Privacy Policy

Mixflow AI Privacy Policy

Last updated: February 8, 2026

Introduction

LLL Ventures, LLC (“We”, “Us”, “Our”) is the developer and provider of the Mixflow AI software service (“Service”), accessible at mixflow.ai. This Privacy Policy explains the information that we collect through our Service, how we use that information, and what choices you have.

Privacy is a fundamental human right. We are committed to protecting the privacy of our users. We do not monetize your data and instead seek to fulfill our company mission by delivering a great product and service. Our commitment to privacy and data protection is reflected in this Privacy Policy which describes how we collect and process “personal information” that identifies you, like your name or email address. Any other information besides this is “non-personal information.” If we store personal information with non-personal information, we’ll consider that combination to be personal information.

References to our “Services” in this statement include our website, apps, and other products and services. This statement applies to our Services that display or reference this Privacy Policy. Third-party services that we integrate with are governed under their own privacy policies.

Information We Collect

We collect the following types of information through our Service:

Account Information:

When you create an account, we collect your name, email address, and payment information (processed by our third-party payment provider, Stripe). If you sign in using a third-party authentication provider (such as Google or GitHub), we receive your name and email address from that provider. We do not store your full credit card number on our servers.

User-Uploaded Content and Conversations:

When you use our Service, you may upload files, documents, images, and other content (“User Content”) for processing by AI models. We also collect the prompts, messages, and instructions you provide to the AI models, as well as the AI-generated responses (“Conversation Data”). We store this content to provide the Service. See “How We Handle Your Uploaded Files” below for details.

Usage Data:

We automatically collect information about how you interact with the Service, including pages visited, features used, timestamps, and general usage patterns.

Device and Browser Information:

We collect device type, operating system, browser type, IP address, and similar technical information when you access the Service.

How We Handle Your Uploaded Files

Because our Service processes your uploaded files with AI, we want to be transparent about how that works:

Storage: Your uploaded files are stored on our servers (hosted on cloud infrastructure in the United States) for as long as they are needed to provide the Service to you. Files are encrypted at rest and in transit.
AI Processing: Your files are sent to third-party AI model providers for processing. See “Third-Party AI Providers” below for details on which providers we use.
No Training: We do not use your uploaded files to train our own AI models. We require that the third-party AI providers we work with do not use your data for training their models either (see their respective policies linked below).
Access: Your files are only accessible to you through your account. Our employees do not access your files except when necessary to provide technical support at your request, to investigate potential violations of our Terms, or when required by law.
Deletion: When you delete a file from your account, it is removed from our active systems. See “Account Deletion and Data Removal” below for full details.

Third-Party AI Providers

To provide our AI-powered features, we send your content to the following third-party AI providers for processing:

OpenAI — Used for text generation, analysis, and conversational features. OpenAI Privacy Policy. We use OpenAI’s API, which does not use submitted data for training by default.
Anthropic — Used for text generation, analysis, and conversational features. Anthropic Privacy Policy. Anthropic’s API does not use submitted data for model training.
Google (Gemini) — Used for text and multimodal processing. Gemini API Terms. Google’s paid API does not use submitted data for model training.

We may add or change AI providers over time. We will update this section and notify you via email or in-app notice when material changes to our AI provider list occur. All providers are selected based on their data handling and privacy commitments through their API terms of service.

How We Use Information

We use the information we collect through our Service for the following purposes:

Provide, operate, maintain, and improve the Service.
Process your uploaded content using AI models as part of the Service’s core functionality.
Enable you to access and use the Service.
Process transactions and send related billing information.
Respond to your comments, questions, and requests and provide customer service.
Monitor and analyze usage trends to improve the Service.
Send you technical notices, updates, and security alerts.
Detect, investigate, and prevent fraudulent or unauthorized activity and security incidents.

Account Deletion and Data Removal

You may request deletion of your account and all associated data at any time by contacting us at contact@mixflow.ai.

When you delete your account:

Account data: Your account information (name, email, preferences) is permanently deleted from our systems within 30 days.
Uploaded files: All files you uploaded are permanently deleted from our active servers within 30 days. Copies may persist in encrypted backups for up to 90 days before being automatically purged.
Conversation data: Your prompts, messages, and AI-generated responses are permanently deleted within 30 days.
Usage logs: Anonymized, aggregated usage data that cannot identify you may be retained for analytics purposes.
AI provider data: Data sent to third-party AI providers for processing is subject to their respective retention policies (see links above). API-submitted data is generally not retained by these providers beyond the processing request, per their API terms.
Legal obligations: We may retain certain information as required by law (e.g., billing records for tax purposes).

