Contents
- Who is responsible for your data
- What data we collect
- Why we collect it (legal basis)
- Third-party processors
- How we handle AI features
- How long we keep data (retention)
- Cookies and local storage
- Where your data is stored
- International data transfers
- How we secure your data
- Data breach notification
- Your rights under GDPR
- Your rights under CCPA/CPRA
- Your rights under UAE PDPL
- Children's privacy (COPPA)
- Do Not Track and Global Privacy Control
- Automated decision-making and profiling
- Changes to this Policy
- How to contact us
1. Who is responsible for your data
The data controller for personal data processed through the Service is Eng. Butti, trading as DiagraFlow, based in the United Arab Emirates. That is the person or entity that decides why and how your personal data is used, and whom you should contact with any privacy question or request. Contact details are in section 19.
Where you use the Service to process personal data of your own end-users (for example, names or emails you put inside a diagram you own on a Team workspace), you are the controller of that data and DiagraFlow acts as your processor. Enterprise customers can sign a separate Data Processing Agreement (DPA) that reflects this.
2. What data we collect
We deliberately keep this list short. Below is every category of personal data we currently collect, together with the specific fields and where they come from.
| Category | Specific fields | Source |
|---|---|---|
| Account identity | Email address, salted bcrypt hash of your password (never the plaintext), display name if you set one, account creation timestamp. | You, at signup. |
| Content you create | Diagrams (Mermaid source code and Yjs CRDT snapshots), whiteboard drawings, Markdown documents, comments and comment threads, uploaded images inside diagrams, workspace and folder names. | You, as you use the Service. |
| Workspace membership | The workspaces you belong to, your role within each workspace (owner, admin, editor, viewer), invitations you sent or received. | You and your workspace admin. |
| Session data | Session cookies (opaque signed tokens), device/browser type as reported by the User-Agent header, session creation and last-active timestamps, IP address at the time of session creation (for security review). | Your browser. |
| Billing metadata | Stripe customer ID, Stripe subscription ID, plan tier, seat count, invoice numbers, last four digits of the card and card brand as reported by Stripe. We do not store your full card number, expiry, or CVV. | Stripe. |
| AI usage counters | Number of hosted-credit AI calls you have made in the current 30-day rolling window, and the timestamp of the last call. | Our servers. |
| Operational logs | HTTP request logs (path, response code, duration, coarse IP), application error stack traces, security-relevant events (failed logins, password resets). Kept for a maximum of 30 days. | Our servers. |
| Support messages | The content of any email you send to us and our reply, held in our email account for as long as we may need it to answer follow-up questions or resolve a dispute. | You. |
We do not collect: your real-world name (unless you put it in your display name), home or business address, phone number, marketing preferences, precise geolocation, health data, biometric data, or "special-category" personal data as defined by the GDPR. We do not run any third-party analytics, ad networks, or session-replay tools on the site or in the app.
3. Why we collect it (legal basis)
Under the GDPR we need a legal basis for each purpose we process your personal data for. Ours are:
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account, storing and syncing your content, delivering all core features of the Service. | Contract — Art. 6(1)(b). Necessary to perform the agreement we have with you. |
| Charging your subscription, sending invoices, meeting our tax and accounting obligations. | Contract and legal obligation — Art. 6(1)(b) and 6(1)(c). |
| Detecting fraud and abuse, keeping the Service secure, investigating security incidents. | Legitimate interests — Art. 6(1)(f). Our interest in a working, un-abused product; balanced against the minimal data collected. |
| Answering support emails and other communications you initiate. | Legitimate interests and contract — Art. 6(1)(b) and 6(1)(f). |
| Sending transactional email — trial-ending reminder, receipt, password reset, security alert, incident notification. | Contract — Art. 6(1)(b). |
| Complying with a legal order, court process, or regulatory obligation. | Legal obligation — Art. 6(1)(c). |
We currently do not send marketing email and therefore do not rely on consent for that purpose. If we ever start, we will ask for consent first and give you a one-click way to withdraw it.
