Source: https://octet-prow.app/privacy

Legal

# Privacy Policy

Last updated: October 14, 2026 · Version 1.2

## 1. Personal information controller

This Privacy Policy explains how Octet Prow (the “Service”) collects, uses, shares, retains, and protects your personal information, and the rights you have. The controller of your personal information is Jin Bojin, an individual sole proprietor (“we”, “us”, or “our”), not a company or other organization.
This policy applies to the website octet-prow.app, the console, and related services, and forms part of our Terms of Service. For privacy questions, email support@octet-prow.app. For visitors to pages published with the Service, see “Visitors to published pages”.

## 2. Information we collect

We collect only the information needed to provide the Service:
- Account information: your email address, display name, and password (stored only as an argon2id hash, never in plain text). If you sign in with Google, we also receive your Google account email, name, profile picture, and account identifier.
- Organization and project information: organization names, project names and subdomains, and members and their roles.
- Content you submit and generate: chat messages, project briefs, product links and product information, uploaded images, and the copy, design systems, images, and pages the Service generates.
- Payment information: your subscribed plan, amount, billing period, and payment status. Payment card data such as full card numbers is handled by Waffo Pancake; we do not receive or store it.
- Shopify information: the store domain and the store access token (stored encrypted) when you connect a store.
- Communications: email correspondence between you and us.
- Device and network information: your IP address and browser information (user agent) when you sign in, and access logs recorded by our servers.
- Usage information: generations, token usage, publishing records, and similar data, used to calculate quotas and improve the Service.

## 3. How we use information and our legal bases

We use personal information for the following purposes:
- Providing and maintaining the Service (signing in, generating and publishing pages, hosting pages): performance of our contract with you.
- Billing, quota calculation, and subscription management: performance of our contract; keeping tax and accounting records: legal obligation.
- Customer support and handling your requests: performance of our contract.
- Service notices (account verification, password resets, billing, and changes to the Terms of Service or this policy): performance of our contract and legitimate interests.
- Security, fraud and abuse prevention, and enforcement of the acceptable use policy: legitimate interests and legal obligation.
- Website analytics and product improvement: legitimate interests, or your consent where the law requires it.
- Marketing: only with your consent. See “Marketing communications”.
We do not use your content or Generated Content to train AI models, and we do not make decisions that produce legal or similarly significant effects on you based solely on automated processing.

## 4. Cookies and local storage

We use the following cookies and browser storage:
- Strictly necessary: sign-in session cookies (prow_access_token and prow_refresh_token, which page scripts cannot read) and a one-time verification cookie used when connecting Shopify (prow_shopify_state). You cannot sign in without them, so they cannot be turned off.
- Functional: your interface language choice, saved in browser local storage (umi_locale), and temporary verification state used during Google sign-in (cleared when you close the tab).
- Analytics: cookies set on our website by Google Analytics (such as _ga) to measure visits and page usage. They are set only if you choose Accept in the cookie banner; until then, Google Analytics is not loaded. For information on how Google processes this data, please refer to the Google Privacy Policy (policies.google.com/privacy).
- Marketing: we do not use marketing or advertising tracking cookies.
You can change your choice at any time under Cookie settings at the bottom of our website; withdrawing consent deletes the Google Analytics cookies. You can also refuse or delete cookies in your browser settings, or install the Google Analytics Opt-out Browser Add-on (tools.google.com/dlpage/gaoptout). If you refuse strictly necessary cookies, you will not be able to sign in.

## 5. Visitors to published pages

Pages you publish with the Service are operated by you. For visitors to those pages, you are the controller of their personal information, and we host the pages on your behalf.
Unless you turn on ad pixels for a project as described below, we do not place any advertising tracking code or set cookies on published pages. Our hosting service and its providers (Cloudflare and Railway) may keep access logs needed for operation and troubleshooting, such as IP addresses, requested URLs, and timestamps. Published pages load fonts from Google Fonts, so visitors’ browsers send request information, including IP addresses, to Google.
If you enable Analytics for a project, pages published from that project afterwards include our internally developed script to measure page views. It sets no cookies, reads no browser storage, and does not track visitors across websites. We record the page path, referring website, country or region, and time of the visit. To estimate the number of unique visitors, we derive an irreversible hash from the visitor’s IP address and browser identifier, mixed with a random value that we rotate every day — so the hash cannot be traced back to a visitor, nor linked to the same visitor across days. We do not store raw visitor IP addresses. These statistics are available only to you and are retained for 90 days. You can disable Analytics at any time in your project settings; republish a page afterwards and it will no longer include the script.
If you add a Meta or TikTok pixel ID to a project, pages you publish in that project afterward load code from the corresponding ad platform. That code sets the ad platform’s own cookies (for example, Meta’s _fbp) and sends events such as page views, clicks on links to other websites, and successful form submissions to that platform. You and the ad platform process this data under your respective terms; we do not receive or store it. You can turn on “Ask visitors for consent before loading pixels”. When it is on, pixels do not load until a visitor selects Accept on the page, and the visitor’s choice is saved in their browser’s local storage. If you remove the pixel IDs and republish your pages, the code is no longer included.
If you collect personal information from visitors or add third-party tools to your pages, you are responsible for giving visitors appropriate privacy notices and obtaining any required consent.

