This Privacy Policy explains how CS Digital Wonders LLC ("we", "us"), operator of PallFlow, collects, uses, and protects personal data when you use our Service. We act as the data controller for the personal data described here.

1. Information We Collect

Identity & contact data: full name and email address provided during registration.
Store connection data: OAuth tokens and store credentials for platforms you connect (Etsy, Shopify, Printify).
Facebook & Instagram data: when you connect a Facebook Page and/or Instagram Business account, we access — strictly within the permissions you grant during the Facebook login — your Page and Instagram account identifiers, access tokens, and basic account metadata (such as Page name and username). This is used solely to publish the content you create and schedule to your own connected accounts. We do not access your private messages, friends list, or personal profile content.
Content data: prompts, uploads, designs, and automation configurations you create.
Billing data: subscription plan, transaction metadata, and last four digits of your payment card. Full card details are handled exclusively by Stripe and are not stored by us.
Usage data: feature usage, automation logs, AI credit consumption, and session activity.
Technical data: IP address, browser type, device type, and referral URL collected automatically.

2. How We Use Information

To create, maintain, and secure your account.
To provide the Service, including automation, listing generation, and mockup features.
To process payments and manage your subscription via Stripe.
To enable third-party integrations you authorize (Etsy, Shopify, Printify).
To publish content on your behalf to the Facebook Page and Instagram Business account you connect — creating and posting the images and Reels you have created and scheduled within PallFlow. We do not use your Facebook or Instagram data for advertising, profiling, or resale.
To send transactional and service-related communications.
To improve the Service and prevent fraud and abuse.
To comply with applicable legal obligations.

3. Legal Bases

Where applicable law (such as the GDPR) requires it, we process personal data on the bases of performance of a contract, our legitimate interests in operating and securing the Service, your consent, and compliance with legal obligations.

4. Facebook & Instagram Permissions

To publish on your behalf, PallFlow requests only the Meta permissions necessary for that function, which may include pages_show_list, pages_read_engagement, pages_manage_posts, instagram_basic, and instagram_content_publish. We use these permissions exclusively to identify your connected accounts and to publish the content you schedule. You grant these permissions during the Facebook login flow and can revoke them at any time (see "Disconnecting & Data Deletion" below). Our use of information received from Meta APIs adheres to the Meta Platform Terms and Developer Policies.

5. Sharing & Disclosure

We do not sell personal data. We share data only with: service providers acting on our behalf (including Stripe for payments, Google for AI features, Meta for publishing to your connected accounts, and cloud infrastructure providers); third-party platforms you choose to connect; and authorities where required by law or to protect rights and safety.

6. Data Retention

We retain personal data for as long as your account is active and as needed to provide the Service. Billing records are retained for 7 years as required by financial regulations. Technical logs are retained for up to 12 months. Store credentials are deleted upon disconnection or account deletion. You may request earlier deletion as described below.

7. Disconnecting & Data Deletion

You are in control of the accounts you connect. You may disconnect your Facebook Page or Instagram account at any time from within PallFlow settings, or from Facebook under Settings & Privacy → Settings → Business Integrations — removing PallFlow there immediately revokes our access and deletes the associated tokens.

To request deletion of all personal data associated with your account or your Facebook login, email [email protected] with the subject line "Data Deletion Request". We will confirm and complete the deletion within 30 days, except where retention is required by law.

8. Security

We use technical and organizational measures including TLS encryption in transit, hashed credentials, and strict access controls. No method of transmission or storage is completely secure. Please notify us at [email protected] immediately if you suspect unauthorized access.

9. Your Rights

Depending on your location, you may have the right to access, correct, delete, restrict, or port your personal data, to object to certain processing, and to withdraw consent. To exercise these rights, contact us at [email protected]. We will respond within 30 days. You may also lodge a complaint with your local data protection authority.

10. Cookies

We use strictly necessary cookies for authentication and session management, and limited analytics to understand usage patterns. You can control cookies through your browser settings; disabling essential cookies may impair the Service.

11. International Transfers

CS Digital Wonders LLC is incorporated in Wyoming, United States. Your data may be processed in the United States or other countries where our service providers operate. Where required, we apply appropriate safeguards such as standard contractual clauses for international transfers.

12. Children

The Service is not intended for individuals under 18, and we do not knowingly collect their personal data. If you believe a minor has provided us data, contact us at [email protected] and we will promptly delete it.

13. Changes

We may update this Policy. Material changes will be notified through the Service or by email at least 14 days before taking effect, and the effective date above will be revised.

14. Contact

Privacy questions and requests: [email protected]