Contents
- Who is responsible for your data
- What data we collect
- Why we collect it (legal basis)
- Third-party processors
- How we handle AI features
- How long we keep data (retention)
- Cookies and local storage
- Where your data is stored
- International data transfers
- How we secure your data
- Data breach notification
- Your rights under GDPR
- Your rights under CCPA/CPRA
- Your rights under UAE PDPL
- Children's privacy (COPPA)
- Do Not Track and Global Privacy Control
- Automated decision-making and profiling
- Changes to this Policy
- How to contact us
1. Who is responsible for your data
The data controller for personal data processed through the Service is Eng. Butti, trading as DiagraFlow, based in the United Arab Emirates. That is the person or entity that decides why and how your personal data is used, and whom you should contact with any privacy question or request. Contact details are in section 19.
Where you use the Service to process personal data of your own end-users (for example, names or emails you put inside a diagram you own on a Team workspace), you are the controller of that data and DiagraFlow acts as your processor. Enterprise processor terms, if offered, will be handled in a separate written agreement.
2. What data we collect
We deliberately keep this list short. Below is every category of personal data we currently collect, together with the specific fields and where they come from.
| Category | Specific fields | Source |
|---|---|---|
| Account identity | Email address, salted bcrypt hash of your password (never the plaintext), display name if you set one, account creation timestamp. | You, at signup. |
| Content you create | Diagrams (Mermaid source code and Yjs CRDT snapshots), whiteboard drawings, Markdown documents, comments and comment threads, uploaded images inside diagrams, workspace and folder names. | You, as you use the Service. |
| Workspace membership | The workspaces you belong to, your role within each workspace (owner, admin, editor, viewer), invitations you sent or received. | You and your workspace admin. |
| Session data | Session cookies (opaque signed tokens), device/browser type as reported by the User-Agent header, session creation and last-active timestamps, IP address at the time of session creation (for security review). | Your browser. |
| Billing metadata | Stripe customer ID, Stripe subscription ID, plan tier, seat count, invoice numbers, last four digits of the card and card brand as reported by Stripe. We do not store your full card number, expiry, or CVV. | Stripe. |
| AI usage counters | Weighted hosted AI credits used in the current credit period, optional top-up balance, and related usage timestamps. | Our servers. |
| Operational logs | HTTP request logs (path, response code, duration, coarse IP), application error stack traces, account lockouts, and password-reset events. Operational retention is limited according to the production logging schedule. | Our servers. |
| Support messages | The content of any email you send to us and our reply, held in our email account for as long as we may need it to answer follow-up questions or resolve a dispute. | You. |
Optional contact information: Settings lets you supply a phone number and a secondary email address for account communication. These fields are optional and are not used for sign-in or password recovery. They remain in your live account until you clear and save them or delete the account; existing backup copies are not immediately rewritten when a field is cleared.
Names or company details are collected only when you voluntarily include them in your display name, billing requests, support messages, or other content. They are used with that account communication or content and follow its retention rules; a name or company is not required to fill the optional contact fields.
We do not request precise geolocation, health data, biometric data, or special-category personal data. We do not run third-party analytics, advertising networks, or session-replay tools. Limited first-party account and usage events support service operation.
3. Why we collect it (legal basis)
Under the GDPR we need a legal basis for each purpose we process your personal data for. Ours are:
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account, storing and syncing your content, delivering all core features of the Service. | Contract — Art. 6(1)(b). Necessary to perform the agreement we have with you. |
| Charging your subscription, sending invoices, meeting our tax and accounting obligations. | Contract and legal obligation — Art. 6(1)(b) and 6(1)(c). |
| Detecting fraud and abuse, keeping the Service secure, investigating security incidents. | Legitimate interests — Art. 6(1)(f). Our interest in a working, un-abused product; balanced against the minimal data collected. |
| Answering support emails and other communications you initiate. | Legitimate interests and contract — Art. 6(1)(b) and 6(1)(f). |
| Sending transactional email — trial-ending reminder, receipt, password reset, security alert, incident notification. | Contract — Art. 6(1)(b). |
| Complying with a legal order, court process, or regulatory obligation. | Legal obligation — Art. 6(1)(c). |
We currently do not send marketing email and therefore do not rely on consent for that purpose. If we ever start, we will ask for consent first and give you a one-click way to withdraw it.
