Privacy Policy

1. Introduction

AssetFlux ("we", "us", "our") is a cloud-based remote asset management platform operated by an individual (osoba fizyczna) based in Poland. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our Service, including the web Dashboard, APIs, SDKs, CLI tool, and CDN. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) and applicable Polish and EU data protection laws.

2. Information We Collect

We collect information necessary to provide and improve the Service. The types of data we collect depend on how you interact with AssetFlux.

2.1 Information You Provide

• Account Information — Name, email address, and password provided during registration, as well as any profile details you choose to add.
• Payment Information — Billing details required for Paid Plans. Payment processing is handled by third-party payment providers; we do not store full credit card numbers on our servers.
• Content Data — Digital assets (such as images and files) that you upload to the Service for management and delivery.
• Communications — Information you provide when contacting our support, submitting feedback, or responding to surveys.

2.2 Information Collected Automatically

• Usage Data — Information about how you interact with the Service, including API calls, SDK usage patterns, asset delivery statistics, and feature usage within the Dashboard.
• Device Information — Browser type and version, operating system, device type, and screen resolution when accessing the Dashboard or landing page.
• Log Data — Server logs including IP addresses, request timestamps, HTTP methods, response codes, and referrer URLs for security and diagnostic purposes.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, operate, and maintain the Service, including hosting and delivering your assets through our CDN.
• To authenticate your identity, manage your Account, and process payments for Paid Plans.
• To monitor usage, enforce rate limits, and ensure the security and integrity of the platform.
• To communicate with you about service updates, maintenance windows, billing, and support requests.
• To analyze usage patterns and improve the Service, including the performance of our APIs, SDKs, and Dashboard.

4. Legal Basis for Processing

Under the GDPR, we process your personal data based on the following legal grounds: (a) performance of a contract — processing necessary to provide you with the Service as agreed in our Terms and Conditions; (b) legitimate interests — processing for security monitoring, fraud prevention, service improvement, and analytics, where these interests are not overridden by your rights; (c) consent — where you have given explicit consent, such as for optional marketing communications; and (d) legal obligation — where processing is required to comply with applicable laws and regulations.

5. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data to third parties. We may share your information only in the following limited circumstances: with trusted third-party service providers who assist us in operating the Service (such as cloud hosting, CDN infrastructure, payment processing, and email delivery), subject to contractual obligations to protect your data; when required by law, regulation, legal process, or enforceable governmental request; or to protect the rights, safety, or property of AssetFlux, our users, or the public.

All third-party service providers are selected for their commitment to data security and GDPR compliance. We enter into data processing agreements with providers who handle personal data on our behalf, ensuring appropriate safeguards are in place.

6. Cookies and Tracking Technologies

AssetFlux uses cookies and similar technologies to operate and improve the Service. You can manage your cookie preferences through your browser settings. Disabling essential cookies may affect the functionality of the Service.

7. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy or as required by law. Account information is retained for the duration of your active Account. Upon Account deletion, your personal data and uploaded Content are permanently removed after a 30-day grace period.

Server logs and usage analytics are retained for up to 12 months for security and diagnostic purposes, after which they are anonymized or deleted. Payment records may be retained for up to 5 years to comply with applicable tax and accounting regulations.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit (TLS/HTTPS), secure storage of credentials using industry-standard hashing algorithms, regular security assessments, and access controls limiting data access to authorized personnel only.

9. Your Rights

Under the GDPR and applicable EU data protection laws, you have the following rights regarding your personal data. To exercise any of these rights, please contact us at privacy@assetflux.io.

• Right of Access — You have the right to request a copy of the personal data we hold about you.
• Right to Rectification — You have the right to request correction of inaccurate or incomplete personal data.
• Right to Erasure — You have the right to request deletion of your personal data, subject to legal retention obligations.
• Right to Data Portability — You have the right to receive your data in a structured, commonly used, and machine-readable format.
• Right to Object — You have the right to object to processing based on legitimate interests or for direct marketing purposes.

10. International Data Transfers

Your personal data is primarily processed and stored within the European Union. In cases where data may be transferred to third-party service providers located outside the EU/EEA, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission or adequacy decisions, to provide a level of data protection consistent with the GDPR.

CDN delivery of your Content may involve caching on edge servers in various geographic locations to ensure optimal performance. This caching is a technical function of the delivery infrastructure and is covered by our data processing agreements with CDN providers.

11. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a person under 18, we will take prompt steps to delete that information. If you believe that a child has provided us with personal data, please contact us at privacy@assetflux.io.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will provide at least 30 days' advance notice of material changes by email or through a notification in the Dashboard. Your continued use of the Service after the updated Privacy Policy takes effect constitutes your acknowledgment of the changes.

13. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about how your personal data is handled, please contact us: