Privacy Policy

1. Introduction

DockFlow commits to protecting your privacy and complying with GDPR (EU 2016/679) and applicable data protection laws. This Privacy Policy explains how we collect, use, and protect your personal information when you use our website and products.

2. Information Collection

Depending on the features you use and the privacy choices you make, we may process:

• Identification: Name and email address when needed for a purchase, support, or licence service
• Technical: IP address, device type, browser, operating system, page activity, privacy choices, and attribution identifiers
• Transaction and licence: Purchase, refund, licensed-device tier, licence-key delivery, and update-eligibility records; payment card details are processed by Stripe and are not stored by DockFlow
• Communications: Email and form correspondence
• Referral survey: The selected source and optional free-text answer. Tracking reports use only the source enum and an opaque submission identifier, never the free text.

Data is collected when you visit our website, purchase products, or submit support requests.

3. Legal Processing Basis

We process your data based on:

• Contract performance for purchased products
• User consent for marketing and cookies
• Legal compliance requirements
• Legitimate business interests (security, improvements, communications)

4. Data Usage

We use your data to:

• Process purchases, deliver permanent licences, and determine update eligibility
• Respond to inquiries and support requests
• Send administrative communications
• Improve functionality and user experience
• Attribute purchases and refunds to the marketing link, campaign, or partner that introduced the customer
• Prevent fraud and ensure security

Note: No profiling or automated decision-making occurs.

5. Data Sharing

We never sell your data. The website uses the following providers only when the related feature is enabled and the service-level regional rule or your privacy choice permits it, as described below and in Section 10.

• Google Tag Manager and Google Analytics: audience measurement and website performance under the Analytics purpose and Google Consent Mode.
• DataFast: first-party cookie-based browser analytics, including returning-visitor and journey measurement, and one server-delivered goal when a committed referral survey is completed. That goal contains only the selected source enum and is linked only when a valid permitted DataFast visitor UUID is available. DataFast's native Stripe connection, not DockFlow application code, owns payment and refund ingestion.
• Hotjar: experience analytics and session replay under the Experience purpose. Sensitive fields and page content are suppressed, and sensitive routes such as account, admin, privacy, checkout, thank-you, API, webhook, and Livewire endpoints are excluded.
• LnkFlow: attribution cookies, journey touchpoints, and consent-permitted checkout decoration. Stripe remains the sole LnkFlow owner for sale and refund events; DockFlow reports only the distinct non-payment referral-survey event.
• Stripe: checkout, payment, fraud prevention, receipts, refunds, and provider-owned conversion delivery.
• UserWay: the accessibility widget and related accessibility assets. It is an accessibility service, not an analytics or advertising service.

All providers are contractually bound to protect your information.

6. International Transfers

Data may be transferred outside the EEA with appropriate safeguards, including Standard Contractual Clauses (European Commission-approved) and adequacy decisions where applicable.

7. Data Retention

Data is retained only as long as necessary for the stated purpose or legal compliance, then deleted or anonymized. Consent choices are configured for 182 days, and material revisions require a new choice. LnkFlow attribution cookies are configured for up to 90 days. DockFlow does not set a separate DataFast retention period in site code; DataFast analytics and its first-party visitor and session cookies follow the approved provider account configuration. Hotjar is configured for the shortest available plan retention; the current plan may retain recordings for up to 365 days, subject to earlier deletion and route/content suppression. Financial records may be retained for statutory accounting periods. Delivery-ledger rows contain an HMAC business-key hash and delivery status rather than the original referral identifier.

8. Security Measures

We implement the following security measures:

• SSL encryption on our website
• Secure access controls
• Regular software and server updates

Disclaimer: No internet transmission method is completely secure.

9. GDPR User Rights

Under GDPR, you have the right to:

• Access: Obtain a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data
• Restrict processing: Limit how we use your data
• Portability: Receive your data in a structured format
• Object: Oppose processing based on legitimate interests
• Withdraw consent: Revoke previous authorization

We will respond to requests within one month. Contact us at support@appitstudio.com. You may also lodge a complaint with your local data protection authority.

10. Cookies & Tracking

Necessary storage supports security, sessions, and your privacy choices. Optional services are grouped into Analytics, Attribution, and Experience purposes. The website obtains its regional privacy context at runtime from a trusted Cloudflare country signal; cached public HTML does not contain a visitor-specific privacy decision.

• Website functionality
• Cookie-based audience, returning-visitor, and journey measurement through DataFast, when permitted
• Google analytics and performance measurement, when permitted
• Attribution and consent-permitted checkout decoration, when permitted
• Experience analytics and replay, when permitted

In the European Economic Area, United Kingdom, Switzerland, and other regions configured for strict opt-in, DataFast, Google Tag Manager/Google Analytics, LnkFlow persistent storage, and Hotjar remain off until you grant the relevant permission. Once permitted, DataFast uses first-party visitor and session identifiers so visits can be connected into returning-visitor journeys. Rejecting or withdrawing Analytics stops DataFast and clears its applicable cookies.

In known regions not configured for strict opt-in, DataFast Analytics and LnkFlow Attribution persistence are enabled by default so DockFlow can measure journeys and campaign performance. Google Tag Manager/Google Analytics and Hotjar remain off unless you explicitly allow their Analytics or Experience purpose. You can reject or change these defaults at any time.

If the country signal is missing, invalid, a Tor code, or cannot be trusted, only DataFast Analytics is enabled by default. The privacy banner remains visible, while LnkFlow persistence, Google Tag Manager/Google Analytics, and Hotjar remain off until you explicitly allow them. This fallback does not infer your location from your time zone, locale, language, or browser settings.

When LnkFlow is enabled, it can read a tracked-link identifier into browser memory. It writes first-party attribution cookies, persists a server journey, or adds a unique client_reference_id to an eligible dedicated DockFlow Stripe link only when Attribution is permitted. Shared Appit Studio bundle links, offer URLs, currency, and required promotion codes remain unchanged when Attribution is denied.

When DataFast server goals are enabled and Analytics is permitted, a committed optional referral-survey submission may produce one purchase_referral_survey_completed goal. It contains only the selected source enum. It is not a purchase, sale, payment, refund, revenue event, or proof of Stripe attribution.

When Hotjar is enabled and Experience is permitted, replay is limited by route exclusions and suppression rules intended to prevent collection of form values, location, numeric text, email addresses, and sensitive page content. Hotjar Identify, User Attributes, surveys, console capture, and iframe capture are not used unless this policy and the service configuration are separately updated.

Global Privacy Control is treated as an opt-out for every optional purpose and service, including DataFast and regional defaults, without showing the banner. You can accept, reject, customize, or withdraw optional processing at any time through the permanent Privacy Choices control in the footer. Rejection or withdrawal stops optional loaders, clears applicable analytics, attribution, and experience cookies, revokes the LnkFlow journey, and restores checkout links modified for attribution. You can also manage cookies through your browser.

11. Children's Privacy

Our website and products are not directed to users under 18 years of age. We do not intentionally collect data from children.

12. Policy Updates

Updates to this policy will be posted on this page with new effective dates.

13. Contact Information

DockFlow
Email: support@appitstudio.com
Address: Boris Rumenov 9, Sofia, Bulgaria