4. Third-party processors
We use a small set of third-party vendors ("sub-processors") to run the Service. They process the data needed for the functions below under their applicable service terms and contracts.
| Vendor | What they do | Data they see |
|---|---|---|
| Stripe, Inc. (United States, Ireland) | Payment processing, invoicing, subscription lifecycle. | Your email, your name and billing address as you enter them into Stripe's checkout, your card details (Stripe stores these — we do not), your Stripe customer and subscription identifiers. |
| Resend, Inc. (United States, EU) | Security and transactional email delivery, including account verification and password reset. | The recipient email, the subject and body of the message, and metadata about delivery. |
| Configured AI model provider — optional hosted-credit path | Generates AI diagrams only when the hosted AI feature is available and you choose to use it. | The prompt you submit and the generated response are sent to the provider configured for that deployment. Provider identity, processing location, retention, and training treatment depend on the deployment configuration and the provider's terms. |
| Hostinger International Ltd. | Application hosting, managed MySQL database, operational storage, and routine mailbox/SMTP services where enabled. | Account records, diagrams and workspace content, operational logs, and routine email content required to operate the Service. |
| Cloudflare, Inc. | Authoritative DNS, content delivery, TLS/security controls, and protection of the public website. | Network metadata such as IP address, requested hostname/path, timestamps, browser headers, and security signals processed while routing and protecting requests. |
We aim to keep this sub-processor list current and will provide notice of material changes when required by law or an applicable written agreement.
We do not sell, rent, or trade your personal data to any third party. We disclose data only to the processors above, to a competent authority when compelled by law (and, where lawful, only after notifying you), and to a successor in interest as part of a merger, acquisition, or sale of assets.
5. How we handle AI features
AI-assisted diagram generation is optional. When you use it, this is exactly what happens to your prompt:
5.1 Hosted AI credits
The 14-day trial includes 10 one-time hosted AI credits. Every paid membership includes 20 hosted AI credits each month; optional top-ups are purchased separately.
- Your prompt is sent from your browser to our backend over TLS.
- Our backend forwards it to the AI provider configured for that deployment. The provider, processing location, retention, and training treatment depend on the deployment configuration and the provider's terms.
- The provider returns the diagram source. We decrement the applicable hosted-credit balance and return the source to your browser.
- The application is designed not to persist your prompt or response beyond the immediate request. The configured provider's own retention policy applies to whatever it holds.
5.2 We do not train on your data
DiagraFlow does not train, fine-tune, or otherwise develop any machine-learning model on your prompts, diagrams, or any other content. We do not sell your prompts to a training pipeline. The only automated processing of the substance of your content is the model inference call you explicitly initiated.
6. How long we keep data (retention)
| Data | Retention |
|---|---|
| Live diagrams, whiteboards, docs, comments | Until you delete them or delete your account. |
| Version history — Personal plan | Rolling 90 days per diagram, then oldest snapshots are pruned. |
| Version history — Enterprise plan | Only if covered by a separate written order; no public entitlement is offered. |
| Encrypted AI API keys | Until you remove them from Settings, or account deletion. |
| Session cookies | Until you sign out, revoke the session in Settings, or 30 days of inactivity — whichever comes first. |
| Operational logs (request logs, error logs, security events) | Maximum 30 days, then rotated out. |
| Billing records (Stripe metadata, invoices) | As long as legally required under UAE tax and accounting law — typically at least 5 years from the date of the transaction. |
| Account after cancellation | Paid Studio access ends when cancellation takes effect. You can still use account Settings to export or explicitly delete your data. We do not silently purge a canceled account on a fixed schedule. |
| Support email correspondence | Up to 3 years from the last message, then deleted. |
7. Cookies and local storage
We use a deliberately minimal set of cookies and browser storage. We do not use advertising or cross-site tracking cookies. No third-party tag manager, Google Analytics, Facebook pixel, session recorder, or Cloudflare Web Analytics script is used.
