Privacy Policy

• Account. Your email address, to create your account and sign you in. Legal basis: performing our contract with you.
• Your content. What you create or upload in the tools, such as diagrams, brand settings, images, fonts, products, tasks, reports and imported files. Legal basis: performing our contract with you.
• Contact data you import (Audience Clarity). Contact lists you upload or sync from Zoho Campaigns or Klaviyo. For this data we act as your processor or service provider: you decide why it is used and are responsible for having the right to use it. A data processing agreement is available on request.
• Integration credentials. Zoho access tokens and Klaviyo API keys you connect, stored encrypted and used only for read-only access to your own data.
• Technical data. IP address, browser and device details, and request logs created when you use the service, to run and secure it. Legal basis: legitimate interests.
• Analytics. How the site is used. If you accept analytics cookies, Google Analytics and Microsoft Clarity (page views, clicks and session recordings) run in full. Legal basis: consent. If you haven't accepted, or you decline, Google Analytics is limited to cookie-less measurements: the page address, a timestamp and basic browser and device details, with no cookies or persistent identifiers. Legal basis: legitimate interests in understanding overall use of the site.

Videos. The Video Background Remover works in your browser. We don't save your videos or frames to our database or storage. A few sampled frames, or every frame in Cloud HD mode, are sent through our servers to the AI providers listed below to process them.

• Essential. Sign-in session cookies and a note of your cookie choice stored in your browser. These are required for the service to work and don't need consent.
• Analytics. Google Analytics (through Google Tag Manager) sets cookies only if you accept; otherwise it is limited to the cookie-less measurements described above. Microsoft Clarity runs only if you accept, and may also set a Microsoft cookie.

You can change your choice at any timeCookie settings. We treat the Global Privacy Control signal from your browser as a decline.

We use these service providers to operate Shapeflux Labs. We don't sell your personal data or use it for advertising.

• Supabase: database, sign-in and file storage (hosted in the United States).
• Render: application hosting.
• Resend: delivery of sign-in emails.
• Cloudflare: Turnstile, which checks that sign-in requests come from a real person and not a bot.
• Anthropic: AI generation of diagrams and icons from your prompts and reference images, and short summaries of audience statistics. For audience analysis, only column names, value-format summaries and aggregate counts are sent, not contact rows.
• Google: Gemini, for scene analysis of sampled video frames; and Analytics and Tag Manager (full measurement if you consent, cookie-less measurement otherwise).
• Replicate: background removal on sampled frames, or every frame in Cloud HD mode.
• Microsoft: Clarity analytics, if you consent.
• Zoho and Klaviyo: only if you connect your account.

We may also disclose data where the law requires it, or to protect our rights and users.

Our hosting and database are in the United States, and our providers may process data in other countries. Where the law requires, we rely on safeguards such as standard contractual clauses.

We keep your account and content until you delete them or ask us to. Technical logs are kept only as long as needed for security and troubleshooting. Analytics data is kept according to each provider's settings.

Depending on where you live (for example under the GDPR, UK GDPR, CCPA/CPRA or LGPD), you may have the right to access, correct, delete or export your data, to object to or restrict certain processing, to withdraw consent, and not to be discriminated against for using these rights. We don't sell or share personal data for cross-context behavioral advertising. To make a request, email hi@shapeflux.com; we may need to verify your identity and will reply within the time the law allows. You can also complain to your local data protection authority.

We use encryption in transit, encrypt stored integration credentials, and limit access to data. No online service is completely secure, so please use a unique sign-in email and keep your account safe.

Shapeflux Labs isn't directed to children under 16, and we don't knowingly collect their data.

We'll update this page when our practices change and revise the date above.