Privacy Policy

This Privacy Policy explains how PanelFlow ("PanelFlow", "we", "us") handles information when you visit our website, join our waitlist, or use our product (together, the "Service"). By using the Service, you agree to the practices described here.

PanelFlow is operated from India and available worldwide. We are the controller of your personal information (the "Data Fiduciary" under Indian law). Because we serve users internationally, more than one privacy regime can apply to you at once — the India-specific and EEA/UK-specific sections below tell you which rights are yours.

We collect the following categories of information:

• Information you provide: your email address when you join the waitlist or contact us, and account details if you create an account.
• Content you create: the projects, characters, worlds, prompts, and images you make with the Service.
• Usage data: how you interact with the Service, such as pages viewed, features used, and approximate location derived from your IP address.
• Device data: browser type, device type, and similar technical information collected automatically.

We use the information to:

• provide, operate, and improve the Service;
• generate content you request, including running your prompts through AI models;
• communicate with you about early access, updates, and support;
• keep the Service secure and prevent abuse;
• comply with legal obligations.

We are established in India, so the Digital Personal Data Protection Act, 2023 and the rules under it apply to our processing. If you are in India, you are a "Data Principal" and you have the right to:

• access a summary of the personal data we process about you and how we process it;
• have inaccurate or incomplete data corrected, completed, or updated, and have data erased where we no longer need it;
• nominate another person to exercise your rights if you die or become incapacitated;
• withdraw consent at any time, as easily as you gave it — withdrawal does not affect processing already carried out;
• raise a grievance with us, and escalate to the Data Protection Board of India if we do not resolve it.

To exercise any of these, or to raise a grievance, contact our grievance officer at support@panelflow.ai. We will respond within the period required by law.

If we become aware of a personal data breach, we will notify affected users and the Data Protection Board of India as required, and within 72 hours where that deadline applies.

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR:

• Performance of a contract — to create and run your account, generate the content you ask for, and process payments.
• Legitimate interests — to keep the Service secure, prevent abuse, and improve how it works, balanced against your rights.
• Consent — for optional communications such as product updates, which you can withdraw at any time.
• Legal obligation — to meet tax, accounting, and other legal requirements.

We operate from India and serve users worldwide, so your information will be processed outside your own country — including in India, where we are established, and in the United States and elsewhere, where our hosting, storage, payment, and AI model providers operate. Where information is transferred out of the EEA or the UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, or on transfers to a country recognised as providing adequate protection.

To generate text and images, we send the prompts and reference material you provide to third-party AI model providers acting on our behalf. We do not sell your content, and we do not use it to train third-party models except as needed to deliver the results you ask for.

We do not sell your personal information. We share it only with service providers who help us run the Service — such as cloud hosting, storage, email delivery, analytics, and AI model providers — under agreements that limit their use of it. We may also disclose information if required by law or to protect the rights and safety of our users and the Service.

We use browser local storage to remember preferences you set — your language and your light/dark theme. These are stored on your device to deliver a feature you asked for, and we do not use advertising or cross-site tracking cookies. You can clear them through your browser settings; doing so resets those preferences.

On your first visit we make one request to a third-party geolocation service (ipapi.co) to look up the country your IP address resolves to, so the site can open in a sensible language. Your IP address is visible to that provider as part of the request. We do not store it, the lookup runs once, and choosing a language yourself stops it running again.

We keep your information for as long as your account is active or as needed to provide the Service, and thereafter as required to meet legal, accounting, or security obligations. You may ask us to delete your account and associated data at any time.

We use reasonable technical and organizational measures to protect your information. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise any of these rights, contact us at support@panelflow.ai. We will not discriminate against you for exercising them.

If you are in the EEA or the UK you also have the right to lodge a complaint with your local data protection supervisory authority. If you are in California, you may have additional rights under the CCPA/CPRA, including to know what personal information we hold and to request its deletion. We do not sell or share personal information for cross-context behavioural advertising.

The Service is not directed to children, and we do not knowingly collect their personal information. The age that counts as a child differs by country — it is 18 in India under the DPDP Act, 13 to 16 across EEA member states, and 14 in South Korea. You must meet the minimum age that applies where you live.

We do not track, profile, or behaviourally target children, and we do not serve advertising. If we learn we have collected personal information from a child without the consent their local law requires, we will delete it. If you believe a child has given us personal information, contact us at support@panelflow.ai.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, notify you.

Questions about this policy? Email us at support@panelflow.ai.