| Name | Purpose | Duration |
|---|---|---|
diagraflow.sid |
Authentication session cookie. HTTP-only, Secure, SameSite=Lax. | 30 days rolling. |
diagraflow.csrf |
CSRF protection token paired with the session cookie. | Session lifetime. |
diagraflow.theme (localStorage; an older
flowgram.theme value is migrated once)
|
Remembers your theme choice (dark, light, or Aurora). A legacy theme value is read once, migrated to this key, and removed. | Until you clear browser data. |
diagraflow.editor.* (localStorage / IndexedDB) |
Local draft and editor-state families, including diagrams, version history, active document, cache ownership, onboarding completion, AI preferences, whiteboard content, and pending offline synchronisation. | Until you clear browser data. |
diagraflow.activation.*, diagraflow.workspace.*, and other
diagraflow.* UI preferences (localStorage)
|
Remember completed onboarding steps, workspace display state, and non-sensitive interface preferences. These keys never replace server-side ownership or access controls. | Until you clear browser data. |
All of the above are strictly necessary for the Service to function and are therefore exempt from the consent requirement under the ePrivacy Directive as implemented in EU member states. Because we set no non-essential cookies, we do not display a cookie consent banner.
8. Where your data is stored
Full transparency, updated as our infrastructure evolves:
- Current production. The application and its dedicated MySQL database run on Hostinger infrastructure. Cloudflare provides DNS, delivery and security in front of the Hostinger origin. Encrypted backup files may also be copied to a separately controlled S3-compatible destination when that operational safeguard is enabled.
- Stripe processes billing data in the United States and the European Union under Stripe's own compliance regime (PCI-DSS Level 1).
- The configured model provider processes AI prompts in the locations specified by its terms. Provider identity and processing location depend on deployment configuration.
9. International data transfers
If you are located in the European Economic Area, United Kingdom, or Switzerland, and your personal data is transferred outside those regions to a country that has not been the subject of an adequacy decision by the European Commission, we rely on the European Commission's Standard Contractual Clauses (2021/914) with the recipient. For transfers to the United States, we also rely, where available, on the recipient's certification under the EU-U.S. Data Privacy Framework.
For UAE data subjects, cross-border transfers are made in accordance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL"), typically relying on the recipient's contractual commitment to an equivalent level of protection.
You can request a copy of the safeguards in place for any specific transfer by writing to the contact address in section 19.
10. How we secure your data
We take security seriously. We do not claim any certification we don't actually hold — no SOC 2, no ISO 27001 today. Current controls include:
- Transport encryption. All connections between you and our servers use TLS 1.2 or newer.
- Password storage. Passwords are salted and hashed with bcrypt. We do not store the plaintext and cannot recover it.
- Secret encryption at rest. Provider credentials and selected operational secrets are encrypted with AES-256-GCM. The encryption key is stored separately from the ciphertext.
- Isolation. Users can access only their own workspaces. Public share links are gated by unguessable cryptographic tokens.
- Session hygiene. Session cookies are HTTP-only, Secure, and SameSite=Lax. CSRF protection is on every state-changing request. Failed login attempts are rate-limited.
- Content-security defences. Rendered Markdown is sanitised with DOMPurify. Public share pages set a strict Content-Security-Policy header.
- Dependency maintenance. Third-party dependencies are reviewed and patched as part of maintenance, with priority handling for critical vulnerabilities.
- Access. Administrative production access is intended to be limited to owner-managed credentials; hosting and infrastructure providers may operate the underlying services they provide.
No system is perfectly secure. The published channel for vulnerability reports is
security@diagraflow.com. Please allow a reasonable time to remediate before
public disclosure.
11. Data breach notification
If we become aware of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, we will notify the competent supervisory authority (and, for EEA data subjects, the lead supervisory authority) without undue delay and, where feasible, within 72 hours of becoming aware of it, as required by Article 33 of the GDPR.
We will notify affected users directly, by email to the address on file, without undue delay when the breach is likely to result in a high risk to their rights and freedoms, as required by Article 34 of the GDPR. For UAE data subjects, we will additionally notify the UAE Data Office in accordance with the PDPL and its executive regulations.
12. Your rights under GDPR
If you are in the European Economic Area, United Kingdom, or Switzerland, you have the following rights over your personal data:
Get a copy of the personal data we hold about you.
Correct any inaccurate or incomplete data.
Ask us to delete your data. Where legally required to retain (e.g. tax records), we will explain what we must keep and for how long.
