Privacy Policy

1. Introduction

PirateApeStudios (ABN 47 340 546 246) ("We," "Us," "Our") operates the product XrayFlow. We are committed to protecting your privacy in compliance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), the General Data Protection Regulation (GDPR) for users in the European Economic Area, and the California Consumer Privacy Act (CCPA) for users in California, USA.

This policy explains how we collect, use, and safeguard your information when you use the XrayFlow service.

2. The Data We Collect

2.1 Information You Provide

• Account Data: When you sign up, we collect your Email Address and User ID (via our authentication providers).
• Billing Data: Transaction history and Plan status. Note: We do not store credit card numbers. All financial data is handled securely by Stripe.

2.2 Automated Usage Data

• Operational Metrics: We track the number of reports generated and the generic IDs of scenarios processed to manage usage quotas.
• Telemetry: We use anonymous analytics tools (PostHog — EU-hosted instance) to understand how users navigate the site. This includes page views, feature usage, and session metadata. No personal data is sent to PostHog.

2.3 Where Your Blueprint Data Physically Travels

We do not store your automation logic. We think you should still be able to see exactly where it goes, so here is the complete inventory of every path your data takes.

• Analysis & visualisation — entirely in your browser. Blueprint parsing, security scanning, PII detection, dataflow graph traversal and interactive report rendering all run on your device. We never analyse, score or store your automation logic. The one exception is fetching: because most automation platforms do not permit direct browser requests, the fetch passes through our server as a proxy and is returned to you immediately without being written down.
• PDF & Markdown exports — browser only. These documents are generated locally and downloaded directly from your device. Nothing is transmitted.
• DOCX export — through our server, never stored. Word documents require a Node.js conversion library that cannot run in a browser. When you export DOCX, the generated report markdown is transmitted to our /api/convert-docx endpoint, converted to a Word file, and returned immediately. The markdown is held in server memory for the duration of the conversion only — it is never written to disk, never logged, and never retained after the response.
• AI features — through our server to your configured provider. If you enable AI insights and configure an AI provider, the prompt derived from your blueprint is transmitted through our server to the provider you selected. We do not control that provider’s retention policy. If you do not enable AI, no blueprint-derived content is transmitted.
• Third-party connections — direct from your browser. Make.com, n8n, Zapier, Power Automate and Microsoft Fabric are contacted directly from your browser. Your credentials are sent to those providers, not to us. API keys are held in memory for the duration of the request only.
• Microsoft Fabric sign-in (device-code flow). Microsoft does not permit browser pages to call its device-code sign-in endpoints directly, so the sign-in handshake is relayed through our server: the device code and the resulting access token pass through our server’s memory on their way from Microsoft to your browser. Nothing is stored, logged, or persisted — the token lives only in your browser’s memory for the session. No client secret exists in this flow. When a deployment supplies its own Fabric registration (the PKCE path), the token goes directly from your browser to Microsoft and never touches our server.

Summary: your blueprint is analysed, scored and rendered without leaving your device. The exceptions are DOCX conversion, AI insights, and the Fabric device-code sign-in relay — each opt-in per action, and none of which is ever persisted.

3. Cookies & Tracking

We use a minimal set of cookies and local storage for functionality and analytics:

• cookie_consent (localStorage) — Records your cookie preference so we do not show the banner on every visit. No personal data stored.
• PostHog (first-party cookies) — Session replay and page view analytics. Only active after you explicitly accept cookies. You may decline at any time.
• Supabase / Stripe — Essential authentication and payment session cookies. Required for the service to function.

You can control cookie preferences via our Cookie Consent banner. You may also disable all non-essential cookies through your browser settings.

4. Local Analysis and Optional Data Paths

Core workflow analysis runs locally in the browser. Other features use separate browser-storage, account, server, or AI provider paths:

• Local blueprint analysis: If you paste or upload a blueprint for core analysis, parsing and analysis run in your browser. That local path does not upload the workflow to our servers. Optional AI or server-backed features use separate data paths described below.
• Connected Make retrieval: When you connect to a platform, requests retrieve workflow data from that platform. Credentials saved through connected-account features are encrypted at rest in our integration vault and decrypted server-side when used.
• AI features: When you request AI generation or AI-assisted content, your prompt or workflow context is sent from our server to the custom AI endpoint configured in your account. The provider's own data-handling terms apply.
• Background migration: This optional, server-backed feature is shown behind a consent disclosure and a separate user action. It requires a signed-in Pro account. The workflow payload is encrypted with AES-256-GCM in Redis, removed on terminal job updates, and has a 24-hour TTL backstop.
• Target push: A signed-in Pro user can send a converted workflow through our server to a connected Make.com or n8n account after the consent disclosure. The target credential is encrypted at rest in the integration vault and decrypted for the request; the created workflow is inactive for review.
• AI model training: Xray Flow does not operate a model-training process using workflow content. AI requests go to your configured provider, whose retention and training practices are governed by its own terms.

