Privacy Policy

Windflow collects only what running the platform requires:

• Account data — your email address and authentication state, managed through Supabase Auth.
• Session and usage telemetry — session identifiers, model, timing, frame and transport metrics, credit consumption, and API request logs, used for billing, capacity planning, and debugging.
• Live media — webcam and microphone streams you send into a session. Live streams are processed transiently in memory on GPU workers to generate your frames; they are not written to storage as part of normal session processing.
• Recordings and uploads — stored only when you explicitly record a session or upload a file. Temporary recordings expire automatically after 24 hours unless you export them.

We do not run third-party analytics or advertising trackers on the site, and we do not collect data unrelated to operating the Service.

During a session, your inputs (including camera and microphone streams) travel over encrypted transport to a GPU worker, are held in memory only as long as needed to produce output frames, and are discarded as the session advances. Nothing from a live stream persists after the session ends unless you used a recording or upload feature. We do not use your content to train models.

We rely on a small set of infrastructure providers to run the Service:

• Supabase — authentication and database.
• Cloudflare — application hosting, CDN, and R2 object storage for recordings and uploads.
• LiveKit — real-time media transport for sessions that use WebRTC delivery.
• Stripe — payment processing. Card data is entered directly with Stripe and never touches Windflow servers.
• GPU compute providers (for example Vast.ai and comparable cloud GPU vendors) — transient session processing on rented GPU capacity.

Each provider processes data only as needed to deliver its part of the Service. We will update this list as our infrastructure changes.

• We do not sell your personal data.
• We do not show ads or share data with advertisers.
• We do not use third-party analytics on the site today.
• We do not train models on your inputs or outputs.

Account data is kept while your account exists. Usage telemetry and billing records are retained as needed for accounting, abuse prevention, and legal obligations. Temporary session recordings expire after 24 hours; content you deliberately store (exports, uploads) is kept until you delete it or your account is deleted. Live media is not retained at all.

Email founders@windflow.online from your account address to request access to, correction of, or deletion of your personal data, and we will act on the request within the timelines required by applicable law. Deleting your account removes your stored content and personal data, except records we must keep for billing or legal compliance.

If you are in the European Economic Area or United Kingdom, you have GDPR rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with a supervisory authority. If you are a California resident, you have CCPA/CPRA rights to know, delete, correct, and opt out of sale or sharing — noting that we do not sell or share personal data as those laws define it. We do not discriminate against anyone for exercising these rights.

Data in transit is encrypted, access to production systems is restricted, and payment credentials are handled entirely by Stripe. No system is perfectly secure; if a breach affects your data we will notify you as required by law.

We will update this policy as the Service evolves and announce material changes on the site or by email. Contact founders@windflow.online with any privacy question or request.