Privacy Policy
Last updated: October 16, 2026 • Effective Date: October 16, 2026
1. Introduction
At Adflow AI (accessible at adflowai.co, “we”, “us”, or “our”), we value the privacy and intellectual property of sellers, creators, and merchants who use our web platform and Telegram bot. This Privacy Policy outlines what information we collect, how it is processed and protected, and your rights concerning your personal and commercial data.
2. Information We Collect
Account Data: When registering, we collect your email address and an encrypted hash of your password. If accessing via Telegram, we collect your Telegram user ID, display name, and username to link your session and credit balance.
Uploaded Media & Product Photos: Photographs and reference images you upload to create catalog shots or lifestyle variations are stored in our secure Cloudflare R2 object storage.
Usage & Transaction Logs: We maintain a ledger of credit transactions, generation job execution times, preset configurations, and signed URL generation tokens.
Analytics (only with consent): If you allow analytics, Google Analytics 4 sets cookies such as _ga and records pages visited, approximate location, device/browser and referral source. If you decline, the analytics script is not loaded. You can change your choice by clearing this site's storage.
3. How Your Images & AI Data Are Handled
We Do Not Train Public AI Models on Your Photos
Your uploaded source product images and output versions belong exclusively to you. We do not sell, scrape, or feed your proprietary product photos into public foundation models. Image inference is performed strictly on demand to fulfill your requested generation jobs.
4. Data Storage & Edge Infrastructure Security
Adflow AI operates natively on Cloudflare Workers, Cloudflare D1 (encrypted SQLite edge database), and Cloudflare R2 (AES-256 encrypted storage). All network transmissions are strictly encrypted in transit using modern TLS 1.3 encryption. Media assets are protected using signed, time-limited content tokens to prevent unauthorized public access.
5. Third-Party Services
We use the following processors to deliver the service:
- Cloudflare Inc.: CDN, edge compute, D1 database, R2 object storage and Workers AI fallback.
- Google (Gemini API): image and copy generation. Uploaded reference images and prompts are sent to the model only to fulfil your request.
- ToAPIs: image/video generation and reference-image hosting when that provider is enabled.
- OpenRouter: text/image fallback when configured.
- Telegram Bot API: account linking, photo delivery and Telegram Stars payments.
- Google OAuth and Google Analytics 4: optional sign-in and consented analytics.
- Resend: transactional email for verification and password reset.
These providers may process data outside your country. We choose providers with contractual and security commitments appropriate to the service; contact us for the current subprocessor list.
6. Data Retention & Deletion Rights
We keep account, project and ledger records while your account is active. You can request deletion of a project, all generated assets, or your whole account by emailing privacy@adflowai.co from the account email. We aim to action verified requests within 30 days, subject to records we must keep for tax, fraud prevention or legal reasons. Self-serve asset deletion is not available in the studio yet; the email request is the supported path today.
7. Contact the Privacy Team
If you have questions about this policy or wish to exercise your data rights (GDPR/CCPA), reach out to: