Privacy notice

Updated 27 October 2026

MakeFlow is a hosted service for makers and studios, with a web app and a companion app. GoldenBerry Software OÜ operates the service. This notice covers the website, early access and your use of MakeFlow.

Who is responsible

GoldenBerry Software OÜ is responsible for account administration, security, billing and product measurement. Our address and contact details are below. When a studio stores information about its customers, suppliers or team, that studio decides why it uses that information; we process it to provide its requested service. If a studio entered your information, contact that studio or ask us to help route your request.

Information we process

• Accounts: email address, profile, studio memberships, settings and authentication records. Email verification codes and session or device credentials provide access.
• Workshop content: materials, products, customers, suppliers, orders, production activity, checklists, notes, files, receipts and financial records you add. These may contain other people's personal information.
• Communications: early-access details, support messages and, when you use connected email features, recipients, messages, attachments and delivery outcomes.
• AI requests: text, images, documents or audio needed for the feature you invoke, relevant workshop context and tool results. Voice features process audio and may produce transcripts.
• Billing and usage: subscription status, payment references, invoices, allowance admissions and AI consumption measurements. Payment processors handle full card details.
• Technical data: account and studio identifiers, feature use, outcomes, timing, device or browser information and error or security records. Infrastructure providers also receive connection information such as your IP address.

Why we use information

We use information to authenticate access, save your work, carry out authorized actions, administer subscriptions and provide support. Processing necessary for those services is based on our agreement with you. An email address is needed to sign in; workshop content and optional device permissions depend on the features you choose.

We use operational information to prevent abuse, investigate errors and improve reliability. Where we rely on legitimate interests, those interests are securing and improving MakeFlow and resolving disputes, subject to your rights. We also retain information needed to meet legal accounting and other obligations. Where consent is required, it is a separate basis: accepting terms does not replace that choice, and consent can be withdrawn.

AI and voice

MakeFlow sends information needed for AI requests to configured providers. OpenAI supports configured chat, extraction and voice features; Exa supports web research when enabled. Relevant request content leaves your device. Submit only information you are entitled to process, and review generated answers and changes.

Chippy can read and change records through tools within your account's permissions. An authorized action may already have saved when a conversation is interrupted. Microphone permission is controlled by your browser or operating system and can be revoked in device settings.

A separate AI usage ledger retains account and studio identifiers, feature, provider, model, measurements, timestamps and outcomes. It excludes prompt, response and receipt bodies. It supports allowances, cost analysis and reconciliation; product analytics is not the billing source. Recording usage does not itself create a metered charge.

Analytics and session recording

MakeFlow uses PostHog EU for product measurement, reliability diagnostics, feature flags and feedback. Measurement is enabled by default in configured cloud environments. Events use opaque account and studio identifiers; they are not anonymous. Events describe features, action outcomes, timing and AI model or usage metadata.

Analytics payloads are designed to exclude customer names and contact details, workshop content, AI prompts and answers, receipt contents, payment details and private file links. Sampled session recordings help identify navigation and interaction problems. Recording is configured to mask text and inputs and mask or block images and private media. Network bodies, headers and console content are excluded. Browser interactions and scrolling can contribute to heatmaps.

Browser and companion analytics can store identifiers and tracking state on your device. Existing analytics opt-out choices are preserved, and supported browser flows honor Do Not Track. Native devices have different controls. Contact us about objections or other privacy requests. Tracking is subject to applicable consent requirements; using MakeFlow is not a substitute for consent where required.

Providers and sharing

Hosting, database and private-file infrastructure process workshop information to operate MakeFlow. Resend processes authentication and other email where configured. Stripe processes enabled purchases and subscription events. PostHog handles the measurement described above. AI and research providers process information needed for enabled features. Some integrations may be unavailable until activated.

Intended recipients receive information you send or share. We may disclose information when required by law or to protect the service and resolve claims. We do not sell workshop content or personal information to advertisers.

PostHog uses its EU service. Other providers may process information outside your country, including outside the EEA. Transfers must use an applicable legal mechanism, such as an adequacy decision or approved contractual safeguards. Contact us for the providers and safeguards applicable to your account.

Storage, security and retention

MakeFlow stores workshop information on servers and private file storage. It uses authenticated access, studio ownership checks and HTTPS for public connections. The companion stores scoped device credentials locally. No service can promise absolute security; keep your email account and devices secure.

Account and workshop records are retained to provide your account's service. Cancelling a subscription or signing out does not erase a workspace. Contact us to request account closure or deletion. Some operational records, including invoice numbering and AI usage audit entries, are retained separately from ordinary workshop records.

Retention depends on the record's purpose, your account relationship, outstanding payments or disputes, legal obligations and backup recovery needs. Deleted information may remain in backups until those copies expire. We do not promise immediate removal from every backup or automatic deletion of all audit records. You can request the retention information relevant to your data.

Early access and communications

Early-access details are used to manage your signup and contact you about access. You can ask us to remove your signup. Service messages, including sign-in codes and billing notices, support your account. Marketing messages have their own unsubscribe route. A studio contacting its customers through MakeFlow is responsible for its recipient permissions.

Your rights

Depending on applicable law, you can request access, correction, deletion, restriction or a portable copy of your personal information, and object to processing based on legitimate interests. You can withdraw consent without affecting earlier lawful processing. Contact us below; we may verify your identity and will respond within the applicable legal timeframe.

You can complain to your local supervisory authority or the Estonian Data Protection Inspectorate. You do not need to contact us first.

Children and changes

MakeFlow is intended for people managing maker businesses and studios, not children under 13. Contact us if you believe a child has supplied personal information. We will update the date when this notice changes and provide an appropriate notice of material changes.

Contact