Microsoft Clarity

We use Microsoft Clarity to understand how you interact with our website. This includes capturing behavioral metrics, heatmaps, and session replay to help us identify usability issues and improve the Service. Session replay may capture mouse movements, clicks, scrolls, and form interactions on our website. Sensitive fields (such as passwords and payment information) are automatically masked and not recorded. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.

Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect information about your browsing activities. We implement Google Consent Mode and Microsoft Clarity Consent Mode to ensure these technologies respect your privacy choices.

When you first visit our website, you will see a cookie consent banner that allows you to accept or reject non-essential cookies. You can change your preferences at any time by clicking “Cookie Settings” in our website footer. For detailed information about the cookies we use, please see our Cookie Policy.
We maintain records of your consent preferences, including timestamps of when consent was given, modified, or withdrawn, to demonstrate compliance with applicable data protection regulations.

Google Consent Mode

We use Google Consent Mode to communicate your cookie preferences to Google services. When you decline cookies:

Google Analytics will not store identifying cookies
Personalized advertising will be disabled
Google may still use privacy-preserving conversion modeling

Data Retention

We retain personal data for as long as your account is active or as needed to provide you the Service. Below are our general retention periods:

Account information: Retained while your account is active, deleted within 30 days of account deletion.
Uploaded files and conversation data: Retained while your account is active, deleted within 30 days of account deletion (backups purged within 90 days).
Usage and device data: Retained for up to 24 months, then anonymized or deleted.
IP addresses: Retained in server logs for up to 90 days for security purposes.
Billing records: Retained as required by applicable tax and financial reporting laws.

Data Security

We implement security measures designed to protect your personal information, including:

Encryption of data in transit (TLS/SSL) and at rest.
Access controls limiting employee access to user data.
Regular security reviews of our infrastructure and practices.

No method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Law Enforcement and Legal Requests

We may disclose your personal information to law enforcement authorities, government agencies, or other third parties if we are required to do so by law, subpoena, court order, or other legal process. We may also disclose your information if we believe in good faith that disclosure is necessary to: (i) comply with applicable law or legal obligations; (ii) protect the rights, property, or safety of the Company, our users, or the public; or (iii) detect, prevent, or address fraud, security, or technical issues.

Where legally permitted, we will make reasonable efforts to notify you of any legal request for your data before making a disclosure, so that you may seek a protective order or other appropriate remedy. We will not voluntarily provide user data to government authorities without legal process, except in emergency situations involving imminent danger of death or serious physical injury.

Third-Party Links

Our Service may contain links to third-party websites. Any access to and use of such linked websites is not governed by this Policy, but instead is governed by the privacy policies of those third-party websites. We are not responsible for the information practices of such third-party websites.

Children’s Privacy

Our Service is not intended for anyone under 16 years of age. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will take steps to delete that information promptly. If you believe we have collected information from a child under 16, please contact us at contact@mixflow.ai.

Special Category and Sensitive Data

We do not intentionally collect or process “special categories of personal data” as defined under GDPR Article 9, which includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning a person’s sex life or sexual orientation. If you upload content containing such data to the Service for AI processing, you do so at your own risk and are solely responsible for ensuring that you have a valid legal basis for processing such data under applicable law.

International Data Transfers

Our Service is hosted in the United States. If you are accessing the Service from outside the United States, including from the European Economic Area (EEA), United Kingdom, or Switzerland, please be aware that your information will be transferred to, stored, and processed in the United States.

We rely on the following legal mechanisms to ensure that your data is adequately protected when transferred outside the EEA:

Standard Contractual Clauses (SCCs): Where required, we enter into European Commission-approved Standard Contractual Clauses with our service providers and subprocessors to ensure that your personal data receives an adequate level of protection when transferred outside the EEA.
EU-US Data Privacy Framework: Certain third-party providers we use (including Google and Microsoft) have self-certified under the EU-US Data Privacy Framework, which the European Commission has recognized as providing adequate data protection.
Contractual safeguards: We require all third-party providers who process personal data on our behalf to maintain appropriate technical and organizational security measures and to process data only in accordance with our instructions.

We conduct Transfer Impact Assessments (TIAs) as recommended by the European Data Protection Board to evaluate the level of data protection in recipient countries and implement supplementary measures where necessary.
For more information about the safeguards we have in place, or to obtain a copy of the relevant SCCs or TIAs, please contact us at contact@mixflow.ai.

Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following lawful bases:

Contractual necessity (Article 6(1)(b)): Processing your account information and uploaded content is necessary to provide the Service you signed up for.
Legitimate interests (Article 6(1)(f)): We process usage data and device information to maintain, secure, and improve the Service. Our legitimate interests do not override your fundamental rights and freedoms.
Consent (Article 6(1)(a)): We rely on your consent for non-essential cookies, analytics tracking (Microsoft Clarity, Google Analytics), and marketing communications. You can withdraw consent at any time.
Legal obligation (Article 6(1)(c)): We may process data to comply with applicable legal requirements (e.g., tax record-keeping, responding to lawful government requests).

Your Rights Under GDPR

If you are located in the European Economic Area (EEA) or the United Kingdom, you have certain data protection rights under the General Data Protection Regulation (GDPR) and the UK GDPR, including:

Right to access: You can request a copy of the personal data we hold about you.
Right to rectification: You can request that we correct inaccurate personal data.
Right to erasure: You can request that we delete your personal data.
Right to restrict processing: You can request that we restrict the processing of your data.
Right to data portability: You can request a copy of your data in a commonly used, machine-readable format (such as JSON or CSV). We will provide the requested data within 30 days of a verified request.
Right to object: You can object to our processing of your personal data based on legitimate interests. You have an absolute right to object to the processing of your personal data for direct marketing purposes at any time.
Right to withdraw consent: Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
Right to lodge a complaint: You have the right to lodge a complaint with your local data protection supervisory authority if you believe your data protection rights have been violated. A list of EU supervisory authorities can be found at edpb.europa.eu. UK residents may contact the Information Commissioner’s Office (ICO).

To exercise any of these rights, please contact us at contact@mixflow.ai. We will respond to your request within one calendar month of receipt. This period may be extended by two further months where necessary, taking into account the complexity and number of requests.

Your Rights Under CCPA/CPRA

If you are a California resident, you have certain rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA):

Right to know: You can request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected it, the business purposes for collecting it, and the categories of third parties with whom we share it.
Right to delete: You can request that we delete the personal information we have collected from you, subject to certain exceptions.
Right to correct: You can request that we correct inaccurate personal information we maintain about you.
Right to opt out of sale/sharing: We do not sell your personal information, and we do not share your personal information for cross-context behavioral advertising purposes.
Right to limit use of sensitive personal information: We do not use or disclose sensitive personal information for purposes beyond what is necessary to provide the Service.
Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise your CCPA/CPRA rights, please contact us at contact@mixflow.ai. We will verify your identity before processing your request by matching the information you provide with the information we have on file. You may also designate an authorized agent to make a request on your behalf.

Categories of Personal Information Collected (CCPA)

The following table describes the categories of personal information we have collected in the preceding 12 months, as defined by the CCPA:

CCPA Category	Examples	Collected	Business Purpose
Identifiers	Name, email address, IP address, account ID	Yes	Provide and maintain the Service
Commercial information	Billing records, subscription history, transaction details	Yes	Process payments and manage subscriptions
Internet or electronic network activity	Usage data, browsing history on the Service, device/browser information	Yes	Improve the Service, analytics, security
Geolocation data	IP-derived approximate location	Yes	Security, compliance, analytics
Professional or employment-related information	Employer name (if provided during signup)	Yes (if provided)	Account administration
Inferences	Usage patterns, feature preferences	Yes	Improve the Service
Sensory data	Files, images, audio uploaded by you	Yes (user-uploaded)	Provide AI processing features

We do not collect the following CCPA categories: characteristics of protected classifications, biometric information, or education information.

Your Rights Under Other US State Privacy Laws

If you are a resident of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), or another US state with a comprehensive consumer privacy law, you may have similar rights to those described above under CCPA/CPRA, including:

Right to access: You can request confirmation of whether we are processing your personal data and request a copy of that data.
Right to correct: You can request that we correct inaccurate personal data.
Right to delete: You can request that we delete personal data we have collected from or about you.
Right to data portability: You can request a copy of your personal data in a portable, readily usable format.
Right to opt out: You can opt out of targeted advertising, the sale of personal data (we do not sell personal data), and profiling in furtherance of decisions that produce legal or similarly significant effects.
Right to appeal: If we deny your privacy request, you have the right to appeal our decision. To submit an appeal, contact us at contact@mixflow.ai with the subject line “Privacy Request Appeal.” We will respond to your appeal within the timeframe required by applicable law. If your appeal is denied, you may contact your state’s Attorney General.

To exercise any of these rights, please contact us at contact@mixflow.ai. We will verify your identity before processing your request.

Do Not Track and Global Privacy Control

Some browsers include a “Do Not Track” (DNT) feature that signals to websites that you do not want your online activity tracked. Because there is currently no universally accepted standard for how to respond to DNT signals, our Service does not currently respond to DNT browser signals.