5. How We Use Your Data

We use your information strictly to:

• Provide and maintain the XrayFlow service.
• Process payments via Stripe.
• Notify you of technical updates or security alerts.
• Improve our product through anonymized usage analytics (with your consent).
• Comply with legal obligations (e.g., tax reporting).

6. Data Retention

We retain your personal data only as long as necessary to provide the service and fulfil legal obligations:

• Account data: Retained while needed to provide account features and meet applicable obligations. Deletion and any legally required retention depend on the relevant account or provider process.
• Billing records: Retention may be required for accounting or legal purposes; Stripe also processes payment records under its own terms.
• Analytics data: Processed by the analytics provider according to the enabled settings and provider retention configuration.
• Workflow data: The core local-analysis path does not upload workflows. Background migration uses the encrypted-job handling and TTL described above; target-push data is sent to the destination platform for workflow creation.

7. Third-Party Sub-Processors

To provide XrayFlow, we share data with trusted third-party providers:

• Stripe — Payment processing.
• Supabase — Authentication, database, and storage.
• Vercel — Cloud hosting and serverless functions.
• Google — OAuth login services.
• PostHog — Product analytics when enabled by your settings.
• Configured AI endpoint — Receives prompts or workflow context when you use an AI feature. Provider terms govern its processing and retention.

8. Subprocessor Notification & Change Policy

We are committed to transparency about changes to our subprocessors. The following policy governs how we notify you of changes:

• Advance Notice: We will provide at least 30 days' written notice (via email and in-app banner) before adding any new subprocessor or changing the scope of an existing subprocessor's processing activities.
• Right to Object: You may object to a new subprocessor by contacting us within the notice period. If you object, we will either (a) not engage the subprocessor for your data, or (b) provide you the option to export your data and terminate your account with a pro-rata refund.
• Due Diligence: Before engaging any new subprocessor, we conduct a security and privacy assessment including review of the provider's security and privacy practices and applicable data-processing terms.
• Subprocessor List Maintenance: The current list of subprocessors is maintained in Section 7 of this policy and on our Trust Centre at xrayflow.io/security. Changes are reflected within 5 business days of execution.
• Annual Review: We review all subprocessors annually for continued compliance and necessity. Subprocessors no longer required are removed within 30 days.

9. International Data Transfers

PirateApeStudios is an Australian entity. Our cloud infrastructure (Supabase / Vercel) uses servers in Australia and the United States. By using the Service:

• EEA users: We ensure adequate safeguards via Standard Contractual Clauses (SCCs) with our sub-processors.
• Australian users: Data remains within the APAC region where possible.
• US users: Data may be processed in the US in compliance with applicable law.

9. Your Rights

9.1 Australian Users (Privacy Act)

• Right to access your personal data.
• Right to correct inaccurate data.
• Right to complain about a breach of the APPs.

9.2 EEA Users (GDPR)

• Right to be informed — This policy fulfills our transparency obligation.
• Right of access — Request a copy of your personal data.
• Right to rectification — Correct inaccurate data.
• Right to erasure ("Right to be forgotten") — Delete your account and associated data.
• Right to restrict processing — Limit how we use your data.
• Right to data portability — Receive your data in a machine-readable format.
• Right to object — Object to processing for analytics.
• Right to withdraw consent — Withdraw cookie consent at any time.

To exercise any GDPR right, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your local Data Protection Authority.

9.3 California Users (CCPA)

• Right to Know — Request details of the personal data we collect, use, and share.
• Right to Delete — Request deletion of your personal data.
• Right to Opt-Out — We do not sell your personal data. No opt-out is needed.
• Right to Non-Discrimination — We will not discriminate against you for exercising your CCPA rights.

To exercise your CCPA rights, email [email protected]. We will verify your identity and respond within 45 days.

10. Data Breach Notification

In the event of a data breach that affects your personal data, we will:

• Notify you within 72 hours of becoming aware of the breach.
• Provide details of the nature and scope of the breach.
• Advise on steps you can take to protect yourself.
• Notify the relevant supervisory authority (OAIC for Australia, ICO for UK, relevant DPA for EEA).

11. Do Not Track

We honor Do Not Track (DNT) signals from your browser. When DNT is enabled, we disable PostHog analytics for your session.

12. Contact Us

If you have questions about this policy, wish to exercise your rights, or need to report a concern:

Email: [email protected]
Security: [email protected]
Entity: PirateApeStudios (ABN 47 340 546 246)
Jurisdiction: Western Australia, Australia