Privacy Policy

ARX FLOW LLC (“ArxFlow,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our platform and services. Please read this policy carefully.

1. Information We Collect

1.1 Information You Provide Directly

We collect information you provide when you create an account, use our Services, or contact us, including:

• Account information: name, email address, company name, and password
• Billing information: payment card details (processed by Stripe; we do not store full card numbers), billing address
• Uploaded content: logos, design files, artwork, and other assets you upload to generate mockups or place orders
• Order information: product specifications, customization details, and order history
• Communications: messages you send to us via email or support channels

1.2 Information Collected Automatically

When you access our Services, we automatically collect certain technical information, including:

• Device and browser information: IP address, browser type and version, operating system, device identifiers
• Usage data: pages viewed, features used, time spent, clicks, and navigation patterns
• Cookie data: session cookies, preference cookies, and analytics cookies (see Section 5)
• Log data: server logs including access times, referring URLs, and error logs

1.3 Information from Third Parties

We may receive information about you from third-party services you connect to our platform, including:

• Shopify: store information, product data, and order data when you connect your Shopify store
• Stripe: payment confirmation and billing status information
• Google: if you sign in with your Google account, we receive your name, email address, and profile identifier from Google

1.4 Information from End Users

If you are a business using ArxFlow (“Client”), your end customers (“End Users”) may interact with ArxFlow-powered experiences embedded in your website or store. We collect End User data on your behalf as a service provider, including names, email addresses, uploaded design files, and order preferences. As a Client, you are responsible for ensuring you have appropriate consent from your End Users for this data collection.

You are the controller of that End User data and we are the processor. Section 13 of our Terms of Service sets out what each of us is responsible for, including how End User requests are handled and how long we keep the data.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the ArxFlow platform and Services
• Process transactions and send related billing information
• Generate AI mockups and production-ready outputs using your uploaded content
• Send administrative communications including account updates, security alerts, and support responses
• Analyze usage patterns to improve the platform and develop new features
• Monitor and prevent fraudulent, unauthorized, or illegal activity
• Comply with applicable legal obligations
• Respond to your inquiries and provide customer support

We do not sell your personal information to third parties. We do not use your data for advertising purposes on behalf of third parties.

3. How We Share Your Information

3.1 Service Providers

We share information with third-party service providers who help us operate our platform and deliver our Services. We share only the information each provider needs for the purpose listed below, and we do not authorize any of them to use it for their own purposes.

• Amplitude: product analytics and session replay. Receives usage events, a pseudonymous user identifier, and — on the ArxFlow website, not on merchant storefronts — a recording of the on-screen session.
• Google (Sign in with Google): account authentication. If you sign in with Google, Google processes the sign-in and returns your name and email address to us.
• Google Drive: order document storage. A copy of each order’s production document, which includes the customer name, email address, and shipping address, is filed to our order folder.
• Linear: issue tracking. When you submit a report or leave feedback, the text you write — and your email address, if you provide one — is copied into a tracking issue.
• Neon: database hosting. Our application database, which holds your account details, orders, uploaded content references, and any support reports you submit, is operated by Neon.
• OpenAI: AI image generation and mockup processing. Receives the artwork you upload and the design instructions you type. We do not send your name, email address, or any other account or customer identifier to OpenAI.
• Replicate: image background removal. Receives the generated design image only.
• Resend: email delivery. Receives order confirmation and fulfillment emails, including recipient name and email address, shipping address, order contents, and attached design files and documents.
• Sentry: error monitoring and performance diagnostics. Receives error reports, which may include your IP address, the request that failed, and a recording of the browser session in which an error occurred.
• Shopify: e-commerce integration and order management. Where you reach ArxFlow through a merchant’s Shopify store, store, product, and order information passes between ArxFlow and Shopify.
• Stripe: payment processing. Receives your email address, billing address, shipping address, and payment details. We do not store full card numbers.
• Vercel: platform hosting, file storage, and website analytics. Hosts our application and stores uploaded artwork, generated designs, order documents, and sent email bodies; its analytics product records page views and aggregate visitor information.

We also use GitHub for source code hosting and automated error triage. Error reports sent to GitHub contain diagnostic information only and are not intended to contain personal information.

3.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities, including courts and government agencies.

3.3 Business Transfers

If ArxFlow is involved in a merger, acquisition, or sale of all or a portion of its assets, your information may be transferred as part of that transaction. We will notify you via email and a prominent notice on our platform of any such change.

