1. Scope
This Policy covers information we collect as the operator of the Services — i.e., when you sign up for an EditrFlow account, connect a third-party platform, or use the app yourself. It does not cover information processed on behalf of an agency you work for as their client, contractor, or lead (in that case, the agency using EditrFlow is responsible for their own privacy practices toward you). It also doesn't cover third-party services you connect to EditrFlow — their own privacy policies govern how they handle your data.
What Information Do We Collect?
Information you provide directly:
Account information — your name and email address, managed through our authentication provider. If you sign in with a third-party identity provider (such as Google), we receive the basic profile information that provider shares for that purpose.
Payment information — handled entirely by our payment processor. We never see or store your full card number; we store only your subscription status, plan, and the processor's own identifiers for your account so we know what you're subscribed to.
Customer Data you create in the app — the records, content, and files you create or upload using EditrFlow's features, such as client and lead records, project and pipeline details, invoices and contracts, portfolio content, and messages or attachments sent or received through a Connected Platform.
Connected Platform credentials — when you connect a third-party messaging or collaboration platform (currently, for example, Slack or Discord, with more supported over time), we store the access credentials needed to send and receive content on your behalf, plus basic profile information needed to attribute that content to the right person. You can disconnect a Connected Platform at any time, which revokes and deletes those credentials.
Optional feature data — some features are opt-in and only collect data once you turn them on, limited to what's described at the time you enable them. For example, our Editing Performance feature only records the name and foreground time of applications you explicitly choose to track — never window titles, screen contents, keystrokes, or any application you haven't chosen.
Support communications — anything you send us directly, like a support request.
Information collected automatically:
Basic technical/log data — things like IP address, device type, and app version, used for debugging and keeping the Services secure and running.
Usage data — which features you use, so we can prioritize what to build next.
Information from third parties:
If you connect a third-party platform, we receive content, profile information, and attachments from that platform's API, limited to what you've authorized and the channels or workspaces you've connected.
Some features may query third-party services on your behalf (for example, a media or content search integration) — in those cases, only the specific request needed to return your result is sent.
How Do We Use This Information?
We use the information above to:
provide, operate, and maintain the Services and their features, current and future;
process payments and manage your subscription;
authenticate you and keep your account secure;
respond to support requests;
fix bugs, improve performance, and decide what to build next;
detect and prevent fraud, abuse, or security incidents; and
comply with legal obligations.
We do not use Customer Data to train machine learning models, and we do not use your data for third-party advertising.
Do Not Track
Because we don't engage in third-party behavioral advertising tracking, we don't currently alter our practices in response to browser "Do Not Track" signals.
Region-Specific Disclosures
California residents: We do not share your personal information with third parties for their own direct marketing purposes without your consent (Cal. Civ. Code § 1798.83).
Nevada residents: You may opt out of any future sale of your personal information by contacting us at the email below. We do not currently sell personal information.
European Economic Area, UK, and Switzerland: Where GDPR or UK GDPR applies, our legal bases for processing include performing our contract with you, your consent, our legitimate interests in operating and improving the Services, and compliance with legal obligations. You have the right to access, correct, or delete your data; restrict or object to processing; request data portability; withdraw consent; and lodge a complaint with your local data protection authority. Where we process data on behalf of an agency (as their service provider/processor), requests about that data should go to the agency directly.
United Arab Emirates: As a company registered in Dubai, we handle personal data in accordance with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), where applicable.
International Data Transfers
Your information may be stored and processed in the United Arab Emirates, the United States, and other countries where our service providers operate, which may have different data protection laws than your own country. By using the Services, you consent to this transfer, in accordance with this Policy.
Changes to This Policy
We may update this Policy from time to time. If we make material changes — for example, introducing a new category of data collection, or a materially different use of your information — we'll notify you through the Services or by email. Continued use of the Services after an update constitutes acceptance of the revised Policy.
Contact Us
MYORGANIC - FZCO Premises DSO-IFZA, IFZA Business Properties, DDP, Dubai, UAE
Email info@editrflow.com
