Privacy Notice — Kerfloom

1. Controller and scope

The intended public worldwide free beta includes 10 production exports for new accounts, with no new purchases or automatic paid upgrade. Export records support allowance accounting and free re-downloads of unchanged released designs. References below to payments and subscriptions concern historical billing or a separately enabled paid service, not a requirement to pay for the free beta.

The Serbian Kerfloom operator identified above is the controller for account, project, product-analytics, support, entitlement, and export records it determines how to use. Paddle separately controls personal data it processes as merchant of record for checkout, fraud prevention, invoicing, tax, and buyer support; see Paddle’s Privacy Notice.

Privacy requests use privacy@kerfloom.com; security reports use security@kerfloom.com. Both aliases forward to the same monitored inbox. Requests are normally acknowledged within two Europe/Belgrade business days and completed within one month unless applicable law permits a documented extension.

Contact the operator using the privacy or security email above. Telephone support is not available.

Representation reviewNo DPO, EEA representative, or UK representative is appointed. Determine applicable representation requirements before public release.

2. Data, purpose, and proposed legal basis

Account and authentication: Email address, password hash where email/password sign-in is used, verification/reset tokens, sessions, account timestamps, security limits, and—if you choose Google sign-in—the Google account’s stable identity reference and verified email address. Used to create and secure the account, link sign-in methods without duplicating the account, perform the service contract, and prevent abuse. Kerfloom does not retain Google access or refresh tokens.
Projects and drafts: Project names, design parameters and geometry, revisions, active draft, material and workflow settings. Used to generate files, sync projects, resolve edit conflicts, and provide requested cloud features under the service contract.
Exports and entitlements: Stable revision keys, artifact manifests and files, credit ledger, plan status, Paddle customer/subscription/transaction references, billing periods, adjustments, and event processing results. Used to deliver purchases, avoid duplicate debits, restore downloads, reconcile billing, handle disputes, and meet accounting or fraud obligations.
Payments: Paddle collects payment-method and billing information. Kerfloom receives identifiers, product/price references, transaction and subscription status, limited customer linkage, and signed event data—not complete card details.
Support and feedback: Contact address, category, subject, message, ticket history, post-export ease rating, optional comment, interview preference, prompt timing, and optional diagnostics such as Studio stage, browser class, export type, pattern/material category, request ID, and recent action names. Used to answer requests and prioritize product improvements. Design geometry and free-form design fields are not attached as diagnostics.
Security and operations: IP-derived rate-limit keys, request path, request ID, response status, duration, readiness, delivery failures, and administrator audit records. Used for service security, incident response, reliability, and accountability under legitimate interests and legal obligations.
Product analytics: Where permitted by applicable law, or after permission where prior consent is required: anonymous/account journey ID, session ID, stage, result, duration, device/browser class, locale, selected control categories, pattern/material categories, and validation outcomes. Used to find confusing or failing product paths. Geometry, uploaded artwork, filenames, email addresses, and free-form field values are excluded.
Optional attribution: With analytics consent: source, medium, campaign, content label, and origin/path-only referrer and landing page. Query strings are stripped from stored URLs. During viability testing Kerfloom does not use Google Signals, remarketing, personalised-ad audiences, or advertising profiles.
Email delivery: Recipient address, sender, subject, message content (including account links or security codes where needed), and delivery metadata are processed by Resend to send verification, password reset, support, recovery, and operational messages. Kerfloom’s separate delivery-monitoring table stores only a hashed event identifier, event type, and timestamp—not recipients, subjects, message bodies, or account links.

The proposed legal bases above remain subject to applicability review under Serbia’s Law on Personal Data Protection and, where applicable, GDPR Article 6. Consent is not used as a substitute for processing necessary to deliver an account, purchase, export, or requested support response.

3. Browser storage and consent

Essential browser storage keeps the local Studio workspace, project state, authentication session, security token, and privacy choice working. A signed-in session cookie is HTTP-only and SameSite=Strict; production uses the Secure attribute. Google sign-in also uses a ten-minute HTTP-only SameSite=Lax cookie to verify the returning browser. Email confirmation codes for sign-in and account deletion expire after ten minutes and are stored as hashes. Essential operation does not depend on optional analytics consent.