Pause our processing while a request is being handled.
Receive your data in a structured, commonly used, machine-readable format (JSON export from Settings → Account).
Object to processing based on our legitimate interests.
Where processing is based on consent, withdraw it at any time — with no effect on processing already carried out.
Contact your local supervisory authority (see edpb.europa.eu for the
list).
You can exercise most of these rights directly in Settings → Account — export your data, delete your account, correct your email. For anything else, email the address in section 19. We will respond within 30 days and can extend to 60 days for complex requests with an explanation.
13. Your rights under CCPA/CPRA
If you are a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) gives you the following rights:
What categories of personal information we collected, the sources, the business purposes, and the categories of third parties we shared it with — all of which is set out in this Policy.
Receive a copy of the specific personal information we collected in the last 12 months.
Ask us to delete personal information we collected from you, subject to legal retention exceptions.
Correct inaccurate personal information we hold about you.
We do not sell or share personal information as those terms are defined by the CCPA. There is nothing to opt out of, but you have the right to make that request anyway.
We do not collect "sensitive personal information" as defined by the CPRA, so this right does not apply here in practice.
We will not deny you the Service, charge you a different price, or provide a different level of quality because you exercised a CCPA right.
You may designate an agent to make requests on your behalf, subject to reasonable verification.
Verified requests can be submitted to the email in section 19. We do not charge a fee for the first two requests in any 12-month period.
14. Your rights under UAE PDPL
If you are a resident of the United Arab Emirates, the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL") gives you:
Know the purpose, categories, recipients, and duration of processing of your personal data.
Request and receive your personal data in a structured, machine-readable format.
Correct inaccurate personal data.
Request deletion of your personal data, subject to legal retention exceptions.
Ask us to limit how we process your data.
Object to decisions based solely on automated processing that has a legal or similarly significant effect on you.
Withdraw consent where processing is based on consent.
Lodge a complaint with the UAE Data Office if you believe your rights have been violated.
To exercise these rights, contact us at the address in section 19. We will verify your identity, respond within the statutory time limits, and document our response.
15. Children's privacy (COPPA)
The Service is not directed to children under the age of 13. We do not knowingly collect personal information from anyone under 13, in accordance with the U.S. Children's Online Privacy Protection Act ("COPPA"). If you are a parent or guardian and you learn that your child under 13 has provided personal information to us, please contact us at the address in section 19. We will delete that information from our systems as quickly as we can, and, unless legally required to retain it, we will not use it for any purpose.
In jurisdictions where the age of digital consent is higher than 13 (for example 16 in some EU member states), we apply that higher local age of consent.
16. Do Not Track and Global Privacy Control
We do not use behavioural advertising, tracking pixels, or cross-site profiling technologies, so there is no tracking activity for a "Do Not Track" (DNT) header or a Global Privacy Control (GPC) signal to disable. We nevertheless treat a GPC signal from your browser as a valid opt-out of any sale or sharing of personal information for the purpose of the CCPA.
17. Automated decision-making and profiling
We do not make any decision that produces a legal or similarly significant effect on you solely by automated means. AI features in the Service produce diagram output; they do not make any decision about your account, your eligibility for a plan, your pricing, or anything else that affects you legally.
18. Changes to this Policy
We may update this Privacy Policy from time to time. When we do, we will change the "Last Updated" date at the top of this page. For material changes — for example, adding a new category of personal data, a new sub-processor, or a new purpose of processing — we will notify you in advance by email and/or a prominent in-app notice at least 30 days before the change takes effect.
Continued use of the Service after the effective date of any change constitutes your acceptance of the updated Policy. If you disagree, you may export your data and delete your account from Settings before the change takes effect.
19. How to contact us
To exercise any right described in this Policy, to ask a question, or to submit a data request, please write to:
DiagraFlow — Data Protection Contact
Attn: Eng. Butti
Published contact channel for privacy requests: privacy@diagraflow.com
Published contact channel for legal notices: legal@diagraflow.com
Published contact channel for security disclosures: security@diagraflow.com
Jurisdiction: United Arab Emirates
For faster handling of a rights request, please write from the email address on your account and describe the specific right you wish to exercise. If you write from a different address we may need to ask additional questions to verify your identity before acting.