Privacy Notice

Jason Yates, a sole proprietor doing business as APFA (AI Product Flow App), operating from the State of Florida, USA is the controller of personal data processed through https://aiproductflowapp.com. For payments, Paddle.com acts as our Merchant of Record and is an independent controller of the payment data it collects. Contact: [email protected].

• Account data: name, email address, password (stored only as a secure hash), role and workspace membership
• Billing data: plan, subscription status, and Paddle customer and subscription IDs. Card and payment details are collected and stored by Paddle, not by us
• Workspace content: trends, designs, listings, products, approvals and other data you create or upload
• Store connection data: API keys or tokens you provide for Printify, Shopify or other platforms, stored encrypted
• Usage and technical data: log records such as IP address, browser type, pages used, errors and timestamps, used for security and reliability
• Communications: messages you send us

• To provide, operate and secure the Service and your workspace
• To process subscriptions through Paddle and manage plan limits
• To publish and sync products to the stores you connect, at your instruction
• To generate AI trends, listings and screening results you request
• To send service messages (for example billing, security and important changes)
• To troubleshoot, prevent abuse and improve the Service
• To comply with legal obligations

Legal bases (where GDPR/UK GDPR applies): performance of our contract with you; our legitimate interests in running and securing the Service; compliance with legal obligations; and your consent where we ask for it.

Content you submit for AI features (such as trend summaries, listing drafts and IP screening) is sent to our AI model providers only to produce the result for you. We do not sell your content or use it to train third-party models.

We do not sell or rent personal data. We share it only with service providers that help us run the Service, under appropriate contractual protections:

• Paddle.com: checkout, payments, invoicing, tax and refunds
• Our cloud hosting, database and AI infrastructure providers
• Stores and platforms you choose to connect (for example Printify, Shopify and Etsy), when you ask us to act on them
• Email delivery providers for service messages

We may also disclose data if required by law, to protect our rights or users, or as part of a business transfer (such as a merger or sale), in which case this notice will continue to apply.

We use strictly necessary cookies to keep you signed in and to secure your session. Paddle may set cookies during checkout to process payments and prevent fraud. We do not use advertising cookies.

Our providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.

We keep account and workspace data while your account is active. After you close your account, we delete or anonymize workspace data within 90 days, except where we must keep records longer (for example billing records for tax and accounting purposes).

We protect data with encryption in transit (HTTPS), encryption at rest for store credentials, hashed passwords, per-workspace data separation and role-based access controls. No system is completely secure, but we work to protect your data and will notify you of breaches as required by law.

Depending on where you live (including the EU, UK and US states such as California), you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. California residents have the right to know, delete and correct, and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising.

To exercise your rights, email [email protected]. You may also complain to your local data protection authority.

The Service is intended for business use by people aged 18 or over. We do not knowingly collect data from children.

We may update this notice from time to time. We will post the new version here with an updated date and notify account owners of material changes.