4. Third-party processors
We use a small set of third-party vendors ("sub-processors") to run the Service. Each has access only to the data listed below, and each is contractually bound to protect it.
| Vendor | What they do | Data they see |
|---|---|---|
| Stripe, Inc. (United States, Ireland) | Payment processing, invoicing, subscription lifecycle. | Your email, your name and billing address as you enter them into Stripe's checkout, your card details (Stripe stores these — we do not), your Stripe customer and subscription identifiers. |
| Resend, Inc. (United States, EU) | Transactional email delivery (once enabled). Sends receipts, password resets, and security alerts. | The recipient email, the subject and body of the message, and metadata about delivery. |
| OpenAI, Anthropic, DeepSeek — hosted-credit path | Generates AI diagrams when you spend a hosted credit. | The prompt you submit and the diagram response. We route through accounts configured to disable training on data where the provider offers that setting. |
| Hetzner Online GmbH (Germany, Finland) — after production migration | Cloud hosting for the application servers. | Encrypted disk volumes containing the application database and file uploads. Hetzner has no application-level access. |
| Neon, Inc. (United States, EU) — after production migration | Managed PostgreSQL database (planned). | All fields listed in section 2, stored encrypted at rest. |
We will maintain an up-to-date list of sub-processors on this page and give at least 30 days' notice before adding a new one that affects existing customers.
We do not sell, rent, or trade your personal data to any third party. We disclose data only to the processors above, to a competent authority when compelled by law (and, where lawful, only after notifying you), and to a successor in interest as part of a merger, acquisition, or sale of assets.
5. How we handle AI features
AI-assisted diagram generation is optional. When you use it, this is exactly what happens to your prompt:
5.1 Hosted AI credits
- Your prompt is sent from your browser to our backend over TLS.
- Our backend forwards it to the chosen model provider (currently OpenAI, Anthropic, or DeepSeek) using an API key that we own, configured under an organisation account where training on request data is disabled where the provider offers that setting.
- The provider returns the diagram source. We decrement your monthly credit counter and return the source to your browser.
- We do not log the prompt or the response in our systems beyond the immediate request. The provider's own retention policy applies to whatever they hold on their side; typical provider retention is 30 days for abuse review.
5.2 We do not train on your data
DiagraFlow does not train, fine-tune, or otherwise develop any machine-learning model on your prompts, diagrams, or any other content. We do not sell your prompts to a training pipeline. The only automated processing of the substance of your content is the model inference call you explicitly initiated.
6. How long we keep data (retention)
| Data | Retention |
|---|---|
| Live diagrams, whiteboards, docs, comments | Until you delete them or delete your account. |
| Version history — Personal plan | Rolling 90 days per diagram, then oldest snapshots are pruned. |
| Version history — Team plan | Rolling 365 days per diagram. |
| Version history — Enterprise plan | Unlimited, subject to your storage entitlement in the order form. |
| Encrypted AI API keys | Until you remove them from Settings, or account deletion. |
| Session cookies | Until you sign out, revoke the session in Settings, or 30 days of inactivity — whichever comes first. |
| Operational logs (request logs, error logs, security events) | Maximum 30 days, then rotated out. |
| Billing records (Stripe metadata, invoices) | As long as legally required under UAE tax and accounting law — typically at least 5 years from the date of the transaction. |
| Encrypted backups | Rolling 30 days, then overwritten. Deleted data may briefly persist in a backup snapshot until the snapshot rotates out. |
| Account after cancellation | Read-only for 30 days so you can export. After 30 days the account, its content, and its keys are permanently deleted. |
| Support email correspondence | Up to 3 years from the last message, then deleted. |
7. Cookies and local storage
We use a deliberately minimal set of cookies and browser storage. We do not use any advertising, analytics, or cross-site tracking cookies. No third-party tag manager, no Google Analytics, no Facebook pixel, no Hotjar-style session recorder.
| Name | Purpose | Duration |
|---|---|---|
diagraflow.sid |
Authentication session cookie. HTTP-only, Secure, SameSite=Lax. | 30 days rolling. |
diagraflow.csrf |
CSRF protection token paired with the session cookie. | Session lifetime. |
diagraflow.theme (localStorage; an older flowgram.theme value is migrated once) |
Remembers your theme choice (dark or light). A legacy diagraflow.theme value is read once, migrated to this key, and removed. |
Until you clear browser data. |
diagraflow.editor.* (localStorage / IndexedDB) |
Local draft cache for offline editing (PWA). | Until you clear browser data. |
All of the above are strictly necessary for the Service to function and are therefore exempt from the consent requirement under the ePrivacy Directive as implemented in EU member states. Because we set no non-essential cookies, we do not display a cookie consent banner.
