Who is responsible
Lagniappe Flow operates the website, customer workspace, support workflow, and plugin activation service. The legal operator and privacy contact appear above when confirmed. Lemon Squeezy acts as merchant of record for checkout, payment, tax, and receipts and provides its own privacy information at checkout. A company owner manages its members and assigned seats; we process those records to provide the service.
Information we collect
We collect account email and profile name; company name, membership, role, invitations, and seat assignments; quote and support correspondence; subscription, trial, payment-status, and provider identifiers; and records needed to distribute releases and authorize installations. Device activation uses a request code, an installation identifier or its hash, an installation label, credential hashes, and entitlement dates. We do not ask you to enter card details on this website.
Website and plugin activity
Security and operational records may include timestamps, IP address, browser or device information, sign-in attempts, downloads, activation and refresh outcomes, and administrative changes. Optional first-party marketing events record a page path, event name, and limited context only after you allow analytics. The current portal does not upload the artwork open in Photoshop or provide a hosted proof-approval service. Support requests may contain files or details you choose to send us.
Why we use information
We use account and company details to create and secure workspaces, deliver invitations and support, verify subscriptions, assign seats, distribute releases, activate devices, prevent repeat trial abuse, investigate failures or fraud, maintain records, and comply with applicable obligations. Optional marketing analytics depend on your choice. Optional release announcements, product updates, and feedback invitations use your separate preferences. Essential service notices may still be sent when optional messages are off.
Our service providers and transfers
Supabase provides authentication, database, and storage services; Vercel hosts the website; Lemon Squeezy handles checkout, subscriptions, taxes, receipts, and underlying license records; and a configured email provider sends account and service messages. These providers may process data outside Trinidad and Tobago. We share only information needed for their function, such as checkout company and plan identifiers, email, and subscription status. Provider privacy notices and transfer arrangements must be checked before international sales open.
Cookies and local storage
Authentication cookies support sign-in and security. Browser storage remembers your theme and analytics choice. Optional analytics remain off until you allow them, and you can change that choice through Privacy preferences. We do not use advertising trackers or session replay in this release. Clearing browser storage may reset your choices.
Retention and deletion
We keep account, billing-sync, support, security, and trial-history records for as long as needed to operate the service, prevent repeat trials, resolve disputes, and meet applicable accounting or legal duties. A company owner can manage members and an account holder can request an export or deletion review from Settings. Some records may need to be retained after access ends, including provider receipts held by Lemon Squeezy. A final category-by-category retention schedule and backup deletion process must be approved before registration opens.
Your choices and requests
You may ask to access, correct, export, or delete personal information, or object to optional communications. Use Settings or the contact address above. We may verify identity and protect other company members' information before responding. Where an applicable law grants further rights, including rights under the EU or UK data-protection regimes when they apply, we will handle a valid request under that law. A request does not automatically cancel a Lemon Squeezy subscription; use the billing portal for cancellation.
Security and incidents
We use role-based access, restricted data policies, signed download links, hashed device credentials, and verified provider webhooks. No service can promise absolute security. If an incident affects personal information, we will investigate and provide notices required by applicable law and our provider obligations.
Children and international use
The service is intended for business users, not children. It is based in Trinidad and Tobago and initially offered to selected companies. Availability from another country does not mean we actively offer services there. If we expand to a jurisdiction with additional privacy requirements, we will review the required notices, rights, representatives, and transfer safeguards before targeting that market.
Changes and contact
We will date and publish material changes to this notice and, when appropriate, notify account holders. Send privacy questions or requests through the contact page or the confirmed privacy email shown above.