Privacy policy

Steadyflow is an independent design and build studio. We are the controller of the information described below. Questions or requests: hello@steadyflowhq.com.

• Account details — your email address and password (stored only as an encrypted hash), your name, and optionally your company name.
• Project briefs — the project name, description, package, optional budget note, deposit amount and status of each build you request.
• Sign-in activity — the email used, whether the attempt succeeded, the time and the IP address. This exists only to lock out password guessing.
• Change history — a record of additions and edits to accounts, projects and roles, so we can investigate mistakes or misuse.

We do not collect analytics, advertising identifiers, location, or any special-category data, and we do not ask you to upload files.

To create and secure your account, to deliver and track the work you ask for, to invoice deposits, and to contact you about your project. Sign-in and change records are kept on the basis of our legitimate interest in keeping the service secure.

The site sets no advertising or analytics cookies. Your browser holds a sign-in token so you stay logged in, and a small note of your cookie-banner choice. Both are essential to the site working; clearing your browser storage removes them and signs you out.

Your account, projects and logs are stored in a managed PostgreSQL database hosted on Amazon Web Services in the United States (region us-east-1, Northern Virginia), operated through Lovable Cloud / Supabase. The website itself is served from Cloudflare's global edge network. Fonts are loaded from Google Fonts (which receives the request IP but no account data). We use no email marketing provider and no AI provider, so no data is sent to either. If you are outside the United States, transfers rely on the providers' standard contractual clauses.

Account and project records are kept while your account is open. Sign-in records are cleared automatically after 30 days, and change records after 12 months. Deleting your account removes all of it immediately.

You can download everything we hold about you, and delete your account and all of its records, from the Security page in your client portal — no request or waiting period. You can also ask us to correct information, object to processing, or complain to your local data protection authority. Email hello@steadyflowhq.com and we will respond within 30 days.

Access is protected by password rules, optional two-step verification, sign-in lockouts and rate limits. Every record is protected at the database level so one client can never read another's data.

We will update this page and its date whenever the practices above change.