Privacy and data

Privacy Policy

This policy explains how StockMetaFlow processes account information, uploaded images, generated metadata, billing records, and service usage.

Effective date: 15 October 2026

1. Data controller and contact

StockMetaFlow is a trade name operated by Oleksii Telnov as an individual operator based in Alicante, Spain. The operator is the controller of personal data processed to provide StockMetaFlow.

Privacy requests can be sent to privacy@stockmetaflow.com. Product and account support is available at support@stockmetaflow.com. A public street address and telephone number are not displayed on the service.

2. Data we process

• Account details such as email address, display name, profile image, authentication provider, verification state, and security events.
• Workspace data such as batches, settings, selected platforms, generation options, review state, and export history.
• Uploaded images, embedded IPTC or XMP metadata, previews, reference/example libraries, generated metadata, and export files.
• Subscription, credit, invoice, payment-reference, storage, and quota records. Stripe processes full payment-card details; StockMetaFlow does not store them.
• Technical information needed for security and operation, including request logs, browser and device information, error diagnostics, and consent choices.
• Messages and attachments you send to support, plus marketing preferences where you separately opt in.

3. Why we use data

• To create and secure accounts, authenticate users, and provide the workspace under our contract with you.
• To upload, store, analyze, generate, review, and export metadata requested by you.
• To operate subscriptions, credits, storage limits, billing, fraud prevention, and accounting obligations.
• To protect the service, investigate misuse, recover interrupted batches, and improve reliability based on legitimate interests.
• To send required service messages and optional product updates where you have consented.

4. Service providers and international transfers

StockMetaFlow uses Supabase for authentication and database services, Cloudflare R2 for private object storage, OpenAI for requested AI-assisted metadata generation, Stripe for payment processing, Resend for transactional email, Vercel for the public website, and a managed runtime provider for API and worker execution. These providers process only the data needed for their services and may use applicable contractual or legal safeguards for transfers outside the EEA.

5. Uploaded content and AI processing

Images and selected source metadata are sent for AI processing only when you start a generation action. StockMetaFlow stores the resulting metadata and workflow state so you can review, edit, and export it. Do not upload content you are not entitled to process or content containing unnecessary sensitive personal data.

6. Storage and retention

Original-file retention, storage quota, export history, and batch limits depend on the selected plan and are shown before purchase. Archiving a batch may remove originals and old artifacts while keeping metadata and compact previews. Account and workspace records are kept while needed to provide the service; billing, security, and accounting records may be kept longer where required by law or for fraud prevention and dispute handling.

7. Cookies and browser storage

Essential cookies and browser storage maintain authentication, security, interface preferences, and your cookie choices. Optional analytics or marketing technologies remain disabled unless they are described and you allow them through Cookie Settings.

8. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or object to processing. You may withdraw optional consent without affecting earlier lawful processing and lodge a complaint with your local data-protection authority, including the Spanish Data Protection Agency where applicable.

9. Security and policy changes

StockMetaFlow uses account controls, row-level database policies, private object storage, time-limited file access, and provider security controls. No system is risk-free. Material policy changes will be published here with an updated effective date.