PersonaFlow

1. Who we are

PersonaFlow (“we,” “us,” or “our”) operates the PersonaFlow platform available at personaflow.onlineand any associated subdomains or mobile applications (collectively, the “Service”).

PersonaFlow is the data controller for the personal data described in this policy. We are based in Slovenia, European Union, and this policy reflects our obligations under the EU General Data Protection Regulation (GDPR) and applicable Slovenian data protection law.

2. Data we collect and why

2.1 Account & identity data

When you register, we collect your name, email address, and a hashed password (if you register with email/password). If you sign in via a social provider (Google, GitHub, Microsoft, LinkedIn, or Discord), we receive your name, email, and profile image from that provider via OAuth. We store the OAuth access and refresh tokens necessary to maintain the connection.

Legal basis: Performance of a contract (GDPR Art. 6(1)(b)) — you cannot use the Service without an account.

2.2 Profile & professional content

You may optionally provide: display name, headline, bio, profession, location, skills, goals, projects, links, profile photo, availability status, calendar booking URL, testimonials, job board listings, social media URLs, GitHub username, and custom domain. This content forms your public PersonaFlow profile page.

We also store profile version snapshots so you can review or restore previous versions of your profile.

Legal basis: Performance of a contract (Art. 6(1)(b)) and your explicit action in providing this content.

2.3 AI-generated content & knowledge documents

When you use AI writing features, your profile data and any knowledge document you have marked public can be sent to the configured AI provider to generate responses. If a Groq API key is configured, that provider is Groq. Otherwise, if an OpenAI API key is configured, that provider is OpenAI. AI generation requests and outputs are logged to track your monthly usage quota. Knowledge documents (name, file type, and text) are stored in the application database. New and existing documents are private until you explicitly mark one public. The visitor-facing assistant retrieves only documents marked public. Private documents remain available in your account.

Legal basis: Performance of a contract (Art. 6(1)(b)) — AI features are a core part of the Service you have requested.

2.4 Analytics & profile visitor data

We record events on published profiles (page views, link clicks, project clicks, contact form submissions) to provide profile owners with analytics. Events are associated with the profile owner's account. Visitor IP addresses are not stored; we record only anonymised interaction metadata (event type, path, timestamp, approximate geographic region derived from IP at collection time, referrer URL, and device type).

Legal basis:Legitimate interests (Art. 6(1)(f)) — enabling profile owners to understand their audience is a core feature. Visitors' interests are protected by the anonymisation of IP addresses.

2.5 Lead & contact form data

When a visitor submits the contact form on your public profile, we collect the visitor's name, email address, and message, and store this as a lead associated with the profile owner's account. Profile owners are responsible for handling this data in compliance with applicable law.

Legal basis: Legitimate interests (Art. 6(1)(f)) of the profile owner in receiving professional inquiries.

2.6 Session & technical data

We log your IP address and browser user-agent when you create a session (sign in). Sessions expire automatically. We use essential cookies and secure HTTP-only session tokens to maintain your logged-in state.

Legal basis: Legitimate interests (Art. 6(1)(f)) — securing accounts and preventing unauthorised access.

2.7 Billing & subscription data

Paid subscriptions are processed by Stripe, Inc.We store your Stripe customer ID and subscription ID to manage your plan. We do not store full payment card numbers, CVVs, or bank account details on our servers. Stripe's privacy policy applies to all payment data: stripe.com/privacy.

Legal basis: Performance of a contract (Art. 6(1)(b)) and compliance with legal obligations including VAT/invoicing requirements (Art. 6(1)(c)).

2.8 Integration & webhook data

If you connect Slack, Zapier, or Make.com, we store the webhook URL you provide and log deliveries (event type, destination URL, timestamp, response status). We connect to GitHub on your behalf using OAuth tokens you authorise. Social media profile URLs you add are stored as part of your profile.

Legal basis: Performance of a contract (Art. 6(1)(b)) — you explicitly configure these integrations.

