Privacy Policy

Last updated: October 8, 2026

This Privacy Policy explains what information InflowLayer collects when you use the InflowLayer application and website (the "Service"), how we use it, who we share it with, and the choices you have.

Who we are

The Service is operated by Maksim Apanasenka, Individual Entrepreneur (identification number 345620704), Batumi, Georgia ("we", "us"). We are the controller of the personal data described in this policy. You can reach us at [email protected].

Information we collect

Account information: the email address you register with, and a securely hashed password. We never store your password in plain text. If you sign in with Google or Apple, we receive your email address and account identifier from them instead of a password.
Project content: the designs, artboards, components, templates and brands you create, and any images, fonts or other files you upload into them.
Billing information: if you buy a paid plan, our reseller Paddle collects your payment details, billing name, address and tax information. We receive from Paddle only what we need to manage your subscription (such as your email, country, plan, subscription status and payment history). We never see or store your full card details.
Usage and device data: basic technical information (such as browser type and IP address) that's generated automatically while using a web application, mainly for security and abuse prevention.
Analytics data: if you consent to analytics cookies, information about how you use our website and app, such as pages visited, actions taken and the ad or link that brought you to us (see "Cookies and similar technologies" below).
Referral program: if you sign up through someone's referral link, we record who referred you, and we tell them how many people signed up and paid through their link (never your name or email). To pay rewards and commissions and to prevent abuse (such as referring yourself), we compare the IP address you signed up from and the type, last four digits and expiry of the card you pay with against the referrer's. If you're a partner, we keep your application (email, profile, audience) and the payout details you give us.

How we use your information and why

To provide, operate and maintain the Service — storing and syncing your projects, authenticating you and keeping your account secure (necessary to perform our contract with you);
To process payments and manage subscriptions through Paddle (performance of contract);
To send service emails, such as email verification codes, password-reset codes and notices about your subscription or changes to our terms (performance of contract and our legitimate interests);
To diagnose problems, prevent abuse and improve the Service (our legitimate interests);
To run the referral and partner programs — crediting referrals, paying rewards and commissions and preventing fraud (performance of contract and our legitimate interests);
To measure how the Service is used and how effective our ads are (only with your consent);
To keep records required by tax and accounting laws (legal obligation).

We do not sell your personal information, and we do not use your project content for advertising.

Service providers we share data with

We use the following providers to run the Service. They process data on our behalf or, where noted, as independent controllers under their own privacy policies.

Paddle.com — our online reseller and Merchant of Record: processes payments, taxes, invoices and refunds. Paddle acts as an independent controller for the billing data it collects; see Paddle's Privacy Policy.
Cloudflare (R2) — stores the images, fonts and other files you upload.
Google (Gmail / Google Workspace) — sends and receives our emails, including verification codes and support correspondence.
Google and Apple — sign-in, if you choose to sign in with your Google or Apple account.
Google Tag Manager and Google Analytics — website and app analytics, only with your consent.
Meta (Meta Pixel) — measures the effectiveness of our ads on Facebook and Instagram, only with your consent.

Account and project data is stored in our own database.

AI assistants you connect

You can connect an AI assistant (such as Claude or ChatGPT) to your workspace through our MCP connection. When you do, the assistant reads and changes your projects, templates, fonts and other workspace data at your request, and that data is sent to the assistant's provider. Those providers are chosen and authorized by you and handle the data under their own terms and privacy policies — they are not our processors. We don't send your data to any AI provider unless you connect one yourself. You can disconnect an assistant at any time. We don't run or train generative AI models, and we don't use your content to train any.

Cookies and similar technologies

When you first visit, we ask whether you allow analytics and marketing cookies. Until you allow them, they aren't set and the tools that use them aren't loaded. You can accept all, reject all, or choose by category, and change your choice at any time using the "Cookie settings" link at the bottom of every page. We ask again after 12 months, or sooner if what we use changes.

Necessary (always on)

Local storage (InflowLayer) — keeps you signed in, remembers interface preferences (such as which panel was last open and your canvas view) and stores your cookie choice. Kept until you sign out or clear your browser data.
Paddle — cookies set during checkout to process your payment securely and prevent fraud.
Google and Apple sign-in — if you choose to sign in with Google or Apple, they may set their own cookies during sign-in.

Analytics (with your consent)

Google Analytics (_ga, _ga_*) — counts visits and shows how the site and app are used, so we can improve them. Kept for up to 2 years.

Marketing (with your consent)

Meta Pixel (_fbp, _fbc) — measures how well our ads on Facebook and Instagram work and helps show them to relevant people. Kept for up to 90 days. Meta may also use its own cookies on its domains.
Referral link (ifl_ref, InflowLayer) — remembers the referral link you came through, so the person who shared it gets credit if you sign up later. Kept for 30 days. Without your consent, the link only counts if you sign up during the same visit.

We load Google Analytics and Meta Pixel through Google Tag Manager, which itself doesn't set cookies and is loaded only after you allow analytics or marketing cookies. You can also block or delete cookies in your browser's settings; blocking necessary storage may stop you from signing in.

International transfers

Our providers may process data in countries other than yours, including the United States. Where required, these transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Data retention and deletion

We retain your account and project data for as long as your account is active. You can delete individual projects at any time from within the app. To delete your account entirely, contact us at the address below — we will delete your account and associated data within a reasonable time, except where we're required to retain something by law (for example, payment records kept for tax purposes).

Your rights

Depending on where you live (including under the EU and UK GDPR and the Law of Georgia on Personal Data Protection), you may have the right to access, correct or delete your personal data, to receive a copy of it, to object to or restrict its processing, and to withdraw consent at any time (without affecting processing before the withdrawal). To exercise these rights, contact us at the address below. You also have the right to lodge a complaint with your local data protection authority.

Children's privacy

The Service is not directed at children under 16, and we do not knowingly collect their data.

Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we'll update the "Last updated" date above.

Contact us

Questions about this policy, or a request to access or delete your data, can be sent to [email protected].