Privacy Notice
Last updated:
1. Controller and contact
Wangfluence OÜ, registered in Estonia, is the data controller for the personal data we process to operate CreatorFlow. For privacy questions or to exercise your rights, email wangyilin_hi@qq.com. Paddle acts separately as Merchant of Record and handles payment-related data under its own privacy notice.
If you enter personal data about collaborators or clients, you are responsible for having a lawful basis to do so and for informing them as required. This notice describes our processing and does not replace your own obligations.
2. Data and purposes
Account data: name, email address, authentication identifiers and authentication credentials or tokens are handled by our authentication service to create accounts, sign you in and secure access. We do not need your Google password. Legal basis: performance of our contract and legitimate interests in account security.
Subscription data: customer and subscription identifiers, selected plan, status and billing-period dates are used to verify paid access and support billing requests. Paddle collects payment details during checkout; CreatorFlow does not store full card details. Legal basis: contract performance and applicable legal obligations.
Workspace data: profile and invoice details, names and contact details of collaborators, deals, fees, expenses, content, PR events, notes and invoice records are currently saved in local browser storage. They are used to provide workspace tools and PDFs. These records are not automatically backed up as a complete cloud workspace, but specific text you submit to AI or connected services is processed remotely. Legal basis for providing these functions: contract performance.
Google data: when authorised, Gmail message identifiers, senders, subjects, snippets and message bodies are read to locate collaboration emails and extract information. Google Calendar event identifiers, titles, dates, times, locations, descriptions and links are read to import events and update local copies. These integrations currently access only the owner's connected account. Legal basis: contract performance for requested functions; consent for authorisation where applicable. You can revoke the connection in your Google account permissions.
AI data: email text, prompts, reply decisions, requirements and relevant rate-card details submitted for extraction or reply drafting are sent to the AI service and its model providers, which generate results. Avoid submitting unnecessary sensitive information or third-party data you cannot lawfully disclose. Legal basis: contract performance.
Support and technical data: correspondence and information supplied for support, IP addresses, device or browser information and technical error or security logs may be processed to answer requests, diagnose failures and prevent abuse. Legal basis: contract performance for support and legitimate interests in reliable, secure operation; legal obligation where required.
3. Who receives data
We use Lovable Cloud for hosting, authentication and subscription records, Lovable's integration infrastructure for authorised Google connections, and Lovable AI and its model providers for AI processing. Google supplies Google sign-in, Gmail and Calendar services. These providers receive the information necessary for their respective functions.
Paddle receives data needed for product sales, subscription management, payments, tax compliance and invoicing as Merchant of Record. Professional advisers, such as accountants or legal advisers, may receive data where necessary. We may disclose data to authorities when legally required or to protect legal rights.
We do not sell your personal data. Connected Google data is used for the requested integration functions, not advertising. We do not use your emails or prompts to train our own AI models; provider processing and retention are governed by applicable service agreements and provider policies.
4. Retention and deletion
Local workspace records and display or language preferences remain in your browser until you delete them, reset them or clear browser storage. Cancellation of a plan alone does not delete them. Downloaded PDFs remain wherever you save them. We cannot remotely remove copies stored on your device.
Account and subscription records are retained while needed to provide and administer your account. Contact us to request account deletion. Support correspondence and technical logs are retained only as long as necessary for the support, security or legal purpose concerned, then deleted or anonymised, subject to provider backup cycles.
Accounting and transaction records may need to be retained for statutory periods, including the applicable Estonian accounting retention period (generally seven years). Paddle maintains its own records under its legal obligations. Provider-held connection and AI request data is subject to those providers' necessary processing and retention. Revoking Google access stops future authorised reads but does not automatically delete records already imported to your device.
5. International transfers and security
Our providers may process data outside Estonia or the European Economic Area. Where a transfer is subject to GDPR, it must be supported by an applicable adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses and any necessary supplementary measures. Contact us for information about safeguards relevant to your data.
We use appropriate technical and organisational safeguards, including encrypted connections, authentication and access controls. No system is completely secure. Local browser records are not a separately encrypted cloud vault; protect your device and avoid shared browser profiles for confidential records.
6. Your GDPR rights
Subject to legal conditions, you can request access, rectification, erasure, restriction, portability and objection to processing based on legitimate interests. Where processing relies on consent, you can withdraw it at any time without affecting earlier lawful processing. Contact wangyilin_hi@qq.com; we normally respond within one month. If a lawful extension is necessary, we will notify you within that month and explain why. We may ask for proportionate identity verification.
You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority. CreatorFlow does not use AI drafts to make solely automated decisions with legal or similarly significant effects about you.
7. Cookies and browser storage
CreatorFlow uses essential authentication or session storage and local storage for workspace records, navigation intent, language choice and calendar preferences. These are needed to provide requested functions and remember your settings. Third-party sign-in and Paddle checkout may use their own necessary cookies under their policies.
The current app does not include optional marketing or analytics tracking. If we introduce non-essential analytics or marketing cookies, we will request consent before using them where required and provide preference controls. You can manage cookies and local storage in your browser; blocking essential storage may prevent sign-in, and clearing local storage deletes locally saved workspace records.
8. Updates
We may update this notice to reflect changes to the service or legal requirements. The update date appears above, and material changes will be communicated through the service or email where appropriate. English and Estonian versions are intended to describe the same processing.