Effective date: April 28, 2026 · Last updated: April 28, 2026
10xFlow ("we", "our", "us") is committed to protecting your personal data and respecting your privacy. This policy explains what data we collect, why, how we store it, and what rights you have — in compliance with the Lei Geral de Proteção de Dados (LGPD, Law 13.709/2018) and applicable international standards.
1. Who We Are
10xFlow is an online education platform teaching AI workflow augmentation methodology. We are the data controller for all personal data processed through this service.
Account data: your email address, collected at purchase via our payment processor (Lemon Squeezy).
Session data: workflow mapping sessions you create in the Workflow Mapper app — including workflow names, step descriptions, and the structured data you enter during mapping.
Usage data: server logs (IP address, timestamp, HTTP method, path) retained for up to 30 days for security and debugging.
Payment data: processed entirely by Lemon Squeezy. We never store card numbers or full payment details.
3. Why We Process Your Data (Legal Basis)
Contract performance (LGPD Art. 7, II): to provide the course and Workflow Mapper access you purchased.
Legitimate interest (LGPD Art. 7, IX): server logs for security monitoring and fraud prevention.
Consent (LGPD Art. 7, I): if you opt into communications or voluntary data sharing features (e.g., the anonymous pattern bank).
4. How Long We Keep Your Data
Account access token: retained until you request deletion or 24 months of inactivity.
Workflow sessions: retained until you delete them or 24 months from last use.
Server logs: automatically deleted after 30 days.
Anonymous bank contributions: de-identified permanently — no link to your account.
5. Data Sharing
We do not sell your data. We share data only with:
Lemon Squeezy — payment processing. Their privacy policy applies to purchase data.
Anthropic (Claude API) — the AI that powers the interview in the Workflow Mapper. Your workflow data and messages are sent to Anthropic's API to generate responses. Anthropic's privacy policy governs that processing.
Infrastructure providers — server hosting (VPS). Data is stored within the EU/Brazil or equivalent jurisdictions.
Anonymous, de-identified pattern data contributed to the AS-IS bank is never linked to any individual.
6. Your Rights (LGPD)
Under the LGPD you have the right to:
Access — request a copy of the personal data we hold about you.
Correction — request correction of inaccurate data.
Deletion — request deletion of your data (subject to legal retention requirements).
Portability — receive your data in a structured, machine-readable format.
Withdraw consent — where processing is based on consent, withdraw it at any time.
Object — object to processing based on legitimate interest.
Lodge a complaint — with the ANPD (Autoridade Nacional de Proteção de Dados) at www.gov.br/anpd.
To exercise any of these rights, email privacy@10xflow.io. We will respond within 15 days.
7. Cookies and Local Storage
txflow_sess (cookie): an HttpOnly, SameSite=Lax session cookie used to authenticate your access. Expires in 30 days. Strictly necessary — no consent required.
10xf_key (localStorage): your Anthropic API key, stored only in your own browser. We never receive or store this on our servers.
We do not use tracking cookies, analytics cookies, or advertising cookies.
8. Security
We use HTTPS (TLS 1.2+) for all connections, HttpOnly cookies, Content Security Policy headers, rate limiting, and server-side input validation. Session files are stored on a private server not accessible to the public.
9. Children
This service is intended for professionals aged 18 and over. We do not knowingly collect data from minors.
10. Changes to This Policy
If we make material changes, we will update the "Last updated" date above and notify registered users by email where required by law.
Data Controller Contact
10xFlow · privacy@10xflow.io
For data rights requests, include "LGPD Request" in the subject line.