Overview
RikuFlow, a TMNSolutions product, collects and processes personal information when you visit the website, sign in to your account or start a trial (on the website or in the app), buy a license, ask for support, and when the RikuFlow app activates and checks for updates.
- Your projects never reach us. Prompts, images, video, audio, transcripts, projects and the API keys of your AI providers stay on your computer (or your server). When a node calls a cloud AI provider, that request goes from your machine straight to that provider, under its terms, not through us.
- We process what we need to sell, deliver and check licenses: your email and order details, your key, device identifiers, app version and operating system, and IP addresses.
- The public website uses cookieless Cloudflare Web Analytics. Only signing in to your account sets a cookie, which keeps you signed in. No advertising, no cross-site tracking. The app contains no usage analytics.
1. Applicability
This privacy policy covers the rikuflow.com website, your account (sign-in, trials, licenses, devices, support requests), license purchases, and the license and update checks made by the RikuFlow app. By using our services, you agree to the terms outlined in this policy.
The controller is TMNSolutions Co., Ltd., tax ID 1501107563, 65 Phan Van Quan, Thanh Phuoc Ward, Binh Minh Town, Vinh Long, Vietnam.
2. Information Collected
We collect the following types of information:
- Personal identifiers (name, email address, country)
- Order data (order number, product, amount, refund status), received from Lemon Squeezy
- License and device data (key and license id, device identifier, device name if you set one, app version, operating system and architecture)
- Account data (sign-in times, your Google account id if you sign in with Google)
- Support requests (your messages and attachments, and, from the app, its version, operating system and recent log lines you chose to include)
- Usage data of the website and license server (IP address, request time, aggregate page views)
In detail:
| Situation | Data | Purpose | Legal basis |
|---|---|---|---|
| You buy a license | Name, email, country, order number, product, amount, refund status (received from Lemon Squeezy) | Issue and email your key, handle renewals, refunds and support, keep business records | Contract; legal obligation (accounting and tax) |
| You sign in to your account (the first sign-in creates it), on the website or in the app | Email, IP address, sign-in time; in the app: a 6-digit code we email you (only a keyed hash is stored, it expires after 10 minutes) and the device identifier and name; with Google: your Google account id and verified email (we receive no Google password or contacts) | Create and show your account, its licenses, orders and devices, email your keys again, approve “Sign in to activate”, prevent abuse of sign-in | Contract (steps at your request); legitimate interest (security) |
| You start a trial (in your account or in the app) | Email, time, IP address | Issue the trial key, enforce one trial per email, prevent abuse | Contract (steps at your request); legitimate interest (abuse prevention) |
| You approve “Sign in to activate” | The device’s name, operating system and app version shown on the approval page, the license you pick | Activate RikuFlow on that computer | Contract |
| You send a support request (from your account or from the app’s Report a problem) | Your messages and attachments; from the app: app version, OS, the license it runs under, and the log lines you left ticked, with keys and tokens masked before sending | Answer and fix the problem | Contract; legitimate interest |
| The app activates or checks for updates | Key and license id, device identifier (a random id plus a hash of the OS user and machine id), device name if you set one, app version, OS and architecture, IP address, time | Enforce device limits, deliver updates you are entitled to, detect revoked keys, security | Contract; legitimate interest (security, preventing key abuse) |
| You email us | Your message and address | Answer you | Legitimate interest; contract |
| You visit the website | Aggregate page views, referrer, country, browser and device type (Cloudflare Web Analytics, no cookies); short-lived server request logs | Understand which pages help, keep the site secure | Legitimate interest |
What we never receive
Your projects, prompts, generated or uploaded media, transcripts, provider API keys, and anything else you create in RikuFlow. Backups you make stay wherever you save them.
3. Information Usage
We use your information for:
- Issuing, delivering and verifying license and trial keys
- Delivering the updates you are entitled to
- Handling renewals and refunds, and keeping business records
- Preventing abuse of trials, keys, sign-in and forms
- Customer support, including the support requests you send
- Understanding which website pages help (aggregate, cookieless analytics)
We do not sell personal data, and we do not use it for advertising or to train AI models.
4. Information Disclosure
Data sharing occurs with:
- Our service providers, listed below
- Third-party AI providers, only from your own computer and only when you run a node with them (where API keys or accounts are provided by you)
- Legal compliance requirements
- Protection of user safety and rights
| Provider | Role | Data |
|---|---|---|
| Lemon Squeezy (and its payment partners, such as Stripe) | Merchant of record: checkout, payment, tax, invoices, refunds. For payment data it acts under its own privacy policy. | Order and payment data |
| Our hosting provider | The server that runs the website, accounts, license server and support, and its database | License, order, device, account and support records, IP addresses, request logs |
| Cloudflare | Download storage (R2), cookieless Web Analytics | IP addresses, request logs |
| “Sign in with Google”, only if you choose it | Your sign-in with Google, under Google’s own privacy policy | |
| Emailit | Sending transactional email (keys, sign-in links and codes, download links, support replies, receipts of requests) | Email address and message content |
Each processes data on our behalf under a data processing agreement, except where stated as an independent controller.
AI providers you connect receive the inputs of the nodes you run with them and process them under their own privacy policies. We are not involved in that exchange. A workflow is entirely local only when every node in it runs locally.
5. Security Measures
We implement technical and organizational protections against unauthorized access and disclosure. Keys are signed, sign-in links are single-use and expire after 15 minutes, sign-in codes are single-use, expire after 10 minutes and stop working after 5 wrong tries, staff access to admin tools requires two-factor authentication and is logged, and the app verifies every update’s signature and checksum before installing it.
6. Data Storage & International Transfers
License, account and support records are stored on our hosting provider’s server. Our providers may process data outside Vietnam and outside your country, including in the United States and the European Union. Where required, transfers rely on appropriate safeguards such as standard contractual clauses offered by the provider. Data goes to AI providers only when you configure and run them yourself, from your own computer.
7. User Rights
Depending on your jurisdiction, you may have the following rights:
- Data access
- Data correction
- Data deletion
- Processing restrictions and objection
- Data portability
- Withdrawal of consent where processing relies on it
You can also complain to a data protection authority. To exercise any of these rights, email us from the address linked to your license. We may need to keep some records (for example, invoices) where the law requires it, and deleting license records ends the ability to show, email or verify that key.
8. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law.
| Data | Retention |
|---|---|
| License, order and activation records | While the license exists, then as long as accounting and tax law requires |
| Trial records | While needed to enforce one trial per email |
| App sign-in codes | Deleted a day after they expire |
| Device records | Until the device is deactivated, then a limited period for security and dispute handling |
| Emails and support requests | As long as needed to handle the request and keep a record of it |
| Server request logs and analytics | Server logs for a limited period for security; analytics as set by Cloudflare and aggregate |
9. Children’s Privacy
Our services are not intended for individuals under 16 years of age. We do not knowingly collect data from children.
10. Policy Updates
Changes to this policy are posted on this page with an updated date, and material changes are communicated by email to customers with a license.
11. Contact Information
For questions or concerns about this privacy policy, please email [email protected] or use our contact form.