Product analytics and marketing attribution are selected by default. In regions where the approved legal basis does not require prior permission, they begin immediately; in configured opt-in regions measurement waits until you confirm the selected settings. You may turn either category off through Privacy settings on the public page or in Kerfloom Studio. A browser Global Privacy Control signal denies Kerfloom’s advertising consent signals. Withdrawing a choice updates consent for future measurement; it does not erase prior records or necessarily stop all requests from already-loaded measurement tools. Limited cookieless requests can continue, and previously set provider cookies are not all automatically removed. Withdrawal does not invalidate earlier lawful processing.

Essential operational records—such as errors, availability, export fulfillment, billing fulfillment, fraud prevention, and security events—continue without analytics consent only where needed to provide and protect the service. They are not used for advertising profiles.

Inventory before approvalRecord every production cookie, local-storage key, expiry, domain, and provider in the owner checklist. Review the regional opt-in list and the applicable legal basis used elsewhere. Staging checks on 24 September verified consent updates and saved choices. An initial Clarity advertising-consent mismatch and GPC cookie-sync issue were resolved in fresh-session retests after changing the provider’s cookie default. The operator confirmed masking in the requested Studio recording check. Actual outside-opt-in-region behavior still requires verification; these checks are not a certification of the entire integration.

4. Recipients and their roles

Kerfloom discloses only data needed for a provider’s task. Current or planned recipient categories include hosting and backup infrastructure, transactional email, Paddle billing, analytics delivery selected by consent, security/uptime services, and professional advisers or authorities where lawfully required.

Paddle: merchant of record, checkout, subscription management, tax, invoicing, fraud review, adjustments, and buyer support.
Hetzner: application, PostgreSQL database, artifacts, and local backups in Helsinki, Finland. The owner confirms acceptance of Hetzner’s data-processing agreement.
Resend: current staging outbound transactional email, sent as support@kerfloom.com. The configured sending region is Ireland; Resend stores message content, delivery logs, webhook payloads, and account records in the United States. See Resend’s data-handling information. Production processing terms and transfer safeguards remain subject to review.
Cloudflare Email Routing and Gmail: inbound messages to the support, privacy, and security aliases are forwarded to a monitored consumer Gmail inbox. These services process the sender and recipient addresses, message content and any attachments you send. Gmail stores the forwarded correspondence; it is not covered by a Google Workspace agreement. Google's consumer terms and Privacy Policy apply. Gmail is no longer the staging transactional SMTP sender. The receiving-mailbox processing arrangement remains under review.
Google Tag Manager and Google Analytics: regional consent-aware product measurement and campaign attribution, with a 14-month retention target. Google Signals, remarketing, personalised-ad audiences, and advertising profiles remain disabled during viability testing.
Google Account sign-in: optional account authentication using the basic OpenID Connect identity scopes for a stable account reference and verified email address. Kerfloom does not request Google Drive, contacts, profile, or other Google service data for sign-in.
Microsoft Clarity: heatmaps and session diagnostics used to find interface friction. Sensitive text is masked, and design geometry and free-form content must not be intentionally tagged or identified. Microsoft describes its role as a data controller, not only our processor; see the Microsoft Privacy Statement. Clarity reads Google consent signals. When advertising storage is granted, Microsoft documents sharing with Microsoft Ads, even if Kerfloom is not running Microsoft advertising campaigns. When denied, that sharing is disabled. Denied analytics storage can still allow limited cookieless collection if the tag loads. See Clarity consent behavior.
UptimeRobot: independent availability and aggregate email-delivery status checks, using Basic Auth for protected staging endpoints, and incident notifications to the operator. These checks do not receive customer project content or email message bodies.
Cloudflare: DNS-only at present, so customer web traffic is not intentionally proxied through Cloudflare.
GitHub and GHCR: source-code and container-image hosting; customer records are not intentionally stored there.
Web fonts: Cabinet Grotesk and IBM Plex are served by Kerfloom. Visitors do not contact Fontshare or Google Fonts to render the interface.
Independent backup copies: the operator keeps encrypted database/artifact backup copies on a computer and removable USB drive, separately from the VPS. Copying is manual, not continuous replication. No additional paid off-server storage provider is configured.

