Lacewing Technologies is the data controller for HumanFlow. This page explains the rights you have over your data and how to use them. It sits alongside our Privacy Policy, which describes what we collect.
Your rights
- Access — get a copy of the personal data we hold about you.
- Rectification — correct anything inaccurate.
- Erasure — have your account and data deleted.
- Portability — receive your data in a machine-readable format.
- Restriction & objection — ask us to pause or stop a particular use.
- Withdraw consent — at any time, without affecting what happened before.
- Complain — to your local supervisory authority.
Why we are allowed to process your data
- Contract — running your account and delivering the results you ask for.
- Legitimate interests — keeping the service secure, preventing abuse, and understanding in aggregate how it is used.
- Consent — anything optional, such as analytics or marketing email.
- Legal obligation — tax and accounting records for payments.
Who processes data on our behalf
Each of these is bound by a data processing agreement and handles only what it needs to do its job.
- Supabase — account database
- DigitalOcean — application hosting
- Vercel — website hosting
- Postmark — transactional email
- Stripe — payments. Card details go to Stripe, never to us.
- Anthropic — the model behind rewriting
Detection runs on our own model, on our own infrastructure. Your text is not sent to a third-party detector.
International transfers
Some processors above operate outside the EEA and UK. Those transfers rely on Standard Contractual Clauses or an adequacy decision.
How long we keep things
- Account data — while your account is open.
- Text you submit — processed to return your result; not retained for training.
- Payment records — as long as tax law requires, typically six years.
Making a request
Email support@humanflow.pro from your account address. We reply within 30 days, free of charge. You can also delete your account yourself — see Delete account.
We may ask you to confirm your identity before acting on a request, so that nobody can use these rights to reach someone else's data.