3.4 Protection of Rights

We may disclose information where we believe disclosure is necessary to protect the rights, property, or safety of ArxFlow, our users, or others.

4. Data Retention

We retain your personal information and uploaded files for as long as your account is active or as needed to provide our Services, and then for the periods described below.

Data we hold on behalf of a Client. Where we process End User data as a service provider, as described in Section 1.4, retention and deletion are governed by Section 13 of our Terms of Service. That section commits us to deleting or anonymizing End User data within 30 days of the Client’s account terminating, of our application being removed from the Client’s store, or of the Client asking us to.

Order and billing records. We keep the records of orders placed through the Services — including the name, email address, shipping address, and contents of each order — for as long as we need them to perform our agreement with you and to meet our tax, accounting, and fraud-prevention obligations. This applies whether or not the account that placed the order is still active.

Everything else. For information we hold in our own right — your account, billing, support, and usage information — we do not operate an automatic deletion schedule. We keep it while your account is active and delete it when you ask us to.

If you would like your data deleted, please contact us at systems@arxflow.com. We will process deletion requests within 30 days, subject to any legal obligations that require us to retain certain information.

Please note that even after deletion of your account, some information may be retained in backup systems for a limited period as required by applicable law or for legitimate business purposes such as fraud prevention.

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve our Services. Cookies are small text files stored on your device.

5.1 Types of Cookies We Use

• Essential cookies: Required for the platform to function. Cannot be disabled.
• Analytics and session-recording technologies: Used by Amplitude and Vercel Analytics to understand how our platform is used. Amplitude also records browser sessions on the ArxFlow website — what you clicked, navigated to, and viewed — associated with a pseudonymous identifier rather than an anonymous one. Text you type into form fields is masked before the recording leaves your browser, and the areas of the page that display your uploaded or generated artwork are excluded from the recording. Session recording is disabled for ArxFlow experiences embedded in a merchant’s store.
• Preference cookies: Store your settings and preferences to improve your experience.

5.2 Managing Cookies and Analytics

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of our Services. To opt out of product analytics and session recording, or to request that we delete analytics data associated with you, contact us at systems@arxflow.com.

6. Children’s Privacy

Our Services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without parental consent, we will take steps to delete that information promptly. If you believe we may have collected information from a child under 13, please contact us at systems@arxflow.com.

7. Data Security

We implement reasonable technical and organizational security measures designed to protect your information against unauthorized access, loss, misuse, or disclosure. These measures include encryption of data in transit, access controls, and regular security reviews.

Information we store is also encrypted at rest by the providers that hold it, as a standard feature of their platforms rather than a setting we configure: Neon, which operates our database, states that customer data is encrypted at rest using AES-256, and Vercel states that all files stored on Vercel Blob are encrypted at rest using AES-256.

However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your information. In the event of a data breach that affects your rights or interests, we will notify you as required by applicable law.

8. Your Privacy Rights

8.1 Access and Correction

You have the right to access the personal information we hold about you and to request correction of inaccurate information. You can update your account information directly in your dashboard or by contacting us at systems@arxflow.com.

8.2 Deletion

You have the right to request deletion of your personal information. To submit a deletion request, contact us at systems@arxflow.com. We will process your request within 30 days, subject to applicable legal requirements.

8.3 California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including:

• The right to know what personal information we collect, use, disclose, and sell
• The right to request deletion of your personal information
• The right to opt out of the sale of your personal information (note: we do not sell personal information)
• The right to non-discrimination for exercising your privacy rights

To exercise your CCPA rights, contact us at systems@arxflow.com with the subject line “CCPA Privacy Request.”

8.4 If You Reached Us Through a Store

If you used an ArxFlow-powered experience embedded in a business’s website or store, that business — not ArxFlow — decides what is collected from you and is who you should contact to access, correct, or delete your information. If you contact us instead, we will direct you to them and, where we can tell which business you reached us through, let them know you asked. We act on their instruction and will supply, delete, or anonymize what we hold within 30 days of their request.

9. Third-Party Links and Services

Our platform may contain links to third-party websites or services that are not operated by us. We have no control over the privacy practices of these third parties and are not responsible for their privacy policies. We encourage you to review the privacy policies of any third-party services you access through our platform.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and by posting the updated policy on our website with a new effective date. Your continued use of our Services after the effective date of any changes constitutes your acceptance of the updated policy.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

We will respond to all privacy inquiries within 30 days.