1. Controller and contacts

For website, support and software processing, the controller is Amine Elalame, reachable at hello@preflightflow.com and 8 bis rue Abel, 75012 Paris, France. Lemon Squeezy processes order, payment, tax and subscription data as Merchant of Record under its privacy policy.

2. Data processed

• Website and commercial journey: PostHog Cloud EU receives a random pseudonymous identifier limited to the session, used pages and controls, campaign source and operating system. Payment events include the plan, billing interval and commercial status without billing contact details. The desktop app sends no usage telemetry to PostHog. No video recording, session replay, PDF, filename, path, report content, license key or contact detail is sent. The host may separately log requests required to deliver and secure the site.
• Free and trial: pseudonymous SHA-256 device fingerprint, installation-specific public key, random token retained server-side only as a hash, operating system, app version, monthly period and consumed-job count, plus trial start, expiry and last-validation dates. Short-lived, one-time challenges authenticate the app and are retained only as hashes. An HMAC-pseudonymised network signal limits automated mass claims. Raw IP addresses, raw hardware identifiers, e-mail addresses and PDFs are not retained in this register.
• Support: email, identity, organisation, message content and technical information you choose to send.
• Licensing: licence key, instance ID, workstation name, product and variant IDs, status and validation dates. The key and instance ID are also stored locally in the operating-system credential vault.
• Orders: Lemon Squeezy collects contact, billing and payment information. PreflightFlow may access order and licence details needed for support and commercial administration; it does not receive full card details.

3. Purposes and legal bases

Provide the requested trial and prevent abusive resets

Performance of the trial terms and legitimate interest in protecting the software, using minimised pseudonymous data.

Supply the licence and support

Contract performance.

Validate workstations and prevent key abuse

Contract performance and legitimate interest in protecting the software.

Keep commercial evidence and comply with law

Legal obligations and establishment or defence of claims.

Secure the site and diagnose errors

Legitimate interest in providing a safe service.

PreflightFlow does not make decisions producing legal effects solely through automated processing of personal data.

4. Recipients and transfers

Access is limited to authorised PreflightFlow personnel and, as needed, the hosting and email providers and Lemon Squeezy/Stripe. Lemon Squeezy is part of Stripe and operates in jurisdictions including the United States; its policy describes safeguards for international transfers. PreflightFlow sends no production PDF to these recipients.

5. Retention

• Pseudonymous Free/trial register: three years after last activity or expiry to prevent repeated resets; this period is reviewed regularly.
• Authorisation challenges: no more than two minutes. Pseudonymous network signals used to prevent mass claims: no more than ninety days.
• Technical fingerprints of Lemon Squeezy licence events: no more than three years to prevent replay of the same event; they contain no PDF or card data.
• Licence data: for the subscription, then as reasonably required for fraud prevention and proof of entitlement.
• Support: until resolution, then no more than three years after the last exchange unless law or a dispute requires longer.
• Accounting and transaction information available to the publisher: for the applicable statutory period, generally ten years for French accounting records.
• Hosting logs: a short period configured with the host and documented before launch.

6. Your rights

Subject to GDPR conditions, you may request access, correction, erasure, restriction, portability or object to processing. Email hello@preflightflow.com; identity evidence is requested only where there is reasonable doubt. You may complain to the French CNIL. For data controlled by Lemon Squeezy, use the contacts in its privacy policy.

7. Cookies

No advertising or analytics cookie is set. PostHog automatically measures the current journey with an in-memory identifier that is discarded when the page closes. No session replay is enabled. The desktop application sends no usage telemetry to PostHog. Lemon Squeezy checkout and portal are third-party sites and may use their own cookies under their notices.

8. Security and changes

Proportionate measures protect access, keys and network exchanges. No system is infallible; incidents presenting risk will be handled and notified as required. Changes are dated and material changes will be brought to affected people’s attention where necessary.