StandardFlow AI
Privacy Policy
StandardFlow, Inc., a Delaware corporation (“StandardFlow AI,” “we,” “us”) operates the standardflow.io website and the StandardFlow AI compliance-analysis application (together, the “Service”). This policy explains what information we collect, how we use it, the providers we rely on, and the choices you have. StandardFlow, Inc. is the controller responsible for personal information processed through the Service.
1. Information we collect
- Information you provide: your name and email when you create an account (typically via Google sign-in); the documents, project details, and other content you upload for analysis; billing information processed by our payment provider; messages or feedback you send us; and, if you ask for them, the email address you give us to receive product updates, or the name, work email, company, and message you submit in a demo request.
- Information collected automatically: usage and device data through analytics cookies on the production website — pages viewed, approximate location (country/region), referrer, and browser type.
2. How we use information
- Provide and operate the Service, including running compliance analysis on the documents you submit and managing your account and organization.
- Process payments and manage subscriptions and credits.
- Understand usage and improve the product (analytics).
- Communicate with you — service notices, invitations, support, and feedback responses.
- Respond to demo requests, and send occasional product updates to people who have subscribed to them.
- Maintain security, prevent fraud or abuse, and comply with legal obligations.
Where the GDPR applies (EEA/UK), we rely on these legal bases: performance of a contract (to provide the Service to you), legitimate interests (to secure, maintain, and improve the Service), consent (for analytics cookies where required), and legal obligation (to comply with applicable law).
Product updates and demo requests
You can subscribe to product updates with just an email address, without creating an account. Subscribing is separate from creating an account: having an account does not subscribe you, and subscribing does not create one. We store the address, the date and source of your sign-up, the notice you agreed to, and your subscription status. Our legal basis is your consent, which you can withdraw at any time using the unsubscribe link we include in updates or by writing to legal@standardflow.io. After you unsubscribe we keep your address on a suppression list so we do not contact you again. A demo request is used only to respond to you; we add you to product updates only if you tick the box on the form. We may also notify our team of a new demo request by email.
3. Cookies and analytics
When you first visit, we ask for your choice with a banner: Accept All, Necessary Only, or Customize. Optional analytics does not load until you allow it. You can change or withdraw your choice at any time with Cookie Settings in the page footer.
Strictly necessary (always on). These keep the Service secure and working and do not need consent:
- Sign-in and session — our authentication provider (Supabase) stores your session in your browser’s local storage, and a short-lived cookie can carry sign-in state across an OAuth redirect or an invitation link.
- Preferences and drafts — the interface language, dismissed notices, onboarding progress, unsaved form drafts, and similar settings are kept in your browser’s local or session storage on your device.
- Your cookie choice — stored in your browser’s local storage as your choice, a timestamp, and the version of this policy. It holds no identifier and is not sent to us.
Analytics (only if you allow it). We use Google Analytics 4 to understand how the
website and application are used. When allowed, it sets first-party cookies such as _ga and
_ga_<property> and receives page, device, and approximate-location data. If you withdraw
consent, we stop sending analytics and delete these cookies where your browser lets us. Consent is
communicated to Google through Google Consent Mode.
Campaign attribution (only if you allow analytics). When you arrive from one of our
campaign links or from another website, we keep a first-party cookie, sf_attr, shared across
standardflow.io sites for up to 90 days. It holds only the campaign labels in the link (source,
medium, campaign and content), the referring website’s name, the page you landed on and the time. If you
create an account, we store the first and the most recent of these with your account so we can tell which
campaigns lead to sign-ups and product use. It is never sent to Google with your account details. If you
withdraw analytics consent, we delete the cookie.
Marketing. We do not currently use advertising or marketing cookies or pixels. The Customize panel includes this category so that any we add later will stay off until you allow it.
Global Privacy Control. If your browser sends the Global Privacy Control signal, we keep marketing off and do not turn analytics on unless you choose to.
Embedded video. The homepage video loads from YouTube only after you press play, using YouTube’s privacy-enhanced domain. Before then, only a preview thumbnail is requested from YouTube’s image servers. Google Fonts are also requested from Google when a page loads.
You can also block cookies in your browser or install the Google Analytics opt-out add-on. To ask about cookies or your data, contact legal@standardflow.io.
4. Service providers
We share information with vendors who process it on our behalf:
- Google — website analytics, account sign-in, and AI model processing.
- Supabase — database, file storage, and authentication hosting.
- Stripe — payment processing.
- Resend — transactional email.
- Vercel and Fly.io — website and application hosting.
Documents you upload are processed by third-party large language model providers (including Google) solely to generate your analysis. We do not sell your personal information.
5. Where data is processed
Our application backend is hosted in Japan (Tokyo). Some of the providers above operate in the United States and other countries. Where personal data is transferred out of the EEA, the UK, or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and equivalents) with the providers involved. By using the Service, your information may be transferred to and processed in these locations.
6. Data retention
We keep account and project data for as long as your account is active or as needed to provide the Service, after which we delete or anonymize it unless a longer retention period is required by law. You may request deletion of your data at any time (see Contact).
7. Security
We use access controls, encryption in transit, and tenant isolation to protect your data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
8. Your rights
Depending on where you live — for example under the GDPR (EEA/UK) or the CCPA/CPRA (California) — you may have the right to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to opt out of the “sale” or “sharing” of personal information. We do not sell or “share” personal information (as those terms are defined under the CCPA/CPRA), and we will not discriminate against you for exercising your rights. To exercise any right, contact us below; we will respond within the timeframe required by law.
If you are in the EEA, the UK, or Switzerland and believe we have not resolved your concern, you also have the right to lodge a complaint with your local data protection supervisory authority.
9. Children
The Service is not directed to children under 16, and we do not knowingly collect their personal information.
10. Changes to this policy
We may update this policy from time to time. We will revise the effective date above and, for material changes, provide additional notice through the Service.
11. Contact
Questions or requests about this policy or your data:
StandardFlow, Inc. — legal@standardflow.io