8. Where your data is stored
Full transparency, updated as our infrastructure evolves:
- Current — early access / self-hosted phase. The application currently runs on a server located at the owner's premises in the United Arab Emirates. The database file is stored on that machine's encrypted disk. Uploads are stored in a local file directory. Traffic reaches you through an HTTPS-terminating reverse proxy.
- Planned production migration. We are migrating to a managed cloud stack: application servers on Hetzner Online GmbH (Germany or Finland, at your workspace's choice) and the database on Neon, Inc. (an EU-region Postgres deployment). Backups are encrypted with AES-256 and held in the same region. We will update this section, and email affected customers at least 30 days in advance, when the migration happens.
- Stripe processes billing data in the United States and the European Union under Stripe's own compliance regime (PCI-DSS Level 1).
- Model providers (OpenAI, Anthropic, DeepSeek) process AI prompts wherever their API is served from — typically the United States. Their privacy policies govern the request while it is with them.
9. International data transfers
If you are located in the European Economic Area, United Kingdom, or Switzerland, and your personal data is transferred outside those regions to a country that has not been the subject of an adequacy decision by the European Commission, we rely on the European Commission's Standard Contractual Clauses (2021/914) with the recipient. For transfers to the United States, we also rely, where available, on the recipient's certification under the EU-U.S. Data Privacy Framework.
For UAE data subjects, cross-border transfers are made in accordance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL"), typically relying on the recipient's contractual commitment to an equivalent level of protection.
You can request a copy of the safeguards in place for any specific transfer by writing to the contact address in section 19.
10. How we secure your data
We take security seriously. We do not claim any certification we don't actually hold — no SOC 2, no ISO 27001 today. What we do have:
- Transport encryption. All connections between you and our servers use TLS 1.2 or newer.
- Password storage. Passwords are salted and hashed with bcrypt. We do not store the plaintext and cannot recover it.
- Secret encryption at rest. Provider credentials and other secrets are encrypted with AES-256-GCM. The data-encryption key is held separately from the ciphertext.
- Disk encryption. Server disks are encrypted at the operating-system level.
- Isolation. Users can access only their own workspaces. Public share links are gated by unguessable cryptographic tokens.
- Session hygiene. Session cookies are HTTP-only, Secure, and SameSite=Lax. CSRF protection is on every state-changing request. Failed login attempts are rate-limited.
- Content-security defences. Rendered Markdown is sanitised with DOMPurify. Public share pages set a strict Content-Security-Policy header.
- Backups. Daily encrypted backups with a 30-day rotating window.
- Dependency updates. Third-party dependencies are patched on a regular cadence, with an out-of-cycle patch for critical vulnerabilities.
- Access. Production access is limited to the owner. There is currently no other engineering staff, contractor, or vendor with production credentials.
No system is perfectly secure. If you find a vulnerability, please write to
security@diagraflow.com
and give us a reasonable time to remediate before public disclosure.
11. Data breach notification
If we become aware of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, we will notify the competent supervisory authority (and, for EEA data subjects, the lead supervisory authority) without undue delay and, where feasible, within 72 hours of becoming aware of it, as required by Article 33 of the GDPR.
We will notify affected users directly, by email to the address on file, without undue delay when the breach is likely to result in a high risk to their rights and freedoms, as required by Article 34 of the GDPR. For UAE data subjects, we will additionally notify the UAE Data Office in accordance with the PDPL and its executive regulations.
12. Your rights under GDPR
If you are in the European Economic Area, United Kingdom, or Switzerland, you have the following rights over your personal data:
Get a copy of the personal data we hold about you.
Correct any inaccurate or incomplete data.
Ask us to delete your data. Where legally required to retain (e.g. tax records), we will explain what we must keep and for how long.
Pause our processing while a request is being handled.
