Privacy Policy

1. Data we collect

• Account data: your email address and, if you sign up with a password, a protected (hashed) version of it, which we cannot read.
• Google sign-in data: if you choose "Continue with Google", Google shares your name, email address and profile picture with us. We do not receive your Google password or access to your Gmail, Drive, contacts or other Google data.
• Project content: flowsheets, project names, folders, previews, parameters, assay favorites and anything else you enter in the editor.
• Sharing data: when you send a copy of a project, the recipient's email address, the optional message and the status of the copy.
• Preferences and subscription: language, theme, date format, PDF credit and similar settings; plan and subscription status. When paid plans launch, billing details will be handled by our payment provider; we will receive only what is needed to manage the subscription (for example, plan, status and the last digits of the card), never the full card number.
• Technical data: IP address, browser and device information, the pages and addresses requested, timestamps and error records, collected automatically by our hosting and database providers for security and operation.
• Communications: the content of messages you send us by email.

2. How we use your data

• to create and authenticate your account and keep you signed in;
• to store, calculate, display and export your projects, and to deliver the copies you choose to send;
• to manage your subscription and, when paid plans exist, billing;
• to send service emails, such as account confirmation and important notices about the Service or these policies;
• to keep the Service secure, prevent abuse, investigate errors and improve reliability;
• to answer your requests and comply with legal obligations.

We do not use your project content to train artificial intelligence models and we do not look at it, except when you ask us to, or when strictly necessary for security, to fix a problem you reported or to comply with the law.

3. Legal bases

Where data protection laws such as the GDPR (European Union and United Kingdom) or the LGPD (Brazil) apply, we process personal data on these bases: performance of our contract with you (account, projects, sharing, subscription); our legitimate interests in keeping the Service secure, functioning and improving, balanced against your rights; compliance with legal obligations; and your consent where the law requires it, which you may withdraw at any time.

4. Google user data

When you sign in with Google, we request only the basic scopes needed for sign-in (openid, email and profile). We use the name, email address and profile picture received only to create and identify your account and to show who is signed in. We do not sell this data, use it for advertising, transfer it to third parties other than the service providers listed below, or use it to train artificial intelligence models.

Mining Flow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke the Service's access at any time in your Google Account settings.

5. Who we share data with

We share personal data only with service providers that help us run the Service, under contracts that limit use to that purpose:

• Cloudflare — hosting, content delivery and security of the website and application;
• Supabase — database, authentication and storage of accounts and projects;
• Google — sign-in with Google and delivery of the website fonts: your browser connects to Google servers when loading the pages, and the sign-in page loads Google's sign-in button, so Google receives technical data about that visit even if you do not use it;
• email delivery providers — sending account and service emails;
• Stripe — payment processing, when paid plans become available.

6. Other disclosures

We may disclose data when required by law or valid legal order, to protect the rights, safety and property of users, YewCastle or others, or in connection with a merger, acquisition or sale of the Service, in which case this Policy will continue to protect your data and we will notify you.

When you send a copy of a project, the recipient will see your email address, the project name, the copy and your message. A copy that is not accepted within 30 days expires.

7. International transfers

YewCastle is based in the United States and our providers process data in the United States and other countries. When personal data is transferred outside your country, we rely on safeguards required by applicable law, such as standard contractual clauses offered by our providers.

8. Retention

We keep your account data and projects while your account exists. When you delete your account, your projects, folders, shares, preferences, subscription record and account are removed from our database right away. Residual copies in backups and technical logs are deleted automatically as our providers rotate them, generally within 30 days. Emails you send us are kept as long as needed to answer you and no longer than 5 years after our last contact. We may keep specific records for longer when the law requires it (for example, billing records).

9. Security

We use encryption in transit (HTTPS), access rules in the database so that each account reaches only its own data, separation between the editor and your login credentials, and restricted administrative access. No system is completely secure; if an incident affects your data, we will notify you and the authorities as required by law.

10. Your rights

Depending on where you live, you may have the right to confirm whether we process your data; access it; correct it; delete it; receive a copy in a portable format; object to or restrict certain processing; withdraw consent; and obtain information about the providers we share it with. You can correct your preferences and delete your account directly in the Service. For other requests, write to miningflow@yewcastle.com; we will answer within the time required by law and may ask you to confirm your identity.

Residents of Brazil also have the rights in Article 18 of the LGPD. You may also file a complaint with your data protection authority, such as the ANPD in Brazil or the authority of your country in the European Union. California residents have the right to know, delete and correct personal information and not to be discriminated against for exercising these rights; we do not sell or share personal information for cross-context behavioral advertising.

11. Cookies and local storage

We do not use advertising or analytics cookies. The Service stores in your browser only what it needs to work: your sign-in session and interface choices such as the language. Our hosting provider may set strictly necessary security cookies. Clearing your browser data signs you out and resets these choices.

12. Children

The Service is a professional tool intended for adults and is not directed to children. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.

13. Changes to this Policy

We may update this Policy. The date of the last update is shown at the top of this page. For material changes, we will notify you by email or in the Service before they take effect.

14. Contact

Questions or requests about privacy: YewCastle LLC — miningflow@yewcastle.com. See also our Terms and Conditions.

13 W Main St, PO Box 953, Felton, DE 19943, USA