Privacy Notice

Effective: 28 August 2026 · Version: 2.1.0

1. Who we are

Ender Akbiyik, a sole trader established in Türkiye, trading as RedenFlow, of Gaziemir, Izmir 35410, Türkiye, is the controller of the personal data described here. That means we decide why and how it is used, and we are answerable for it.

For anything about your data, write to info@redenflow.com. A person reads that address.

2. What this notice covers

It covers the RedenFlow desktop application, the redenflow.com website, and the services behind them: sign-in, licence checks and account management. It does not cover other websites you may reach from ours, which have their own notices.

3. What we collect

When you create an account

• your email address, which is how you sign in and how we reach you;
• your name, if you give it.

What you choose to add to your profile

• first and last name, company, job title, city and country. All optional, and all editable or removable by you at any time from your account page.

To run your licence

• your plan, subscription status and renewal or expiry date;
• a device identifier derived from the computer you use, so we can apply the device limit of your plan and detect a licence being shared far beyond it;
• how many times your device has changed, and when your licence was last checked.

To apply plan limits

• counts only: how many projects, images, AI-assisted labels, training runs and exports you have made. These are numbers, not content.

When you pay

• the subscription and customer identifiers our payment provider gives us, the plan bought, the amount, the currency and the renewal date. We record the event our payment provider sends us so a payment is never applied twice.
• We never receive or store your card details. Those go to Paddle, and never pass through our systems.

When you write to us

• your message and the address you sent it from, so we can reply and keep track of the conversation.

Diagnostics

• crash reports and basic error information, so we can find and fix faults.

4. What we never collect

Your images, your datasets, your labels and the models you train never leave your computer. We do not upload them, store them, look at them, or use them to train anything of ours. We could not produce them if we were asked to, because we do not have them.

5. Why we use it, and on what legal basis

• To provide the product you asked for: creating and running your account, signing you in, applying your plan and its limits, taking payment and renewing your subscription. Legal basis: performance of our contract with you.
• To keep the product and our customers safe: enforcing device limits, detecting licence abuse and fraud, protecting our systems. Legal basis: our legitimate interests in preventing loss and abuse, weighed against your interests, using the least data that works.
• To fix faults and improve the product: diagnosing crashes and errors. Legal basis: our legitimate interests in a product that works.
• To send you service messages: confirming your address, confirming a subscription, warning you before a renewal, telling you a payment failed, telling you about a security matter or a material change to our terms. These are not marketing and you cannot unsubscribe from them while you hold an account, because they are part of the service. Legal basis: performance of our contract.
• To meet legal obligations: keeping records tax and accounting law requires. Legal basis: legal obligation.
• Marketing, if we ever send any, only with your consent, which you can withdraw at any time. Legal basis: consent.

6. Who we share it with

We do not sell personal data and we do not share it for advertising. We use these providers, and each only gets what it needs to do its job:

• Paddle (Paddle.com Market Ltd and its affiliates), our Merchant of Record. Paddle sells the subscription to you, takes the payment, manages the subscription, calculates and remits tax, and issues invoices. Paddle is a controller of the payment data it collects from you in its own right, under its own privacy notice.
• Supabase, for the database and sign-in service that hold your account, hosted in the European Union.
• Vercel, which hosts redenflow.com.
• Resend, which delivers the emails we send you.
• Google (Google Ireland Limited), which provides the website analytics described in section 12, and only where you have agreed to it. We have not enabled advertising features, so this data is not used to target advertisements to you.
• Professional advisers such as accountants, where they need it.
• Authorities, where the law requires it or where it is needed to protect rights or safety.
• A buyer of the business, if it is ever sold or merged, under the same protections you have now, and we would tell you first.

7. Where your data goes

Your account data is held in the European Union. Some of our providers are based in the United Kingdom or the United States and may process data there. Where data leaves the European Economic Area or the United Kingdom, it is protected by an adequacy decision or by Standard Contractual Clauses with the provider concerned.

8. How long we keep it

• Account and profile data: while your account exists, and for 30 days after you ask us to delete it, so an accidental deletion can be undone.
• Licence and usage counts: while your account exists.
• Payment records: for as long as tax and accounting law requires, which in Türkiye is generally ten years.
• Support messages: for up to two years after the conversation ends.
• Crash and error data: up to 12 months, then deleted.

9. Your rights

Depending on where you live, including under the EU and UK GDPR and under Türkiye’s KVKK, you have the right to:

• ask what we hold about you and get a copy;
• have inaccurate data corrected;
• have your data deleted;
• ask us to restrict how we use it, or object to our using it;
• receive your data in a portable form, or have it sent to someone else;
• withdraw consent where we relied on it, without affecting what we did before;
• find out whether your data has been passed abroad, and to whom;
• ask that any decision made about you by automated means be reviewed by a person. We do not currently make any such decisions.

10. How to use those rights

Email info@redenflow.com and say what you want. We may need to check who you are first. We answer within one month, and will tell you if a request is complex enough to need longer, as the law allows.

If you are unhappy with our answer you can complain to your data protection authority: in Türkiye the Personal Data Protection Authority (KVKK), in the United Kingdom the Information Commissioner’s Office, and in the EU the authority for the country where you live.

11. Security

Traffic to and from our services is encrypted in transit. Access to the database is restricted per account by row level security, so one account cannot read another, and administrative access is limited to those who need it. Sign-in credentials are handled by our authentication provider and we never see your password. Sensitive values stored on your own computer are encrypted at rest. No system is completely secure, and we do not claim otherwise; if a breach ever puts your rights at risk we will tell you and the relevant authority within the time the law sets.

12. Cookies and website analytics

The desktop application does not use cookies at all.

The website uses strictly necessary cookies to keep you signed in and keep your session secure. These cannot be switched off, because blocking them stops you signing in. Nothing is asked of you for these, and nothing about them identifies you beyond your own session. Paddle’s checkout sets its own cookies while you are paying, under Paddle’s notice.

The website also uses Google Analytics to count visits and see which pages people find useful. It does not run unless you agree to it. Nothing is loaded, no cookie is set and no request is made to Google until you choose, and choosing to refuse is one click, in the same place and the same size as accepting.

If you agree, Google Analytics sets cookies that let us see how many people visit, which pages they read, roughly which country they are in, and which of those visits led to a download or a subscription. Your IP address is shortened before it is stored, and we have not enabled any advertising feature, so this is never used to target advertisements at you or shared for that purpose. Legal basis: consent.

You can change your mind at any time. There is a Cookie settings link at the bottom of every page; refusing there removes the cookies and stops any further collection. Refusing costs you nothing: every part of the website works the same either way.

13. Children

RedenFlow is not intended for children. You must be at least 16, or the age your country sets for consenting to online services if that is lower, to hold an account. We do not knowingly collect data from anyone below that age. If you believe a child has given us personal data, write to info@redenflow.com and we will delete it.

14. Changes to this notice

We may update this notice. The version and effective date at the top always say which one you are reading. Where a change materially affects you we will tell you by email to the address on your account, or in the application, before it takes effect.

15. How to contact us

Ender Akbiyik, trading as RedenFlow
Gaziemir, Izmir 35410, Türkiye
info@redenflow.com