Privacy Policy

1. Who we are

Centraflow Pvt Ltd, a company registered with the Securities and Exchange Commission of Pakistan (SECP), operates Centraflow AI. For personal data described in this policy we are the controller (or “business” under US state privacy laws). You can reach us at R-1,2, Lehtrar Road, Khanna Dak, Islamabad, Pakistan, or by email at omar@centraflow.tech, which is also the contact for all privacy requests.

Payments are handled by Paddle.com, our Merchant of Record. For payment and billing data Paddle acts as an independent controller under its own Privacy Notice.

2. Data we collect

• Account data: your name, email address and profile picture from Google or GitHub when you sign in, an account identifier and session records. We do not receive your Google or GitHub password.
• Your content: project names, notes and text you type or import, outlines, generated mindmaps, theme choices, node positions and the history of your generations.
• Imported files: text files, PDFs and images you attach are read in your browser. Images and scanned PDFs are converted to text with in-browser OCR. We keep only the extracted text you submit; we do not store the original file.
• Suggestion telemetry: for inline suggestions we record only the outcome (for example, accepted or dismissed), lengths, timing and a correlation identifier. We do not store the suggestion text in this telemetry.
• Subscription data: your Paddle customer and subscription identifiers, plan, status and trial, renewal and cancellation dates. We do not receive or store your card number.
• Technical data: IP address, browser and device information and request logs, used for security, abuse prevention, rate limiting and diagnostics.

3. How we use data and our legal bases

• Provide the Service (account, saving projects, generating mindmaps, subscriptions) — performance of our contract with you.
• Security, fraud prevention and abuse limits (including usage and rate limits) — our legitimate interests in keeping the Service safe and sustainable.
• Improve and debug the Service using aggregate suggestion telemetry and logs — our legitimate interest in product quality.
• Service and billing communications (confirmations, renewal and trial reminders, important changes) — contract and legal obligation.
• Legal and tax compliance and defending legal claims — legal obligation and legitimate interests.

We do not sell your personal data, do not share it for cross-context behavioural advertising, and do not make decisions about you that have legal or similarly significant effects through solely automated means. Where we ever rely on consent, you can withdraw it at any time.

4. AI providers and your content

To generate outlines, suggestions, themes and images we send the relevant part of Your Content (for example, your notes, the surrounding outline, a style prompt, or a rendered image of your mindmap for Artistic Export) to third-party AI providers, currently OpenAI and Anthropic. They process it on our behalf to return a result.

We do not use Your Content to train our own models. Under the providers’ API terms in effect at the time of writing, content sent through their APIs is not used to train their models by default. Please do not submit highly sensitive personal data (such as health or government identifiers) in your notes. Provider terms can change, so review theirs if this matters to you.

5. Who we share data with

We share personal data only with service providers that help us run the Service, and where the law requires:

• Neon — managed PostgreSQL database hosting for your account and content (United States region).
• OpenAI and Anthropic — AI processing of the content you choose to generate from.
• Google and GitHub — authentication when you sign in with them.
• Paddle.com — payments, tax, invoicing, fraud prevention and customer billing support.
• Our cloud hosting and infrastructure providers — running the application, logs and rate limiting.
• Professional advisers, authorities and successors where required by law or in connection with a business transfer.

These providers may only process the data to provide their services to us and are bound by data protection terms.

6. International transfers

We operate from Pakistan and our providers process data in other countries, including the United States and the United Kingdom. Where personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum) or the equivalent mechanisms offered by our providers. You can request details of the safeguards we use by emailing us.

7. How long we keep data

• Account, content, history and telemetry are kept while your account is active and deleted when you delete your account.
• Residual copies in provider backups expire on the provider’s rolling retention schedule.
• Billing and tax records are retained by Paddle and, in limited form, by us for as long as the law requires.
• Security and request logs are kept only for as long as needed for security and diagnostics.

You can delete projects at any time and delete your whole account from your account settings.

8. Your rights

Depending on where you live (including under the GDPR, the UK GDPR and US state laws such as the CCPA / CPRA) you may have the right to access your data, correct it, delete it, restrict or object to processing, receive a portable copy, withdraw consent, and not be discriminated against for exercising your rights.

• Export: download a copy of your data from your account settings.
• Delete: delete your account and associated data from your account settings.
• Anything else: email omar@centraflow.tech. We respond within one month, and may need to verify your identity.

For billing data held by Paddle (for example invoices or payment details), you can use the Paddle customer portal or contact Paddle directly. You also have the right to complain to your local data protection authority; we would appreciate the chance to address your concern first.

9. Cookies and local storage

We use only the cookies and browser storage needed to sign you in and make the Service work, and we do not use advertising or analytics cookies. Details are in our Cookie Policy.

10. Security

We use measures appropriate to the risk, including encrypted connections, access controls, database-backed sessions, rate limiting and least-privilege access to production systems. No system is perfectly secure. If a personal data breach affects you we will notify you and the relevant authorities as the law requires.

11. Children

The Service is for people aged 18 or over and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

12. Changes to this policy

We may update this policy as the Service or the law changes. We will post the new version here with a new effective date and, for material changes, notify you by email or in the Service.

13. Contact

Centraflow Pvt Ltd, R-1,2, Lehtrar Road, Khanna Dak, Islamabad, Pakistan. Email: omar@centraflow.tech. See also our Terms of Service and Refund Policy.