Privacy Policy

Effective date: July 6, 2026

AI Workflow Pro ("we", "us", "the site") respects your privacy. This policy explains what data we collect, why we collect it, and the choices you have. If anything here is unclear, email [email protected] and we'll answer in plain English.

We act as a data controller for personal data processed through this site.

1. Data we collect

We never sell your personal data. We do not run third-party advertising, profiling, or automated decision-making with legal effects on you.

2. How we use it

• Deliver what you asked for: articles, the newsletter, your purchased downloads
• Keep the site running: error monitoring, abuse detection, fraud prevention on payments
• Improve content: aggregate analytics tell us which tutorials land; nothing about you personally is shared with third parties
• Required by law: tax reporting on product sales income (HMRC), responses to lawful requests from UK/EU authorities

3. Third-party processors

We rely on a small set of vendors. Each one sees only the data it needs for its job:

Each processor has its own privacy terms; links are available on their websites.

4. Cookies and tracking

Essential cookies keep the site running (sign-in session, CSRF protection). Analytics cookies (Google Analytics 4 with IP anonymisation) are blocked by default until you accept them in the cookie banner. You can withdraw consent any time by clearing cookies or adjusting your browser settings; we also honor "Do Not Track" and common ad-blockers.

We do not use behavioural retargeting, advertising cookies, or cross-site tracking.

5. Your rights

Under UK GDPR, EU GDPR, and the California Consumer Privacy Act (CCPA), you have the right to:

• Access the data we hold about you (Art. 15 UK/EU GDPR)
• Correct anything inaccurate (Art. 16)
• Delete your data (Art. 17 / CCPA deletion right)
• Export your data in a portable format (Art. 20)
• Opt out of marketing email (every newsletter has a one-click unsubscribe)
• Object to processing under Art. 21
• Restrict processing under Art. 18
• Withdraw consent at any time where processing is based on consent (Art. 7)

To exercise any of these, email [email protected]. We reply within 30 days — usually much faster. We honor all rights above for everyone regardless of your location.

Right to complain:

• UK residents: you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk
• EU/EEA residents: you have the right to lodge a complaint with your local data protection authority
• California residents: you have additional CCPA rights including the right to know and the right to opt out of the sale of personal information (we do not sell)

6. Data retention

• Newsletter subscription: for as long as you stay subscribed; after you unsubscribe, the email is kept 90 days in case you re-subscribe, then permanently deleted
• Order records: 7 years (UK HMRC tax law requirement)
• Server logs: 30 days, then automatically rotated and deleted

7. Children

AI Workflow Pro is directed at adult readers. We do not knowingly collect personal data from children under 18, and studio products are not sold to anyone under 18. Users aged 16–17 may subscribe to the free newsletter only with parental consent. If you believe we have collected data from a child inappropriately, email us and we'll delete it promptly.

8. International data transfers

Our servers are in the United States. When we transfer personal data outside the UK or EU/EEA to a country without a Commissioner's adequacy decision, we rely on:

• For UK-to-US transfers: the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (in force since 21 March 2022)
• For EU-to-US transfers: the EU Standard Contractual Clauses (2021) or the EU-US Data Privacy Framework where the vendor is certified

All transfers are additionally protected by encryption in transit (TLS 1.2+) and at rest.

9. Security

Newsletter sign-in uses magic links (one-time email links); we do not store user passwords. Payment details for product purchases are handled entirely by Polar's PCI-DSS compliant checkout — we never see or store raw card data. All traffic is HTTPS (TLS 1.2+). The server is hardened with fail2ban + UFW firewall + key-only SSH authentication. Backups are encrypted at rest.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the UK ICO within 72 hours and notify you without undue delay, as required by UK GDPR Art. 33–34.

10. Changes

If we change this policy materially, we'll notify newsletter subscribers by email at least 14 days in advance and update the "Effective date" at the top. Continued use means you accept the updated policy.

11. Contact

AI Workflow Pro (Data Controller)

Email: [email protected]

We answer privacy questions personally, not through a ticketing form.