Privacy Notice

We collect information you provide directly, information collected automatically when you use ERVFlow, and data from third-party sources.

Account & Profile Data

• Name, email address, and password (stored as a bcrypt hash)
• Profile photo and display preferences
• Company name and role, if provided

Billing Information

• Subscription plan and billing cycle
• Payment method details — processed securely by Stripe; we never store card numbers
• Invoice history and transaction records

Usage & Interaction Data

• Features accessed, pages visited, and time spent in the editor
• Projects created, templates used, and AI generation counts
• Error logs and performance diagnostics to improve reliability

Device & Technical Data

• Browser type, operating system, and screen resolution
• IP address and approximate geolocation (country/region level)
• Session identifiers and authentication tokens

We use the information we collect to operate and improve ERVFlow:

• Service delivery — authenticate accounts, render projects, and process subscriptions
• Personalization — remember preferences, settings, and suggested templates
• Security & fraud prevention — detect unusual activity and enforce our Acceptable Use Policy
• Product improvement — analyze aggregate usage to prioritize features and fix issues
• Communications — send service announcements, security alerts, and (with consent) product news
• Legal obligations — comply with applicable laws and enforce our Terms of Service

We do not sell your personal data or use your project content to train AI models without explicit written consent.

ERVFlow uses cookies and similar technologies for core functionality and to understand platform usage.

Essential Cookies

Required for the platform to function — session tokens, CSRF protection, and authentication state. Cannot be disabled without breaking the service.

Analytics Cookies

We use privacy-respecting analytics (Vercel Analytics) to understand aggregate usage. These do not track you across third-party sites.

Marketing Cookies

Used only with your explicit consent. Manage preferences at any time below.

We work with carefully vetted third-party providers, each bound by a data processing agreement:

• Analytics — Vercel Analytics (privacy-first, no cross-site tracking)
• Payments — Stripe (PCI-DSS Level 1 compliant)
• Cloud infrastructure — Vercel and AWS (ISO 27001, SOC 2)
• Email delivery — Resend (transactional notifications only)
• Error monitoring — Sentry (no PII in error traces)

We do not share personal data with advertisers or data brokers.

• Account data — retained while active and for 90 days after deletion
• Billing records — retained for 7 years for financial record-keeping
• Usage analytics — aggregated for 24 months; raw events purged after 90 days
• Support communications — retained for 3 years
• Backups — encrypted, 30-day rolling retention

You can request deletion at any time. We will honor requests within 30 days, subject to legal obligations.

ERVFlow is operated from the United States. Data may be transferred to and processed in the US and other countries. Where required, we implement Standard Contractual Clauses (SCCs) approved by the European Commission. Enterprise customers can request regional data hosting.

Depending on your location, you may have the following rights. Submit requests to privacy@ervflow.com.

• Access — request a copy of your personal data
• Rectification — correct inaccurate or incomplete information
• Erasure — request deletion of your personal data
• Portability — export your data from Settings → Account → Export Data
• Objection — object to processing based on legitimate interests
• Withdraw consent — opt out of marketing at any time via account settings

We respond to all requests within 30 days and may need to verify your identity.

• All data in transit protected with TLS 1.3
• Data at rest encrypted with AES-256
• Production access restricted to authorized personnel via MFA
• Regular penetration tests and security audits
• Infrastructure hosted on SOC 2 Type II certified providers
• Responsible disclosure program for security researchers

To report a vulnerability: security@ervflow.com

ERVFlow is not intended for individuals under 16. We do not knowingly collect data from children. If you believe we have done so, contact us at privacy@ervflow.com and we will promptly delete it.

We may update this Privacy Notice from time to time. For material changes, we will notify you at least 30 days in advance by email and via an in-app banner. Continued use after the effective date constitutes acceptance.