Receive your data in a structured, commonly used, machine-readable format (JSON export from Settings → Account).
Object to processing based on our legitimate interests.
Where processing is based on consent, withdraw it at any time — with no effect on processing already carried out.
Contact your local supervisory authority (see edpb.europa.eu for the list).
You can exercise most of these rights directly in Settings → Account — export your data, delete your account, correct your email. For anything else, email the address in section 19. We will respond within 30 days and can extend to 60 days for complex requests with an explanation.
13. Your rights under CCPA/CPRA
If you are a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) gives you the following rights:
What categories of personal information we collected, the sources, the business purposes, and the categories of third parties we shared it with — all of which is set out in this Policy.
Receive a copy of the specific personal information we collected in the last 12 months.
Ask us to delete personal information we collected from you, subject to legal retention exceptions.
Correct inaccurate personal information we hold about you.
We do not sell or share personal information as those terms are defined by the CCPA. There is nothing to opt out of, but you have the right to make that request anyway.
We do not collect "sensitive personal information" as defined by the CPRA, so this right does not apply here in practice.
We will not deny you the Service, charge you a different price, or provide a different level of quality because you exercised a CCPA right.
You may designate an agent to make requests on your behalf, subject to reasonable verification.
Verified requests can be submitted to the email in section 19. We do not charge a fee for the first two requests in any 12-month period.
14. Your rights under UAE PDPL
If you are a resident of the United Arab Emirates, the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL") gives you:
Know the purpose, categories, recipients, and duration of processing of your personal data.
Request and receive your personal data in a structured, machine-readable format.
Correct inaccurate personal data.
Request deletion of your personal data, subject to legal retention exceptions.
Ask us to limit how we process your data.
Object to decisions based solely on automated processing that has a legal or similarly significant effect on you.
Withdraw consent where processing is based on consent.
Lodge a complaint with the UAE Data Office if you believe your rights have been violated.
To exercise these rights, contact us at the address in section 19. We will verify your identity, respond within the statutory time limits, and document our response.
15. Children's privacy (COPPA)
The Service is not directed to children under the age of 13. We do not knowingly collect personal information from anyone under 13, in accordance with the U.S. Children's Online Privacy Protection Act ("COPPA"). If you are a parent or guardian and you learn that your child under 13 has provided personal information to us, please contact us at the address in section 19. We will delete that information from our systems as quickly as we can, and, unless legally required to retain it, we will not use it for any purpose.
In jurisdictions where the age of digital consent is higher than 13 (for example 16 in some EU member states), we apply that higher local age of consent.
16. Do Not Track and Global Privacy Control
We do not use behavioural advertising, tracking pixels, or cross-site profiling technologies, so there is no tracking activity for a "Do Not Track" (DNT) header or a Global Privacy Control (GPC) signal to disable. We nevertheless treat a GPC signal from your browser as a valid opt-out of any sale or sharing of personal information for the purpose of the CCPA.
17. Automated decision-making and profiling
We do not make any decision that produces a legal or similarly significant effect on you solely by automated means. AI features in the Service produce diagram output; they do not make any decision about your account, your eligibility for a plan, your pricing, or anything else that affects you legally.
18. Changes to this Policy
We may update this Privacy Policy from time to time. When we do, we will change the "Last Updated" date at the top of this page. For material changes — for example, adding a new category of personal data, a new sub-processor, or a new purpose of processing — we will notify you in advance by email and/or a prominent in-app notice at least 30 days before the change takes effect.
Continued use of the Service after the effective date of any change constitutes your acceptance of the updated Policy. If you disagree, you may export your data and delete your account from Settings before the change takes effect.
19. How to contact us
To exercise any right described in this Policy, to ask a question, or to submit a data request, please write to:
DiagraFlow — Data Protection Contact
Attn: Eng. Butti
Email for privacy requests: privacy@diagraflow.com
Email for legal notices: legal@diagraflow.com
Email for security disclosures: security@diagraflow.com
Jurisdiction: United Arab Emirates
For faster handling of a rights request, please write from the email address on your account and describe the specific right you wish to exercise. If you write from a different address we may need to ask additional questions to verify your identity before acting.