Kerfloom does not operate its own advertising-profile service. Its disabled Google personalization settings do not establish that Microsoft’s separate advertising uses are disabled. Provider processing and consent-enabled sharing are described above.

Provider review — 24 September 2026Resend states that its data-processing addendum is incorporated at signup without a separate countersignature; retain the account copy and assess applicable transfers. Google explicitly does not offer a data-processing agreement for consumer Gmail. The consumer mailbox is retained for the test period by the operator's decision, with authenticator-app two-factor authentication confirmed. This operational choice does not resolve the applicable processing and transfer requirements. See Resend’s account guidance and Google’s explanation. Current Clarity terms, processing roles and secondary uses still require verification; masking alone does not establish approval.

5. International transfers

Kerfloom is operated from Serbia, which is outside the EEA. Providers may process data in Serbia, the EEA, United Kingdom, United States, or other locations associated with their services. Before deliberately offering to EEA customers, document each transfer route and the applicable adequacy decision, contractual safeguard, or lawful exception, and explain how to obtain a copy where required.

Do not approve genericallyReplace this review language with the actual production transfer register. Determine whether an EEA representative is required; do not assume that using EEA hosting resolves controller-location or provider-transfer duties.

6. Retention

This draft distinguishes current staging behavior from selected retention targets. A target below is not an enforced deletion deadline unless explicitly stated. Retained records and unresolved schedules must be reviewed before public release; this description does not authorize indefinite retention.

Projects and drafts: Cloud project records remain until project or account deletion; no automatic inactivity expiry is implemented. Deleting one project removes its cloud project record, not necessarily previously generated export files. Browser-only drafts and downloaded files remain on the user's device.
Ready export artifacts: Generated files are associated with the account and design revision, not a single project record. Individual project deletion does not currently remove them. Account deletion queues physical file cleanup; failed cleanup remains pending and is retried. This does not remove old backup or provider copies.
Free-beta export allowance and release records: Balances and released-design identifiers are kept while the account exists, so the allowance does not reset and unchanged released designs can be downloaded again without another credit. Account deletion removes the linked allowance, credit ledger, release and download-token records. Pending physical file cleanup is retained until it succeeds. Retained backups are handled separately as described below; this account-deletion rule does not erase historical backup copies.
Historical billing records: Historical Paddle records are separate from free-beta export usage. Account deletion removes local account links where implemented, but does not comprehensively erase personal data from historical provider payloads. Their retention and redaction schedule remains unresolved; no unspecified tax or freelancer schedule is applied to free-beta usage in this draft.
Support records: The selected target is two years after closure. Explicit closure dates are now recorded, but historical unknown dates are not guessed and automatic age-based cleanup is not enabled. Account deletion removes linked tickets and messages; mailbox and provider copies are separate. In-app support replies are also emailed through Resend, including the ticket subject and reply text. Please do not send passwords, confirmation codes, payment-card details or unrelated sensitive documents in support messages.
First-party analytics and GA4: The selected retention target for first-party analytics/attribution and GA4 event-level data is 14 months; deployed enforcement and GA4 settings must be verified before publication. First-party age-based cleanup is not enabled. Account deletion removes linked first-party records, not all anonymous or unlinked events or provider copies. Changing collection preferences is separate from deleting previously stored data; provider deletion and consent-revocation behavior still need consolidated release verification. This is not a blanket retention promise for provider aggregates or session recordings.
Clarity session diagnostics: Microsoft documents 30-day playback retention and nine months for labeled or favorited sessions, heatmaps and click data. These provider periods are separate from the 14-month analytics target. See Clarity retention.
Application and security logs: The selected target is 30 days, not a verified maximum. Staging application logs rotate by size (five files of up to 10 MB each), rather than by age. Proxy and host logs have separate rotation settings; their actual retention needs verification before publication.
Email delivery records: Kerfloom removes delivery-monitoring events older than 30 days during ingestion or monitoring refresh. Resend reports 30-day email and log retention on its Free plan; provider account records, backups, and termination handling have separate terms. Inbound support correspondence follows the support-record policy and mailbox arrangements, not the outbound monitoring window.
Administrator and security audits: The selected target is two years. Automatic age-based cleanup is not enabled; audit records may remain after account deletion. A read-only report identifies age candidates and registered holds without deleting records.
Retention holds: Owner administrators can register a reason and review date for specific analytics, attribution, support or audit records. These holds are intended for future age-based cleanup. A review date does not automatically release a hold. Holds do not override the current account-deletion workflow or preserve provider copies; the hold register's own retention schedule remains unresolved.
Backups: Encrypted staging backups are scheduled daily and verified through isolated restoration. The active encrypted backup job does not automatically prune old sets. Encrypted copies on the operator's computer and USB are refreshed manually; earlier copies and pre-migration originals remain retained. Account deletion does not erase these historical copies. The approved target is daily recovery points within 30 days on the VPS and computer, and weekly points within that window on USB. This expiry policy is not yet implemented; a disconnected USB can only be cleaned on reconnection. Pre-migration copies require a separate retirement review, and keys remain while retained backups need them. These targets are not a guarantee that every copy is erased within 30 days.