However, we do honor Global Privacy Control (GPC) signals as required under the CCPA/CPRA. If your browser or device sends a GPC signal, we will treat it as a valid opt-out of the sale or sharing of your personal information. You can learn more about GPC at globalprivacycontrol.org.
You can also manage your tracking preferences through our cookie consent banner and the opt-out options described in “Your Choices” below.

Automated Decision-Making

Our Service uses AI models to process your uploaded content and generate outputs. This processing is performed at your direction as a core feature of the Service — it is not used to make automated decisions that produce legal effects or similarly significant effects concerning you (such as credit decisions, hiring decisions, or access to services). If we ever introduce features that involve automated decision-making with significant effects, we will update this policy and, where required by GDPR Article 22, provide you with the right to obtain human intervention, express your point of view, and contest the decision.

Your Choices

You have several choices available when it comes to your personal information:

Account: You can update your account information or request account deletion at any time by contacting us.
Cookies: You can manage your cookie preferences using our cookie consent banner or by clicking “Cookie Settings” in our website footer. You can also configure your browser to reject cookies, though this may affect site functionality.
Analytics Opt-Out: You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.
Promotional Communications: You may opt out of receiving promotional messages from us by following the instructions in those messages.

Data Breach Notification

In the event of a data breach that affects your personal information, we will:

Notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required under GDPR (where applicable), unless the breach is unlikely to result in a risk to the rights and freedoms of individuals.
Notify affected users via email without undue delay where the breach is likely to result in a high risk to your rights and freedoms.
Comply with applicable US state data breach notification laws, which may require notification within specific timeframes depending on the state.
Provide details about the nature of the breach, the data affected, and the steps we are taking to address it.
Provide recommendations for steps you can take to protect yourself.

Subprocessors

In addition to the AI providers listed above, we use the following third-party service providers (subprocessors) who may process your personal data on our behalf:

Amazon Web Services (AWS): Cloud hosting and infrastructure. AWS stores and processes data on our behalf under a data processing agreement. AWS Privacy Policy.
Google Cloud Platform (GCP): Cloud hosting and infrastructure. GCP stores and processes data on our behalf under a data processing agreement. Google Cloud Privacy Notice.
Microsoft Azure: Cloud hosting and infrastructure. Azure stores and processes data on our behalf under a data processing agreement. Microsoft Privacy Statement.
Vercel: Web hosting and deployment platform. Vercel stores and processes data on our behalf under a data processing agreement. Vercel Privacy Policy.
Stripe: Payment processing. Stripe processes your payment information directly and is PCI-DSS compliant. Stripe Privacy Policy.
Google Analytics: Website analytics (with your consent). Google Privacy Policy.
Google Ads: Advertising and conversion tracking (with your consent). Google Privacy Policy.
Microsoft Clarity: Website behavioral analytics (with your consent). Microsoft Privacy Statement.

We require all subprocessors to process your data in accordance with our instructions and applicable data protection laws. We will notify you of material changes to our subprocessor list by updating this page and, where required, providing notice via email or the Service.

Data Processing Agreements

For enterprise customers or any user who requires one, we can provide a Data Processing Agreement (DPA) that governs how we process personal data on your behalf in compliance with GDPR and other applicable data protection regulations. To request a DPA, please contact us at contact@mixflow.ai.

Data Protection Contact

We have not appointed a Data Protection Officer (DPO) under GDPR Article 37, as our core activities do not currently meet the thresholds requiring such appointment. All privacy-related inquiries, data subject access requests, and data protection concerns should be directed to our privacy team at contact@mixflow.ai. We will review this position as our data processing activities evolve and will appoint a DPO if required by applicable law.

EU Representative

As we are established in the United States and not in the European Union, and we offer services to individuals in the EEA, we are required to appoint a representative in the European Union in accordance with Article 27 of the GDPR. We are in the process of designating an EU representative and will update this section with their name and contact details once appointed. In the interim, you may direct any inquiries regarding our data processing practices to contact@mixflow.ai.

UK Representative

Under Article 27 of the UK General Data Protection Regulation (UK GDPR), we are required to appoint a representative in the United Kingdom for data protection purposes. We are in the process of designating a UK representative and will update this section with their name and contact details once appointed. In the interim, you may direct any inquiries regarding our data processing practices to contact@mixflow.ai.

Changes to this Privacy Policy

We may change this Privacy Policy from time to time. If we make material changes, we will notify you by revising the “Last Updated” date at the top of this Privacy Policy and providing additional notice via email or a notice within the Service.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at contact@mixflow.ai.