Privacy Policy

The controller of your personal data is [LEGAL ENTITY], [ADDRESS], [COUNTRY], registered under [COMPANY NUMBER] (“MassFlow”, “we”).

For any question about this policy or your data, write to hello@massflow.app. We answer within one month, as the GDPR requires.

This policy covers this website, massflow.app. Creating an account takes you to the MassFlow application on a separate domain; the data processed there is described in section 8 and, where it differs, in the application’s own policy.

We measure how this page is used so we can make it better: which sections people read, which buttons they click, which questions they open in the FAQ, and where they leave. We use PostHog, on servers located in the European Union.

Until you make a choice in the banner, and if you decline, PostHog runs in cookieless mode: we still count visits, but nothing is stored on your device and you are identified only by a short-lived hash computed on PostHog’s servers. No cookie, no local storage, no session recording, and no way for us to recognise you on a later visit.

If you accept, we additionally:

• store an identifier on your device, so we can tell a returning visitor from a new one;
• record your browsing session — a reconstruction of the pages as you saw them, your mouse movements, scrolling and clicks. Anything typed into a form field is masked before it leaves your browser;
• build heatmaps of clicks and scroll depth for each page, in aggregate;
• pass that identifier to the MassFlow application if you click a signup link, so we can tell whether visits to this page turn into accounts.

In every case we also receive technical data your browser sends: IP address, browser and operating system, screen size, referring page, and any campaign parameters in the link you followed (“utm_source” and similar). Your IP address is used to derive an approximate location — country and city — and is not stored alongside the events.

We do not sell this data, do not use it for advertising, and do not share it with advertising networks. We do not attempt to identify you personally from it.

If your browser sends a “Do Not Track” signal, we honour it and capture nothing at all.

We set nothing until you accept. If you do, the following are stored on your device:

If you decline, only your refusal is remembered — and it is remembered without a cookie.

You can change your mind at any time — here, or through the Cookies link at the bottom of the home page. Either clears your answer and asks again. Withdrawing is as easy as accepting was, and does not affect the lawfulness of what we did before.

• Consent (GDPR Article 6(1)(a)) for the cookie, the session recordings and the heatmaps. You give it in the banner and can withdraw it at any time.
• Legitimate interest (Article 6(1)(f)) for cookieless audience measurement and for keeping the site secure and working. Our interest is knowing whether this page does its job; the impact on you is minimal, since nothing is stored on your device and you are not identified.
• Performance of a contract (Article 6(1)(b)) for anything related to an account or a subscription.

We use a small number of providers, who process data on our instructions and for no purpose of their own:

• PostHog— product analytics and session recording, on European Union infrastructure. PostHog, Inc. is established in the United States and may access the data as our processor for support and maintenance; that access is covered by the European Commission’s Standard Contractual Clauses.
• [HOSTING PROVIDER] — serves this website. Server logs, including IP addresses, are kept for [LOG RETENTION] for security purposes.
• [PAYMENT PROCESSOR] — handles subscriptions and card details for the application. We never see or store your card number.

We do not otherwise disclose your data, except where the law requires it.

• Analytics events: [ANALYTICS RETENTION, e.g. 12 months].
• Session recordings: [REPLAY RETENTION, e.g. 30 days] — deliberately shorter, because they are the most detailed thing we hold.
• Your answer to the consent banner: until you clear it, and in any case we ask again after 13 months.
• Emails you send us: [EMAIL RETENTION] after our last exchange.

Signing up takes you to the MassFlow application. There we process the data needed to provide the service: your email address, your account and billing details, the media and templates you upload, and the videos generated from them. That content is yours; we process it to run the service and do not use it to train models or share it with anyone else. [CONFIRM AGAINST THE APPLICATION BEFORE PUBLISHING.]

Under the GDPR you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider. You may withdraw consent at any time. Exercising any of these costs nothing and requires no justification — write to hello@massflow.app.

If you think we have handled your data badly, you can complain to your national data protection authority — in France, the CNIL. We would rather you told us first, but it is your right either way.

MassFlow is a tool for professional use and is not directed at people under 16. We do not knowingly collect their data.

If we change what we collect, we will update this page and the date at the top. If the change is material — a new purpose, a new processor — we will ask for your consent again rather than assume it.