1.1. This Privacy Policy explains how personal data is handled in connection with the VengoFlow service (the Site www.vengoflow.com and the App www.vengoflow.com/app; the “Service”).
1.2. For international customers, the data controller is Pixel Rainbow Inc. (“we”, “us”), 700 North Fairfax Street, STE 614, Alexandria, Virginia 22314, USA. Contact for privacy matters: support@vengoflow.com.
1.3. By using the Service (registering, signing in, placing data), you acknowledge this Policy, which is part of our Terms of Service.
2.1. Account data: your email address (used for one-time-code sign-in and service notifications).
2.2. User Content: the contents of your projects, boards, task cards, notes, checklists, labels, deadlines, and the files and links you upload. You decide what this contains; it may include personal data if you enter it.
2.3. Technical and usage data: IP address, browser and device information, dates and times of access, activity logs, and cookie / local-storage data — to the extent needed to operate, secure, and diagnose the Service.
2.4. Payment data: the fact and parameters of a subscription (plan, amount, period) and identifiers issued by our payment processor. We do not receive or store your full card details — these are handled by Stripe in accordance with the PCI DSS standard.
2.5. Calendar-integration data (only if you connect it): access tokens issued by the external calendar service and the identifier of the calendar our Service creates. Tokens are stored on the server side only and are never exposed to the browser. We request the minimum scope (access only to the calendar our Service creates; we do not request access to your other calendars).
2.6. We do not intentionally request or process special categories of personal data or biometric data. Please do not place such data in your User Content.
3.1. We use personal data to:
3.2. We do not sell personal data, and we do not use it to send you third-party advertising.
4.1. Where the EU/UK GDPR applies, we rely on: performance of a contract (providing the Service and billing); your consent (for optional integrations and non-essential analytics); our legitimate interests (security, fraud prevention, improving the Service); and compliance with legal obligations.
5.1. To run the Service, we use third-party providers (processors), each receiving only the data needed for its function:
5.2. We may disclose personal data to competent authorities where required by law, or to protect our rights and the security of the Service.
6.1. Your data may be processed in the United States and other countries where we and our providers operate. Where data is transferred from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) and equivalent mechanisms.
7.1. The Service uses cookies and browser local storage for essential technical purposes: maintaining your sign-in session, preserving sign-in form state (while a one-time code is valid), and interface settings. Sign-in is not possible without these technologies.
7.2. The Site uses the Yandex Metrica web analytics service to measure traffic and key actions (sign-up, plan payment) in an anonymised and aggregated form. No advertising trackers are used. Session recording (Webvisor) and click maps are enabled only on public pages of the Site; inside the App they are disabled, and the content of your tasks, notes, and files is never sent to analytics.
7.3. You can restrict cookies in your browser settings; doing so may make the Service unusable.
9.1. We take reasonable technical and organizational measures to protect personal data, including:
9.2. No method of transmission or storage is completely secure; we cannot guarantee absolute security.
10.1. You may create a public view-only link to a card or project (vengoflow.com/s/<token>). Content opened via such a link becomes viewable by anyone who holds the link, without registration.
10.2. You decide whether to share and bear the risk of further distribution of the link. You can disable a Public Link at any time; access then stops. Public-link pages are closed to search-engine indexing.
11.1. Subject to applicable law, you may request access to, rectification of, erasure of, restriction of, or portability of your personal data; object to certain processing; and withdraw consent at any time. You also have the right to lodge a complaint with your data-protection supervisory authority.
12.1. If you are a California resident, subject to the CCPA/CPRA you may request to know, access, delete, or correct your personal information, and to opt out of the “sale” or “sharing” of personal information — although we do not sell or share personal information as those terms are defined. We will not discriminate against you for exercising your rights.
13.1. Send requests to support@vengoflow.com from the email address of your Account (so we can verify ownership of the data). Withdrawing consent and deleting your Account end your access to the Service; data processed on other legal bases (for example, billing records) is retained for the periods required by law.
14.1. The Service is intended for people aged 18 and over. We do not knowingly collect data from minors; if we learn that such an Account exists, it will be deleted on the request of a parent or guardian.
15.1. We may update this Policy by publishing a new version on the Site with the effective date. Changes take effect upon publication unless stated otherwise. Your continued use of the Service constitutes acceptance of the new version.
Pixel Rainbow Inc.
700 North Fairfax Street, STE 614, Alexandria, Virginia 22314, USA
Privacy, legal and support: support@vengoflow.com