Privacy Policy

Effective date: September 14, 2026 · Last updated: September 14, 2026

Data controller
Nikita Smirnov (Individual Entrepreneur · Small Business Status)
Tax ID: 322784046 · Certificate N 031-0003092
7th Street, N7, Village of Varkhan, Adigeni District, Georgia
[email protected]

1. Overview

This Privacy Policy explains what personal data we collect when you use MediaFlow (the "Plugin") and themediaflow.app (the "Website"), why we collect it, and how we use and protect it. We comply with the Law of Georgia on Personal Data Protection.

We collect only what is necessary to provide the service. We do not sell your data to third parties.

2. Data We Collect

Data	When collected	Purpose
Email address	Account registration, purchase	License delivery, account login, support
License key	Generated at purchase	Activation and access control
Device identifier	Plugin activation	Enforcing device limits per plan
Device name	Plugin activation (hostname)	Displayed in your license dashboard
Activation timestamps	On each activation / verification	Licensing audit, offline grace period
Trial start date	First Plugin launch	Tracking 10-day trial period
Payment data	Purchase (via Paddle)	Billing — handled entirely by Paddle

The Plugin itself does not collect, transmit, or store any information about your Premiere Pro projects, footage files, folder contents, or editing activity. File-watching logic runs entirely on your local machine.

3. How We Use Your Data

To create and manage your account
To deliver your license key by email after purchase
To verify license validity when the Plugin checks in (once per 24 hours)
To display your active devices in the license dashboard
To respond to support requests
To send product update notifications (you may opt out at any time)

4. Legal Basis for Processing

Contract performance — processing your email and license data to deliver and maintain the service you purchased
Legitimate interest — fraud prevention, license abuse detection
Consent — marketing communications (opt-in only)

5. Third-Party Services (Data Processors)

Service	Purpose	Privacy policy
Paddle	Payment processing (Merchant of Record)	paddle.com/legal/privacy
Supabase	Database and authentication (hosted in EU)	supabase.com/privacy
Resend	Transactional email delivery	resend.com/legal/privacy-policy
Cloudflare Pages	Website hosting and CDN	cloudflare.com/privacypolicy
Google OAuth	Optional sign-in with Google	policies.google.com/privacy

We do not share your personal data with any other third parties. Each processor listed above is bound by a data processing agreement and may only use your data to provide the specific service indicated.

6. Data Retention

We retain your account data for as long as your account is active. If you request deletion, we will remove your personal data within 30 days, except where retention is required by law (e.g., financial records associated with Paddle transactions, which Paddle retains per their own policies as Merchant of Record).

Deactivated device records are retained for 90 days before permanent deletion.

7. Cookies

The Website uses only essential cookies required for authentication (Supabase session token). No tracking or advertising cookies are used. We do not use any analytics services.

8. Your Rights

Under Georgian data protection law, you have the right to:

Access the personal data we hold about you
Correct inaccurate data
Request deletion of your data
Object to processing based on legitimate interest
Data portability — receive your data in a machine-readable format
Lodge a complaint with your national data protection authority (EU/EEA residents may contact the supervisory authority in their country of residence)

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

9. Data Security

All data is transmitted over HTTPS. License keys and device identifiers are stored in a Supabase-hosted database with row-level security. Passwords are never stored — authentication uses secure tokens via Supabase Auth. We do not store payment card details; all payment data is handled exclusively by Paddle.

10. International Transfers

Your data may be processed outside Georgia by our service providers (Supabase in the EU, Resend and Cloudflare in the US). These transfers are made under appropriate safeguards including standard contractual clauses.

11. Children

MediaFlow is not intended for users under 18. We do not knowingly collect personal data from minors.

12. Changes to This Policy

We may update this Privacy Policy. The updated version will be posted on this page with a revised effective date. For material changes, we will notify you by email.

13. Contact

Privacy questions or data requests: [email protected]