2.9 Referral data

If you were referred by another user, we record the referring user's ID alongside your account to attribute referrals and apply any applicable rewards.

Legal basis: Legitimate interests (Art. 6(1)(f)) in operating a referral programme.

3. Third-party processors

The processors below are the ones this application is built to use. A transfer mechanism such as Standard Contractual Clauses was not verified in this update and needs legal review before this section is treated as final.

Hosting — the project is configured for Vercel. Vercel Web Analytics and Speed Insights are loaded in the application layout.
Database — PostgreSQL. The database connection configured for this project uses Neon in AWS us-east-1. Knowledge-document text is stored there.
AI inference — Groq when a Groq API key is configured; otherwise OpenAI when an OpenAI API key is configured.
Payments — Stripe, when billing is configured, for subscription checkout and the customer portal.
Transactional email — Resend, when an API key is configured, for messages such as verification, lead notices, and digests.
File storage — profile images use S3-compatible object storage when bucket credentials are configured. The code treats a Cloudflare R2 endpoint as R2 and otherwise uses the configured S3-compatible endpoint. Knowledge-document text is not stored in object storage. If object storage is not configured, images are written to local disk on the server.

We do not sell, rent, or trade your personal data to any third party.

4. Public profiles

When you publish your profile, your profile content is publicly accessible at/u/your-username and may be indexed by search engines, embedded on third-party websites, and shared via QR codes or social cards. You control what content is published and can unpublish your profile at any time from your dashboard.

Lead data submitted through your public contact form is stored securely and accessible only to you. We deliver lead notifications to your email or configured webhooks.

5. Data retention

Account & profile data — retained while your account is active. Deleting your account removes the user record in the application database and attempts to delete the stored avatar file. Stripe records and database backups may still exist. How long those copies are kept needs legal review.
Analytics events — the dashboard shows 7 days on Starter, 90 days on Creator, and 365 days on Pro. The application does not currently delete older event rows.
AI generation logs — retained for billing and abuse prevention for 90 days, then deleted.
Session logs — automatically expire and are purged after expiry.
Billing records — retained for 10 years as required by Slovenian accounting law (ZGD-1).

6. Your rights under GDPR

As a data subject in the EU/EEA, you have the following rights regarding your personal data:

Right of access (Art. 15) — request a copy of all personal data we hold about you.
Right to rectification (Art. 16) — correct inaccurate or incomplete data.
Right to erasure (Art. 17) — request deletion of your data where no legal obligation to retain applies.
Right to restriction (Art. 18) — ask us to pause processing your data in certain circumstances.
Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
Right to object (Art. 21) — object to processing based on legitimate interests.
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any right, email privacy@personaflow.online. We will respond within 30 days. You also have the right to lodge a complaint with the Slovenian Information Commissioner (Informacijski pooblaščenec): ip-rs.si.

7. Cookies

The application uses:

Session cookie (strictly necessary) — an HTTP-only cookie that authenticates your session. It is marked secure in production.
Theme preference — a localStorage value storing light or dark mode.
Vercel Web Analytics and Speed Insights — loaded on pages. These may set cookies or similar identifiers.
Google Analytics — loaded only when a measurement ID is configured for the deployment.

Whether a cookie consent banner is required for the analytics tools above needs legal review. This policy previously said the product used no third-party analytics cookies. That statement did not match the application.

8. Security

Passwords are hashed with bcrypt. OAuth access and refresh tokens are stored in the database so sign-in connections can be maintained. Application code does not add a separate encryption layer around those tokens. Whether the database encrypts data at rest depends on the host and was not independently certified in this update. If you discover a vulnerability, please disclose it responsibly to privacy@personaflow.online.

9. Children

PersonaFlow is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us immediately for deletion.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify registered users by email at least 14 days before material changes take effect. The “Last updated” date at the top of this page reflects the most recent revision.

11. Contact

For any privacy-related questions or to exercise your rights:
privacy@personaflow.online

For general support: support@personaflow.online