## 6. Sharing and disclosure

We do not sell your personal information or share it with third parties for their advertising.
Payment card data is handled exclusively by our PCI-DSS compliant payment processor, Waffo Pancake, and is not stored on our servers.
We share personal information only in the following cases:
- Service providers: to operate the Service, we share information necessary for each provider to perform its role with Waffo Pancake (Merchant of Record: payments, taxes, invoicing, and refunds); Alibaba Cloud Model Studio (AI generation: chat messages, project briefs, page content, and attached images); Cloudflare (website and page hosting, content delivery, file storage, and DNS); Railway (backend hosting); Supabase (database); Resend (email delivery: email addresses and message content); Google (Google sign-in, Google Analytics, and Google Fonts); and Shopify (only if you connect a store).
- Members of the same project: your content in a project is visible to that project’s other members.
- Legal requirements: to comply with laws, court orders, or lawful requests from government authorities, or to protect the rights and safety of us, our users, or the public.
- Business transfers: if the Service is transferred, personal information may be transferred with it. We will notify you in advance and require the recipient to continue to honor this policy.
- With your consent: in any other case, we will ask for your consent before sharing.

## 7. International data transfers

Our servers and those of our providers may be located in the United States, Singapore, mainland China, and other countries or regions, so your personal information may be processed outside the country or region where you live.
The providers we use are bound by data processing agreements. For personal information from the European Economic Area, the United Kingdom, and Switzerland, we rely on safeguards such as the EU Standard Contractual Clauses (SCCs) offered by those providers. Where applicable law requires your separate consent for a cross-border transfer, we will ask for it separately.

## 8. Data security

We protect your personal information with measures including:
- Encrypting all data in transit with TLS (HTTPS).
- Storing passwords only as argon2id hashes, keeping sign-in tokens in cookies that page scripts cannot read, and storing only hashes of refresh tokens on our servers.
- Encrypting secrets such as Shopify store access tokens with AES-256-GCM and never sending them to the browser.
- Strictly limiting personnel access to production data and the scope of their access permissions.
If a security incident may affect your personal information, we will notify affected users and, where required by law, the relevant authorities within 72 hours of discovering it, describing what happened, the likely impact, and the steps we have taken.

## 9. Data retention

We retain personal information only for as long as necessary to fulfil the stated purposes:
- Account, organization, and project information: retained for the duration of your account, and deleted within 30 days after you request account deletion.
- Your content, Generated Content, and published pages: retained for the duration of your account. After your subscription ends, retained for at least 90 days; if you do not resubscribe within 90 days, they may be deleted after we notify you by email. Deleted within 30 days after you request account deletion.
- Sign-in session records (IP address and browser information): retained for the duration of your account for security investigations, and deleted with your account.
- Billing records (plan, amount, and dates, without card numbers): retained for 5 years after your subscription ends to handle disputes and meet tax and accounting requirements.
- Communications: retained for 2 years after our last exchange.
- Server access logs: usually retained for no more than 30 days.
- Backups: deleted data is removed from backups as they rotate, usually within 30 days.
When a retention period ends, we delete or anonymize the information, unless a longer retention period is required by law.

## 10. Your rights

Depending on the laws where you live (such as the Personal Information Protection Law of the People’s Republic of China, the EU General Data Protection Regulation, and the California Consumer Privacy Act), you may have the following rights:
- Access: to know how we process your personal information and to receive a copy of it.
- Correction: to correct inaccurate information. You can change your display name directly in Account settings.
- Deletion: to delete your account and personal information.
- Portability: to receive the personal information you provided to us in a commonly used electronic format.
- Restriction and objection: to restrict or object to processing based on our legitimate interests.
- Withdrawal of consent: to withdraw consent you have given, without affecting the lawfulness of processing before the withdrawal.
To exercise these rights, send an email to support@octet-prow.app from your registered email address. We will respond within 30 calendar days after verifying your identity. You also have the right to lodge a complaint with the data protection authority where you live.
We will not treat you differently for exercising any of these rights.

## 11. Marketing communications

We do not currently send marketing emails. If we send marketing emails in the future, we will first obtain your consent, and every marketing email will include an unsubscribe link so you can opt out at any time.
Service notices, such as account verification, password resets, billing, and changes to our terms or this policy, are necessary to provide the Service and are not affected by unsubscribing.

## 12. Children

The Service is intended for users aged 18 or older, and we do not knowingly collect personal information from anyone under 18. If you believe we have collected information from a minor, email support@octet-prow.app and we will delete it promptly.

## 13. Third-party links and services

The Service may link to third-party websites and services, such as Google sign-in, the Shopify admin, the Waffo Pancake checkout page, and pages published by other users. This policy applies only to information we collect directly. Third parties handle data under their own privacy policies, and we are not responsible for their practices.

## 14. Changes to this policy

We may update this policy and will update the date and version number at the top of this page accordingly. We will notify you of material changes by email or in-product notice at least 14 days before they take effect.

## 15. Contact us

For privacy questions, requests to exercise your rights, security incident reports, and customer support, email support@octet-prow.app. Correspondence sent to this address is handled personally by the operator. We usually respond within 2 business days, and we respond to rights requests within 30 calendar days.
Operator: Jin Bojin (individual sole proprietor). Website: octet-prow.app.
Operator: Jin Bojin (individual sole proprietor) · Website: octet-prow.app · Last updated: October 14, 2026