Privacy Policy

Who is responsible

Cloud Mavericks Pty Ltd (Melbourne, Victoria, Australia) decides how and why your information is used in SFProto. In data protection law we are the controller, and you can reach us at support@sfproto.com.

What we store

• Your account: the email address you sign in with, and the account id Supabase gives it. There is no password — we email you a one-time code.
• Your work: projects, pages, the AI conversation saved with each page, and wireframes you upload.
• Sharing: the links you create, who each was shared with, and a hashed one-time code when a recipient confirms their email. We store the hash, not the code.
• Feedback: ideas and problems you send, with your email address and the page you sent them from.
• AI usage: one row per AI request with the kind of request, whether it counted against your limit, the model and the number of tokens. We do not store the text of the request in this record.
• Website analytics: page views through Vercel Web Analytics, which does not use cookies and does not track you across sites.
• Ordinary server logs kept by our hosting and database providers, which include IP addresses for a short period.

Why we use it, and our legal basis

• To run the service you asked for — saving your work, building pages, sharing links, sending sign-in and share codes. Basis: performing our contract with you.
• To keep SFProto working and fair — counting AI use against limits, blocking abuse, and investigating reports. Basis: our legitimate interests in a service that stays available and affordable.
• To answer you when you contact us or send feedback. Basis: our legitimate interests, or your consent where you volunteered it.
• To meet legal obligations, such as tax records once billing is live. Basis: legal obligation.
• We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use your work to train AI models.

The AI provider

To build or change a page, SFProto sends your request, the page you are working on and any wireframes you attached to Google’s Gemini API. We use a paid tier, where Google states it does not use the request to improve its products.

Wireframes are passed to Gemini through its file service and deleted by us as soon as the reply comes back. Google keeps its own limited records for abuse monitoring under its terms.

Please do not put credentials, payment details or sensitive personal information into prompts or prototypes.

Who else processes your data

• Supabase — database, file storage and sign-in (United States).
• Vercel — hosting, server functions and cookieless page-view analytics (United States).
• Google — the Gemini API that builds prototypes.
• Resend — sending sign-in codes, share invitations and notifications.
• Stripe — payments, once billing opens. Stripe handles card details; we never see them.
• Each provider is bound by its own data processing terms. We will update this list before adding anyone new.

Where your data is held

Your account, work and uploads are stored in the United States (Supabase, US East), and our server functions run in Washington, D.C. Email and payments providers may process data elsewhere.

If you are in the UK, EU, India or another country with transfer rules, this means your information is transferred internationally. We rely on the providers’ standard contractual clauses and equivalent safeguards for those transfers.

How long we keep it

• Your work stays until you delete it or delete your account.
• Deleting your account removes your projects, pages, conversations, uploads, share links and feedback from our live systems straight away. Backup copies roll off within 30 days and are never restored for ordinary use.
• AI usage rows are kept while the account exists so limits and costs can be counted, and are deleted with the account.
• One-time codes for share links expire after 10 minutes and are deleted once used.
• Sign-in and provider logs are kept for short periods by Supabase and Vercel under their own retention settings.

Your rights

You can get a copy of everything in your account at any time: Account → Download my data gives you a JSON file. Account → Delete my account removes it.

Depending on where you live, you also have rights to access, correct, delete, restrict or object to our use of your information, and to ask for it in a portable form. Email support@sfproto.com and we will answer within 30 days.

If you are unhappy with our answer you can complain to a regulator: the Office of the Australian Information Commissioner in Australia, the Information Commissioner’s Office in the UK, or your supervisory authority in the EU.

Cookies and browser storage

• A sign-in cookie that keeps you signed in. Necessary; without it you cannot use the app.
• A cookie for shared links, set only when a recipient confirms their email with a code, so they do not have to repeat it for up to 30 days.
• Browser storage for your drafts and preferences on the device you are using.
• Page-view analytics that set no cookies and do not identify you. Because we run no advertising or cross-site tracking, SFProto shows no cookie consent banner.

How we protect it

• Everything is served over HTTPS.
• Database rules restrict every row to the account that owns it; administrative access runs only on the server.
• One-time codes are stored as hashes, expire quickly and lock out after repeated wrong tries.
• Shared prototypes are never indexed by search engines and always carry a banner saying they are prototypes.
• Access is invite-only while we test, and AI use is rate limited per account.
• If you believe your account or a shared link has been misused, email support@sfproto.com and we will act on it.

Children

SFProto is for people aged 18 and over. We do not knowingly collect information from children.

Changes to this policy

The date at the top shows the current version. If we change something that matters — a new processor, a new purpose, or a change in retention — we will email the address on your account before it takes effect.