Privacy Policy
Version 2026-09. Draft pending legal review.
This policy explains what personal data Pageflow collects, why, and the choices you have. It follows the Uganda Data Protection and Privacy Act, 2019 and, where it applies to you, the EU/UK GDPR.
What we collect
| Data | Why | Kept |
|---|---|---|
| Account: name, email, password (held by Google Firebase Authentication), Google sign-in ID, timezone, language | To run your account and sign you in | Until you delete your account |
| Workspace content: websites, pages, images, templates, versions | To build, store and publish your sites | Until you delete it or your account |
| AI prompts and outputs | To generate and edit your site; to measure quality and prevent abuse | Until you delete your account; design previews 7 days |
| Billing: plan, invoices, billing address, card brand/last 4 digits, Mobile Money number (encrypted) | To charge you and keep tax records | Invoices 7 years as tax law requires; payment methods until removed |
| Security logs: IP address, browser, request IDs, audit log of account and admin actions | To protect the Service and investigate abuse | As long as needed for security and legal claims (period to be set in legal review) |
We never see or store full card numbers: card details go straight to our payment provider's hosted fields.
Visitors to sites built with Pageflow
- Analytics are cookieless. We count visits without cookies or fingerprinting: a visitor's IP and browser are combined with a salt that changes every day and hashed. The IP itself is never stored, and the hash can't be linked across days.
- Forms: what a visitor types into a site's form is stored for the site owner, together with a hashed IP for spam protection. The site owner decides how long to keep submissions and can export or delete them.
- The site owner is the controller of their visitors' data; we process it on their behalf.
Who we share data with
We use these processors, under contracts that protect your data:
- Google Firebase (sign-in), our cloud hosting and storage provider, and our content delivery network
- Flutterwave (card and Mobile Money payments)
- Moonshot AI (Kimi) for AI features, and Unsplash for stock images
- Our email provider, and Sentry for error reports
We do not sell personal data. We disclose data to authorities only when the law requires it.
International transfers
Some processors store data outside Uganda. We rely on their contractual and technical safeguards for these transfers.
Your rights
You can access, correct, export or delete your data. Most of this is in Settings; for anything else write to support@pageflow.dev.xandalabs.com. You can also complain to the Personal Data Protection Office of Uganda.
Deleting your account
Settings → Profile → Delete account removes your account at once: your workspaces (if you are their only member), websites, media, forms and submissions are deleted, your published sites go offline, and your sign-in is removed from Firebase. Backups roll off within 30 days. Invoices are kept for tax purposes.
Cookies
See the Cookie Statement.
Changes
We will tell you by email or in the app before material changes take effect.
Contact
Data protection questions: support@pageflow.dev.xandalabs.com.