Privacy Policy

1. Introduction and Scope

This Privacy Policy ("Policy") describes how PlansFlow ("we," "us," "our," or the "Company") collects, uses, shares, stores, and protects your personal information when you access or use the PlansFlow platform, including our website, applications, APIs, and related services (collectively, the "Service").

We are committed to protecting your privacy and processing your personal data in accordance with applicable data protection laws, including but not limited to:

Data Minimization: We follow the principle of data minimization and only collect personal data that is adequate, relevant, and limited to what is necessary to operate and improve the Service.

• General Data Protection Regulation (GDPR) – European Union
• California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA) – California, USA
• Virginia Consumer Data Protection Act (VCDPA) – Virginia, USA
• Colorado Privacy Act (CPA) – Colorado, USA
• Other applicable state, federal, and international privacy laws

By using PlansFlow, you acknowledge that you have read and understood this Privacy Policy and agree to its terms. If you do not agree with this Policy, please do not use our Service.

This Policy should be read in conjunction with our Terms of Service.

2. Data Controller Information

PlansFlow acts as the data controller for personal data processed through the Service. For questions or concerns regarding this Policy or our data practices, please contact:

3. Information We Collect

We collect various categories of information depending on how you interact with our Service:

3.1 Account Information

• Email address
• Name or display name
• Profile picture (if provided)
• Password (encrypted and hashed)
• Account preferences and settings
• Authentication tokens and session data

3.2 Billing and Payment Information

• Billing name and address
• Payment method details (processed and stored by Stripe; we do not store full card numbers)
• Transaction history and invoices
• Subscription tier and status
• Credit balance and usage history

3.3 User Content

• Projects, canvases, and workspaces you create
• Text, prompts, and messages you submit to AI models
• Images, videos, and audio files you upload
• AI-generated outputs (text, images, videos, audio)
• Drawings, annotations, and other creative content
• Chat conversations and collaboration data

3.4 Technical and Device Information

• IP address (may be anonymized for certain purposes)
• Browser type and version
• Operating system and device type
• Device identifiers and fingerprints
• Screen resolution and viewport size
• Time zone and language preferences
• Referring URL and exit pages

3.5 Usage and Analytics Data

• Features accessed and actions taken
• Session duration and frequency
• AI model usage patterns and preferences
• Error logs and performance metrics
• Search queries and navigation paths
• Timestamps and event logs

3.6 Communications Data

• Support tickets and customer service interactions
• Feedback, surveys, and research participation
• Email communications and preferences

3.7 Information from Third Parties

• Social login data (if you sign in via Google, Apple, etc.)
• Payment processing data from Stripe
• Analytics data from service providers
• Fraud prevention and security data

4. How We Use Your Information

We process your personal data for the following purposes, each with a corresponding legal basis:

4.1 Service Provision (Contract Performance)

• Creating and managing your account
• Processing AI generation requests and delivering outputs
• Storing and managing your projects and content
• Processing payments and managing subscriptions
• Providing customer support

4.2 Platform Improvement (Legitimate Interest)

We use analytics data solely for product improvement, security, and operational insights. We do not share analytics data with third-party advertising networks, nor do we use it for targeted advertising purposes.

• Analyzing usage patterns to improve features
• Debugging and fixing technical issues
• Optimizing performance and user experience
• Developing new features and services
• Conducting internal research and analytics

4.3 Security and Abuse Prevention (Legitimate Interest / Legal Obligation)

• Detecting and preventing fraud, abuse, and policy violations
• Monitoring for security threats and vulnerabilities
• Enforcing our Terms of Service and Acceptable Use Policy
• Investigating and responding to security incidents
• Complying with content moderation obligations

4.4 Communications (Consent / Legitimate Interest)

• Sending transactional emails (receipts, password resets, etc.)
• Providing service announcements and updates
• Marketing communications (with consent where required)
• Responding to inquiries and support requests

4.5 Legal Compliance (Legal Obligation)

• Responding to legal process and government requests
• Meeting regulatory and compliance requirements
• Preserving evidence for potential litigation
• Reporting to authorities as required by law (e.g., CSAM)

5. Third-Party AI Processing

PlansFlow integrates with third-party AI model providers to deliver AI generation capabilities. When you use AI features, your inputs and prompts may be transmitted to these providers:

5.1 AI Providers We Use

• Venice.ai: Text generation, image generation, video synthesis, text-to-speech, embeddings, and various other AI capabilities
• Google (Gemini): Multimodal AI capabilities including text and vision
• Lovable AI Gateway: Internal routing and AI model access
• Other Providers: Additional AI services may be integrated as the platform evolves

5.2 Data Shared with AI Providers

When using AI features, the following data may be transmitted to third-party AI providers:

• Text prompts and instructions you provide
• Images or media you upload for AI processing
• Contextual information necessary for processing
• Technical metadata (request parameters, model settings)

5.3 Third-Party Data Practices

Our primary AI providers state in their API terms that they do not use customer API inputs or outputs to train their foundation models in their paid API products. Some providers may retain limited data for a short period of time for abuse monitoring, security, and operational diagnostics. We do not control their independent practices and encourage you to review their privacy policies directly:

• Venice.ai Privacy Policy: https://venice.ai/privacy
• Google Privacy Policy: https://policies.google.com/privacy

Processor Obligations: Third-party AI providers and other data processors act only on our documented instructions and are contractually prohibited from using your data for their own purposes (such as training their models on your data) unless explicitly stated in their policies.

Important: We select AI partners with privacy-respecting practices, but we cannot control their data handling. PlansFlow is not liable for independent changes in third-party provider policies, but will update its own documentation and practices where required by law.

6. Content Storage and Data Retention

6.1 Data Storage Zones

User-generated content is stored in distinct secure zones based on content type:

• Media Storage (Supabase Storage Buckets): Images, videos, and audio files you upload or generate are stored in private, access-controlled storage buckets. Each bucket is configured with row-level security ensuring only authorized users can access their content;
• Structured Data (Supabase Database): Text content, chat logs, project metadata, canvas data, user preferences, and account information are stored in secure PostgreSQL database tables with row-level security policies;
• Transient Processing Data: AI prompts and model inputs may be temporarily held by third-party AI providers during processing. Retention periods vary by provider—see Section 5 for details;
• Analytics and Logs: Usage analytics, error logs, and security events are stored separately for platform improvement and security monitoring.

6.2 Storage Infrastructure and Location

User Content is primarily stored in the United States on Supabase-managed infrastructure with the following characteristics:

• Primary data storage located in the United States
• Private, access-controlled storage buckets
• Encryption at rest (AES-256) and in transit (TLS 1.3)
• Geographic redundancy for reliability
• Access restricted to your account (and collaborators you designate)
• Automatic backup and disaster recovery procedures

Note: If we add regional data storage options in the future, this Policy will be updated accordingly.

6.3 Retention Periods

• Active Account Data: Retained while your account is active
• User Content (Projects, AI Prompts, Chat Messages, Generated Outputs): AI prompts, chat messages, and generated outputs stored as part of user projects are treated as User Content and are retained while the account is active, unless the user deletes them or requests removal (subject to legal retention requirements)
• Deleted Content: Removed within 30 days of deletion request (subject to backup cycles)
• Account Deletion: Personal data deleted within 90 days; some data retained for legal compliance
• Billing Records: Retained for 7 years for tax and legal compliance
• Security Logs: Retained for up to 2 years for security and fraud prevention
• Aggregated Analytics: May be retained indefinitely in anonymized form

6.4 No Training on User Data

PlansFlow does not use your User Content to train our own AI models without your explicit, affirmative consent. If we ever implement opt-in training features, they will be clearly disclosed and require your active participation.

7. Sensitive Content Handling

7.1 Permitted Mature Content

PlansFlow permits artistic and anatomical nudity and mature creative content for legitimate purposes, including:

• Fine art and creative expression
• Educational and medical illustrations
• Literary and narrative fiction
• Documentary and journalistic content

7.2 Strictly Prohibited Content

The following content is strictly prohibited and may be retained for reporting to law enforcement:

• Child sexual abuse material (CSAM) in any form
• Content sexualizing, exploiting, or endangering minors
• Non-consensual intimate imagery (including deepfakes)
• Content promoting terrorism, violence, or self-harm
• Content facilitating illegal activities

7.3 Content Moderation

We employ automated systems and human review to detect prohibited content. Content flagged for review may be temporarily retained for moderation. If illegal content is detected, we will preserve evidence and report to appropriate authorities as required by law.

8. Data Sharing and Disclosure

We do not sell or share your personal information as those terms are defined under the CCPA/CPRA. We also do not use your personal information for cross-context behavioral advertising. We share data only in the following circumstances:

8.1 Service Providers

We share data with trusted third parties who assist in operating our Service:

• Supabase: Database and authentication infrastructure
• Stripe: Payment processing
• AI Providers: Venice.ai, Google Gemini, and others for AI processing
• Cloud Infrastructure: Hosting and content delivery
• Analytics Providers: Usage analytics (with anonymization where possible)
• Security Services: Fraud prevention and security monitoring

8.2 Legal Requirements

We may disclose your information when required by law or when we believe disclosure is necessary to:

• Comply with legal process (subpoenas, court orders)
• Respond to government requests
• Protect our legal rights and safety
• Prevent fraud, security threats, or illegal activity
• Report suspected child exploitation to NCMEC or law enforcement

8.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred. You will be notified of any such change and any choices you may have.

8.4 With Your Consent

We may share information with third parties when you provide explicit consent.

9. Data Security

We implement comprehensive security measures to protect your data:

9.1 Technical Measures

• TLS/SSL encryption for all data in transit
• AES-256 encryption for data at rest
• Secure password hashing (bcrypt)
• Row-level security (RLS) for database access control
• Regular security audits and penetration testing
• Intrusion detection and monitoring systems

9.2 Organizational Measures

• Limited access to personal data on a need-to-know basis
• Employee security training and awareness programs
• Incident response procedures
• Vendor security assessments

9.3 Data Protection Impact Assessments

Where required under applicable law, PlansFlow conducts Data Protection Impact Assessments (DPIAs) for high-risk processing activities, including the integration of advanced AI systems.

