Privacy Policy for FlowPrompter

Effective Date: March 28, 2026

Buitron Inc ("we," "us," or "our") operates the FlowPrompter mobile application and the FlowPrompter Web Studio (collectively, the "Services"). We are the Data Controller for the personal data collected through the Services. This Privacy Policy explains how we collect, use, and protect your information across all platforms.

1. Information We Collect and How We Use It

We collect information to provide, secure, and improve our teleprompter and AI features.

• Identifiers (Account Information): If you create an account or sign in via Google Auth, we collect your email address, a unique user ID, and an encrypted password to authenticate you and sync your data across devices. Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Payment Information: When you purchase a Pro subscription via the Web Studio, your payment details are collected and processed directly by our secure payment provider (Stripe). We do not collect or store your full credit card numbers on our servers.
• User Content (Scripts and Folders): Scripts you write or generate are securely synced to our cloud database (Supabase) to provide cross-device access.
• Audio and Voice Inputs: When using the voice-tracking feature, the Services request microphone access. Your voice is processed in real-time by your device's native or browser speech recognition APIs to scroll the text. We do not collect biometric voice prints.
• Device & Diagnostics: We and our third-party processors automatically collect pseudonymous data, including your device model, browser type, OS version, and crash logs for security and debugging.
• Camera Access: To allow you to record videos alongside the teleprompter, the Services request access to your device's camera. The camera feed is processed strictly on your device to create local recordings. We do not transmit, stream, view, or store your camera feed or video files on our servers.
• Local Video Recordings ("Takes"): All videos are stored strictly locally on your device's internal storage. We do not upload, host, or have access to your video recordings.

Do Not Track (DNT) Signals: Some web browsers transmit "do-not-track" signals to websites. Because there is not yet a universally accepted standard on how to interpret these signals, we currently do not alter our data collection and use practices in response to DNT signals.

2. Cookies and Tracking Technologies

We use strictly necessary cookies and similar technologies to ensure our Web Studio functions securely and properly:

• Authentication: Cookies are used by Supabase to keep you securely logged into your account.
• Fraud Prevention: Stripe utilizes strictly necessary cookies to detect and prevent fraudulent payments during checkout.
• Analytics: We use privacy-friendly web analytics (Vercel Analytics) to understand aggregated site traffic. This does not track personal IP addresses or use invasive cross-site tracking cookies.

3. Third-Party Processors and AI Integrations

We use trusted third-party service providers that act as processors on our behalf:

• Database & Authentication (Supabase): Used to securely store your synced scripts and manage logins.
• Subscription Management (RevenueCat & Stripe): Used to securely process payments, verify Pro subscription status, and manage cross-platform billing.
• AI Integrations (OpenAI): If you use the AI Ghostwriter, your text prompts are sent to OpenAI to generate your script. Per their API policies, OpenAI does not use your prompts to train their public models.

4. Legal Bases for Processing (EEA/UK Users)

If you reside in the EEA or UK, we process data under: Contract (account syncing and billing), Consent (mic/camera access), Legitimate Interests (app security and basic analytics), and Legal Obligation (tax/accounting).

5. Data Sharing and Sales

We do not sell, rent, or trade your personal information, scripts, or videos to any third parties for advertising or marketing purposes.

6. Data Retention

We retain your account identifiers and cloud-synced scripts for as long as your account is active. Upon account deletion, we will delete or de-identify your personal data within a reasonable timeframe (typically 30 days).

7. Data Security

Cloud-synced scripts are encrypted in transit (TLS) and at rest (Supabase). Because your video recordings are stored locally, their security relies on your device's own security measures.

9. Children’s Privacy

FlowPrompter is not directed to individuals under the age of 13 (or 16 in certain jurisdictions). We do not knowingly collect personal information from children.

10. International Data Transfers

Buitron Inc is based in the United States. If you access our Services from outside the US, your information will be transferred to and processed in the US.

11. Accessibility Statement

Buitron Inc is committed to making our Services accessible to everyone, including individuals with disabilities. We continuously strive to improve the user experience for all and apply relevant accessibility standards. If you experience any difficulty accessing our website, app, or reading this Privacy Policy, please contact us so we may assist you and provide the information in an alternative format.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our technology, features, or legal obligations. We will notify you of any material changes by updating the "Effective Date" at the top of this policy, and/or providing a prominent notice within the app or via email before the changes take effect. Your continued use of the Services after the effective date constitutes your acceptance of the updated policy.

13. Future Advertising & Analytics

Currently, we do not use invasive third-party advertising tracking pixels. As our platform grows, we may introduce analytics and advertising partners (such as Meta or Google) to help us reach more creators. When we do, we will update this policy and provide appropriate cookie consent and opt-out mechanisms in accordance with regional privacy laws.