1. Who we are, and the short version
Lazy Flow decides how and why your personal data is used (the “controller”). Contact: illia@lazy-flow.com.
We collect the minimum needed to sell you a workspace and look after you afterwards. We do not sell or share your personal data, we run no advertising trackers, and workspaces run on your own machine: we never see what is inside your folders.
2. Where things stand today
Right now this website has no accounts and no checkout, and it runs no analytics. Apart from the technical data any web host handles to serve a page, we collect nothing else about visitors. If you email us, we hold your message and address so we can reply. The sections below describe what we collect when purchases are available, and we will publish a new version of this policy before that data is collected.
3. What we collect when you buy, and why
Your email address, to send you your download link and order confirmation. Purchase records (what you bought, when, for how much), so we can verify your purchase and handle support. Payment details, which you enter directly with Stripe: we never receive or store your full card details.
Download activity: when a link was sent and used, and the IP address it was used from. We keep this to prove delivery, resolve delivery-failure refund requests and defend against unwarranted payment disputes.
Support messages you send us, for as long as needed to deal with your request and any follow-up.
Delivered files may carry an opaque order reference that does not contain your name or email.
4. Our legal bases (UK and EU GDPR)
Contract: handling your order and delivering your product. Legitimate interests: keeping delivery logs to resolve disputes and defend against fraudulent chargebacks, and answering your support requests. Legal obligation: keeping transaction records for tax and accounting. Consent: marketing email, if we offer it, which is always a separate choice, can be withdrawn at any time, and is never required to buy.
5. Who we share data with
We use these providers to run the service, and each receives only what it needs: Stripe (payments); Supabase (our database and any accounts); Cloudflare (hosting and file delivery); Resend (sending transactional email such as your download link); and Google Workspace (our support mailbox, which holds the messages you send us).
We do not sell your personal data and we do not share it for cross-context behavioural advertising. If that ever changes, we will update this policy and give you a way to opt out first.
6. International transfers
Some of these providers process data outside the UK and EU. Where they do, the transfer is covered by safeguards such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.
7. How long we keep data
Transaction records: six years, because UK tax rules require it, even if you ask us to delete the rest. Download and delivery logs: 18 months, which covers the card-dispute window and any follow-up. Support messages: until your request is resolved and any follow-up period has passed. Other data, such as marketing consent: until you withdraw it or ask us to delete it.
8. Your rights
You can ask us to give you a copy of your data, correct it, delete it, send it to you in a portable format, restrict or object to how we use it, or withdraw consent. Email us and we will reply within one month; for a complex request we may extend that by up to two further months, and we will tell you if so.
Deletion is not absolute: we will delete what we can, but we must keep transaction records for the period in section 7, and may keep the minimum needed to enforce the Product Licence Terms against a confirmed breach.
9. US state privacy rights
If you live in California, Virginia, Colorado, Connecticut, Texas or another US state with a privacy law, you have the rights in section 8 plus the right to opt out of the sale or sharing of your personal data for targeted advertising and profiling, and the right not to be treated differently for using your rights. We do not sell or share personal data in those senses. “Share” here has the meaning it has in the California Consumer Privacy Act: disclosing personal data for cross-context behavioural advertising.
In the last 12 months we have collected identifiers (such as your email address and IP address) and commercial information (purchase records) for the purposes above, and disclosed them to the providers listed in section 5 for business purposes only.
You can use an authorised agent to make a request, and we will verify the agent’s authority. If we decline a request you can appeal by replying to our decision email, and we will respond to the appeal within 45 days.
10. Children
Our products are for adults: you must be at least 18, or have a parent or guardian’s permission, to buy. We do not knowingly collect personal data from children under 13. If you think a child has given us personal data, tell us and we will delete it.
11. Cookies
Our Cookie Policy lists what the site stores on your device and lets you change your choice at any time. We never use advertising storage.
12. Automated decisions
We do not make automated decisions about you that have legal or similarly significant effects, and we do not profile you.
13. Complaints
Please tell us first so we can put things right. UK residents may complain to the Information Commissioner’s Office (ico.org.uk). If you are in the EU, you may complain to the data-protection authority in your country of residence.
14. Security
We rely on our providers’ security and follow reasonable practices to protect the data we hold, but no system is completely secure.
15. Changes to this policy
We will post any change here with a new version number and date, and tell you by email if the change is significant and we hold your address.