7. Your rights

Depending on applicable law, you may have rights to information, access, correction, deletion, restriction, objection, portability, withdrawal of consent, and review of certain solely automated decisions. Kerfloom does not currently make decisions producing legal or similarly significant effects solely from product analytics.

Use Account & sync to export ordinary account data or delete the account. Account deletion removes account access, cloud project records, linked support and analytics records, and queues generated files for physical cleanup. If file cleanup fails, the application reports it as pending and retries; it does not mean account access remains active. Browser-only drafts and downloaded files stay on your device.

The self-service export is not a comprehensive response covering every retained record. Historical billing payloads, administrator audits, unlinked analytics, hold history, logs, backups and external provider copies are not all erased by account deletion. Removing an account link does not necessarily anonymise the remaining data. For a broader access or deletion request, use Help and feedback in Kerfloom Studio or email privacy@kerfloom.com. We may need proportionate information to verify the requester and protect another person's account. The unresolved retention schedules above must be settled before this draft is published.

You may complain to Serbia’s Commissioner for Information of Public Importance and Personal Data Protection. If GDPR applies, you may also complain to the competent EEA supervisory authority. Contacting Kerfloom first is welcome but not required where law gives a direct complaint right.

8. Security

HTTPS protects data in transit. Application-level encryption for the covered database fields and generated files is active on staging following the 22 September 2026 cutover. Operational database/artifact backups are encrypted and restore-verified; encrypted copies are also kept on the operator's computer and USB. Independent recovery from a real USB backup passed before cutover using the same key set and storage format. This is not end-to-end encryption or a claim that every metadata field, log, provider record, or browser copy is encrypted by Kerfloom. Retained pre-migration databases, files and older backups are not retroactively encrypted or erased by the switch.

Kerfloom uses measures including password hashing, email verification, HTTP-only sessions, CSRF protection, rate limits, signed billing webhooks, restricted artifacts, least-privilege containers, private database networking, encrypted HTTPS transport, audit records, backups, and restore tests. No system is risk-free. Report a suspected account or data-security issue to security@kerfloom.com.

9. Children

Kerfloom is a general-audience design tool, not an adults-only service. If a person is not legally able to create an account or accept the terms where they live, a parent or legal guardian must create or manage the account and accept the terms on their behalf. Kerfloom does not knowingly seek children’s data for advertising profiles. Applicable child-privacy requirements and provider age restrictions remain subject to review; parental involvement alone does not establish that all requirements are met.

10. Changes and contact

Material changes are dated and normally communicated by email at least 30 days before taking effect, except urgent legal or security changes that cannot reasonably wait. Privacy requests use privacy@kerfloom.com; payment-data questions may also be directed to Paddle under its own privacy notice.

Remaining reviewProvider entities and transfer safeguards, historical financial-record retention, DPO/EEA/UK representation, child-privacy position, and the receiving-mailbox arrangement remain under review. The operator's contact-publication decision and unresolved applicability risk are recorded in the internal launch register.