Privacy Policy

Last Updated: November 27, 2025

1. Introduction

This Privacy Policy explains how Rflow ("we," "us," or "our") collects, uses, and protects your information when you use our AI-powered R coding assistant service.

2. Information We Collect

2.1 Information You Provide

• Payment Information: Processed securely through Stripe (we never see your credit card details)
• API Keys: Generated and stored to authenticate your access
• Email (Optional): If you contact support

2.2 Automatically Collected Information

• Usage Data: Message count, timestamps, API key usage
• Technical Data: IP address, browser type, operating system
• Error Logs: For debugging and service improvement

2.3 Information We Do NOT Collect

3. How We Use Your Information

3.1 To Provide the Service

• Authenticate your API key
• Track message usage and limits
• Process payments through Stripe
• Deliver AI responses via Anthropic's Claude API

3.2 To Improve the Service

• Analyze usage patterns (anonymized)
• Debug technical issues
• Optimize performance
• Develop new features

3.3 To Communicate With You

• Send API keys after purchase
• Respond to support requests
• Notify about service updates (if you opt-in)

4. Data Storage and Security

4.1 Where Your Data is Stored

4.2 Security Measures

• Encryption: All data transmitted over HTTPS
• API Keys: Stored securely with hashing
• Payment Security: PCI-compliant through Stripe
• Access Control: Limited access to production systems
• Regular Backups: Database backed up regularly

5. Third-Party Services

5.1 Anthropic (Claude AI)

Your AI requests are sent to Anthropic's Claude API. Their privacy policy applies:

• Anthropic may use requests to improve their models
• Data retention per Anthropic's policy
• Subject to Anthropic's terms of service

View Anthropic's Privacy Policy →

5.2 Stripe (Payment Processing)

Payment information is processed by Stripe:

• We never see your full credit card number
• Stripe is PCI DSS Level 1 certified
• Subject to Stripe's privacy policy

View Stripe's Privacy Policy →

6. Data Sharing and Disclosure

6.1 We DO NOT Sell Your Data

We will never sell, rent, or trade your personal information to third parties for marketing purposes.

6.2 When We May Share Data

• With Your Consent: When you explicitly authorize sharing
• Service Providers: Anthropic (AI), Stripe (payments)
• Legal Requirements: If required by law or to protect rights
• Business Transfer: In case of merger or acquisition

7. Your Rights and Choices

7.1 Access and Control

You have the right to:

• Access: Request a copy of your data
• Correction: Update incorrect information
• Deletion: Request deletion of your data
• Export: Receive your data in a portable format
• Opt-Out: Unsubscribe from marketing communications

7.2 How to Exercise Your Rights

Contact us at contact@rflowlabs.com to:

• Request data access or deletion
• Update your information
• Ask questions about your privacy

8. Data Retention

• API Keys: Retained while service is active
• Usage Logs: Retained for 12 months
• Payment Records: Retained per legal requirements (typically 7 years)
• Support Emails: Retained for 2 years

You can request early deletion by contacting support.

9. Children's Privacy

Rflow is not intended for users under 13 years of age. We do not knowingly collect information from children. If you believe a child has provided us with personal information, please contact us immediately.

10. International Data Transfers

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data in accordance with this privacy policy.

11. Cookies and Tracking

We use minimal tracking:

• Essential Cookies: For authentication and session management
• Analytics: Anonymized usage statistics (if implemented)
• No Advertising Cookies: We don't use cookies for advertising

12. Changes to This Policy

We may update this privacy policy from time to time. Changes will be:

• Posted on this page with a new "Last Updated" date
• Notified via email for material changes (if we have your email)
• Effective immediately upon posting

13. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights:

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to say no to the sale of personal information
• Right to access your personal information
• Right to equal service and price

14. European Privacy Rights (GDPR)

If you are in the European Economic Area, you have rights under GDPR:

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing

15. Contact Us

For privacy-related questions or concerns: