Legal & Privacy Compliance

Privacy Policy

Last Updated: September 4, 2026 • Version 3.1

Zero-Model-Training Guarantee

Binding Enterprise Commitment

SchemaFlow guarantees that no customer data, extracted content, scraped markdown, target URLs, custom schemas, or API inputs/outputs are ever used to train, retrain, or fine-tune foundational AI models. Your data remains strictly isolated to your organization’s runtime pipeline.

1. Information We Collect

We collect minimal technical information necessary to authenticate and bill your API usage:

Account Credentials: Work email address, company name, and hashed credentials.
Billing Information: Processed securely via Stripe; SchemaFlow never stores raw credit card numbers or banking credentials.
API Telemetry: Request timestamps, HTTP status codes, latency metrics, and credit usage for spend monitoring and rate-limiting.

2. Technical & Encryption Standards

All infrastructure operated by SchemaFlow complies with defense-in-depth enterprise security controls:

Data in Transit

Enforced TLS 1.3 encryption across all public API endpoints and internal microservices. Perfect forward secrecy is mandatory.

Data at Rest

Hardware-accelerated AES-256 volume encryption with AWS KMS-managed customer-specific master keys.

3. Data Retention & Ephemeral Scraping

By default, scraped web content is processed ephemerally in volatile memory and streamed directly to your client application. Unless customer-managed webhook caching is explicitly enabled in your dashboard, page contents are discarded from memory immediately upon request completion.

4. GDPR & CCPA/CPRA Privacy Rights

Regardless of your geographic location, SchemaFlow affords all users comprehensive privacy protections matching European Union GDPR and California CCPA/CPRA standards:

Right of Access: Request a complete export of all personal and telemetry records.
Right of Erasure: Request immediate deletion of your account and API records.
Right to Rectification: Update inaccurate business identity or contact details.
No Data Brokering: SchemaFlow never sells, licenses, or rents customer personal data.

5. Subprocessors & Cloud Infrastructure

We partner with SOC 2 / ISO 27001 certified cloud infrastructure providers:

Amazon Web Services (AWS): Cloud compute (ECS Fargate), vector storage, and managed VPCs.
Stripe Inc.: Payment processing and invoice management.

6. Privacy & DPA Contacts

To request a custom Data Processing Addendum (DPA) or exercise your GDPR/CCPA rights, contact our Data Protection Officer:

privacy@schemaflow.techGeneral Support: support@schemaflow.tech