9.4 Breach Notification

In the event of a data breach that affects your personal information, we will notify you and applicable regulatory authorities as required by law, typically within 72 hours of becoming aware of the breach.

10. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal data:

10.1 Access and Portability

You have the right to request a copy of the personal data we hold about you in a structured, commonly used, machine-readable format.

10.2 Correction

You have the right to request correction of inaccurate or incomplete personal data.

10.3 Deletion

You have the right to request deletion of your personal data, subject to legal retention requirements and our legitimate interests in preventing fraud and abuse.

10.4 Restriction of Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances.

10.5 Objection

You have the right to object to processing of your personal data for direct marketing or based on our legitimate interests.

10.6 Withdraw Consent

Where we process data based on your consent, you have the right to withdraw that consent at any time.

10.7 Exercising Your Rights

To exercise any of these rights, please contact us at privacy@plansflow.com. We will respond to your request within 30 days (or as otherwise required by applicable law). We may need to verify your identity before processing your request.

10.8 No Discrimination

We will not discriminate against you for exercising your privacy rights. However, some features may not be available if you delete certain data necessary for their operation.

11. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of categories and specific pieces of personal information collected
• Right to Delete: Request deletion of personal information
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out: Opt out of the "sale" or "sharing" of personal information (we do not sell or share personal information as defined under CCPA/CPRA)
• Right to Limit Use: Limit use of sensitive personal information
• Right to Non-Discrimination: Not be discriminated against for exercising your rights

Categories of Information Collected: Identifiers, commercial information, internet activity, geolocation data, professional information, and inferences.

To exercise your rights, contact us at privacy@plansflow.com or use the privacy controls in your account settings.

12. European Economic Area (GDPR)

If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR):

12.1 Legal Bases for Processing

We process your personal data based on the following legal bases:

• Contract: Processing necessary to provide the Service you requested
• Legitimate Interests: Processing necessary for our legitimate business interests, balanced against your rights
• Consent: Processing based on your explicit consent (which you may withdraw)
• Legal Obligation: Processing necessary to comply with legal requirements

12.2 International Data Transfers

Your data may be transferred to and processed in the United States and other countries. We ensure appropriate safeguards for such transfers, including:

• Standard Contractual Clauses approved by the European Commission
• EU-U.S. Data Privacy Framework (where applicable)
• Binding Corporate Rules (for certain vendors)
• Adequacy decisions where available

12.3 Automated Decision-Making

We do not use your personal data to make automated decisions that produce legal or similarly significant effects about you without meaningful human involvement. While we use AI tools for content generation at your direction, these do not constitute automated decision-making that affects your legal rights or access to services.

12.4 Right to Lodge a Complaint

You have the right to lodge a complaint with your local data protection authority. Contact information for EU data protection authorities is available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en

13. Cookies and Tracking Technologies

13.1 Types of Cookies We Use

• Essential Cookies: Required for basic site functionality (authentication, security)
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand how users interact with the Service
• Performance Cookies: Monitor and improve platform performance

Important: We do not use cookies or tracking technologies for targeted advertising. Cookies are used solely for essential functionality, user preferences, and internal analytics to improve our Service.

13.2 Cookie Consent

Where required by applicable law (such as in the European Union), a cookie consent banner will be presented before non-essential cookies are placed on your device. You may accept or reject non-essential cookies through the consent mechanism.

13.3 Managing Cookies

You can control cookies through your browser settings. Note that disabling certain cookies may affect functionality. Most browsers allow you to:

• Block all cookies
• Block third-party cookies
• Delete cookies when you close your browser
• Accept cookies only from sites you visit

13.4 Do Not Track

We currently do not respond to "Do Not Track" browser signals as there is no industry standard for such signals.

14. Children's Privacy

PlansFlow is primarily intended for adults eighteen (18) years of age or older. We do not knowingly collect or solicit personal information from anyone under the age of 13, and users under 13 are not permitted to use the Service.

Users between 13 and 17 years old may only use the Platform under the direct supervision of a parent or legal guardian who agrees to be bound by our Terms of Service on their behalf and who remains responsible for the minor's activity on the Platform.

If we become aware that we have collected personal information from a child under 13, we will take steps to delete such information promptly. If you believe we have inadvertently collected information from a child under 13, please contact us immediately at privacy@plansflow.com.

15. Third-Party Links and Services

Our Service may contain links to third-party websites, services, or applications. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you access.

16. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or business operations. When we make material changes:

• We will update the "Last Updated" date at the top of this Policy
• We will notify you via email and/or prominent notice on the Service
• For material changes affecting existing users, we will provide at least 30 days' notice before the changes take effect
• We may seek your consent for certain changes as required by law

Your continued use of PlansFlow after the effective date of any changes constitutes your acceptance of the updated Policy.

17. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For data protection inquiries from the EU/EEA, you may also contact our designated representative (if applicable) at: eu-rep@plansflow.com

We will respond to all legitimate requests within 30 days, or as required by applicable law.