, indexes, revisions and permission records. We also process the instructions and requests sent through authorized agents and integrations to carry out your use of the Service.
Support Communications: We collect information you provide when contacting us or requesting assistance.
2. How We Use Your Information
We process information for the following purposes:
- To create and manage accounts, workspaces, and access permissions.
- To store and retrieve files, support authorized collaboration, index supported content and process queries. We use customer content, customer data, and queries only to provide the Service to you, never for model training.
- To measure usage and process payments.
- To monitor performance, diagnose problems, secure the Service, and prevent abuse.
- To understand feature usage and improve the application and developer experience.
- To send account notifications, security alerts, service communications, and billing receipts.
- To comply with legal obligations.
Where applicable law requires a legal basis, we rely on performance of a contract, legitimate interests in operating and securing the Service, compliance with legal obligations, or consent, as appropriate to the processing.
3. Data Privacy and Confidentiality
No Data Selling: We do not sell, rent, or lease your personal information or customer content to third parties.
Maintenance Access: Administrative access to the infrastructure that runs FlashDrive is restricted to authorized personnel for updates and maintenance. This access does not authorize personnel to read your files or other customer content.
Support at Your Request: If you explicitly ask us to examine customer content for support, our review is limited to the information and assistance you request. Using the Service or asking a general support question does not by itself authorize that review.
Collaborators and Connected Agents: Content and related metadata may be disclosed to the people, agents and external tools you authorize, within the access you grant. Their providers may process that information under their own terms and privacy practices. Review the permissions and provider settings before connecting them. Revoking a grant does not remove copies recipients already obtained.
Legally Required Access or Disclosure: We may preserve, access, or disclose information to comply with applicable law or binding legal process. Such access or disclosure is limited to what is legally required.
Model Training: We do not use customer content, customer data, or queries to train, fine-tune, or otherwise develop any machine-learning model, and we do not provide them to others for that purpose. This covers files and other content you upload or index, data you connect to the Service, the queries you or your users send, and the results returned to you.
Security: We use technical and organizational safeguards designed to protect information, including encryption at rest, access controls and isolation between authorized scopes. These safeguards do not guarantee absolute security or that uploaded content is free of malware. The Service is not represented as end-to-end encrypted or as providing independent customer control of encryption keys.
4. Cookies, Analytics, and Session Replay
Essential Cookies: We use cookies and similar technologies to support authentication, account security, and privacy preferences.
PostHog: We use PostHog for product analytics, application session replay, and service usage events sent by our servers. Analytics may be associated with account email and name, user identifiers, and organization or workspace identifiers.
Marketing Website Analytics: On the FlashDrive marketing website, we use PostHog by default to measure website visits, referral sources, campaign tags, and interactions with account links, pricing examples, and booking controls. PostHog marketing analytics does not record form contents or session replay. Microsoft Clarity session replay is described separately below. To turn marketing analytics off, enable Global Privacy Control in your browser. We honor Global Privacy Control.
Microsoft Clarity: On the FlashDrive marketing website, we use Microsoft Clarity to understand page visits and interactions through behavioral analytics, heatmaps, and session replay, and to improve the website. Clarity uses cookies and similar technologies, subject to applicable consent settings. Microsoft also processes this website usage data under the Microsoft Privacy Statement, which explains its collection and use of that information.
Session Replay and Content Privacy: Session replay reconstructs interactions with the application. It is configured to mask form inputs and designated sensitive content, including file contents and credentials. Ordinary interface text and layout may remain visible.
Scope of Browser Choices: Browser tracking preferences and Global Privacy Control affect supported browser analytics and replay. They do not stop authenticated API usage events, server-side service analytics, billing records or security logging. You can contact us about privacy requests using the details in Section 6.
You can also manage cookies through your browser, although blocking essential cookies may affect sign-in and other functions. Blocking cookies alone does not necessarily stop server-side events. Where applicable law requires consent for optional tracking, that consent must be obtained before the relevant processing.
5. Third-Party Service Providers
We use service providers to help operate FlashDrive. They process information for the following purposes:
- Hosting and storage: To store information and operate and secure the Service.
- Payment processing: To handle payments, subscriptions and billing.
- Analytics: To understand usage and improve the Service, as described in Section 4.
6. Your Rights and Data Control
Subject to applicable data protection laws, you may exercise the following rights:
- Access and Portability: Request access to or a copy of your personal information.
- Correction: Request correction of inaccurate account or personal information.
- Deletion (Right to be Forgotten): To request deletion of your FlashDrive account, email support@evokoa.com from the email address associated with your account. You may make this request at any time. Account closure ends your access and starts deletion of associated content, indexes and operational copies. Any existing associated backups are queued for hard deletion within 30 days, except where retention is legally required. These descriptions do not reduce deletion obligations already owed to existing customers. This retention statement does not mean that backups are included with your account.
To exercise these rights, contact support@evokoa.com.
Files and Recovery Copies: Authorized users can download files through supported interfaces. Deleting a file is different from closing an account. Consult the product documentation for current file-recovery availability, eligible operations and recovery windows. File recovery does not imply recovery of an entire deleted drive or account. Our Terms of Service explain the limits of backup and recovery commitments. Recovery copies, operational records and legally required records can remain after a file disappears from ordinary browsing; deletion is not a representation of immediate erasure from every system.
7. Children’s and Minors’ Privacy
The Service is intended for individuals who are at least 18 years old. We do not target the Service at minors or knowingly collect personal information from minors to create accounts or provide the Service directly to them.
If you are under 18, please do not create an account or submit personal information to us.
If you believe a minor has provided personal information to us, contact support@evokoa.com so we can investigate and take appropriate action.
8. Contact Us
If you have questions about this Privacy Policy or wish to exercise your privacy rights, contact:
Evokoa Inc.
Email: support@evokoa.com
We may update this policy as our practices or the Service change. We will revise the “Last Updated” date and provide additional notice of material changes where required by applicable law.