Privacy Notice

1. Who we are

This Privacy Notice is issued by Tribbu ("Tribbu", "we", "us"), the operator of CreatrFlow OS (the "Service"). Tribbu acts as the data controller for personal data processed in connection with the Service.

2. Personal data we collect

Account data: email address, login credentials, display name.
Profile data: any information you add to your profile (e.g. avatar, preferences).
Content data: workflows, prompts, and assets you create in the builder.
Support data: messages and attachments you send us.
Usage and device data: log records, pages viewed, browser type, IP address, cookies and similar identifiers.
Billing-related data: Paddle collects payment details directly; we receive transaction metadata only (order ID, amount, status, country).

3. Purposes and legal bases

Provide the Service (contract): create your account, deliver the builder, store the workflows you save.
Generate your workflow (contract): workflows, weekly plans, post ideas and prompt packs are generated using built-in rules in your browser or on our server. This generation process does not send your answers to an AI model provider.
Optional AI chat assistant (contract): when you use the optional AI chat assistant, the conversation history from that chat is sent through the Lovable AI Gateway to an AI model provider. Builder answers and saved workflows are not automatically included, but anything you type or paste into the chat is included.
Submit to your tools (contract, at your request): if you use "Submit to your tools," the platform, scheduled time, title, notes and your account ID are sent to the webhook address you provide.
Process orders and entitlements (contract): unlock paid features after a successful purchase and revoke access after a refund.
Transactional and service emails (contract): welcome messages, purchase confirmations, refund notices, security alerts.
Security and fraud prevention (legitimate interests / legal obligation).
Customer support (contract / legitimate interests).
Compliance with law (legal obligation).

We do not currently send marketing emails or use third-party advertising or analytics cookies.

4. How we share your data

We share personal data only with the following categories of recipients:

Paddle.com Market Ltd. — our Merchant of Record. Paddle processes payments, handles billing, taxes, refunds, invoicing and related customer service. See Paddle's privacy notice for details.
Lovable — hosts the Service and the database, and provides the AI Gateway that routes chat assistant conversations (only) to an underlying AI model provider to produce a reply. Tribbu itself does not use your chat messages to train models; we have not verified, and do not make any statement about, how the AI model provider retains or uses them.
Webhook destinations you choose — such as Zapier, Make or n8n, only when you use "Submit to your tools."
Our email delivery provider for transactional and service messages.
Professional advisers (legal, accounting) under confidentiality.
Authorities where required by law or to protect rights and safety.

5. International transfers

Where personal data is transferred outside your country (including outside the UK/EEA), we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

6. Retention

We keep personal data for as long as your account is active and for as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. When data is no longer needed it is deleted or anonymised.

7. Your rights

Depending on your jurisdiction you have the right to:

Access the personal data we hold about you.
Request correction, deletion, or restriction of processing.
Object to processing or withdraw consent.
Receive your data in a portable format.
Lodge a complaint with your supervisory authority.

To exercise any of these rights, contact us at support@creatrflowos.com. We respond within one month.

8. Security

We implement appropriate technical and organisational measures, including encryption in transit, access controls, and least-privilege practices, to protect personal data.

9. Cookies and local storage

We use strictly necessary cookies and browser storage (including sessionStorage) to keep you signed in and to operate the builder. We do not set advertising cookies and do not currently use third-party analytics cookies. If that changes, we will update this notice and ask for your consent where required.

10. Contact

Tribbu — support@creatrflowos.com.