1. Information we collect
Information you give us
- Waitlist signups. When you request early access we store your email address, the page you signed up from, and the time of signup.
- Account information. When you create an account we store your name, email address, and a salted, one-way hash of your password. We never store your password in plain text. If you sign in with Google, we receive your name, email address, and profile picture from Google; we never see your Google password.
- Design content. The text prompts you write, the parametric models generated from them, edit history, and files you export (STEP, STL, GLB).
- Communications. Anything you send us by email, including support requests.
Information collected automatically
- Usage and telemetry. Events such as generation requests, success/failure of a model build, request timing, and feature usage. We use this to fix failures and improve model quality.
- Log data. IP address, browser type, device information, request identifiers, and timestamps, kept in standard server logs for security and debugging.
- Local storage. We use your browser's local storage to remember your theme preference and to keep you signed in (authentication tokens). We do not use third-party advertising cookies or cross-site trackers.
2. How we use your information
- To provide, operate, and secure the Service — including authenticating you, generating and storing your models, and serving your exports.
- To contact you about early access, service announcements, and important account or security notices.
- To diagnose failures and improve generation quality, including analysing which prompts fail to build and why.
- To enforce our Terms of Service, prevent abuse, and comply with legal obligations.
Your designs are yours. We do not claim ownership of your prompts or the models generated from them, and we do not use your private designs to train models available to other customers without your explicit consent. See the Terms of Service for details.
3. Who we share it with
We do not sell or rent personal data. We share it only with the service providers ("subprocessors") that run our infrastructure, each bound to process data only on our instructions:
| Provider | Purpose | Data involved |
|---|---|---|
| Vercel | Website and app hosting, content delivery | IP address, request logs |
| Modal | API compute — runs the generation service | Prompts, generated geometry, request logs |
| Supabase | Managed database | Account data, waitlist emails, designs, telemetry |
| Optional "Sign in with Google" authentication and web fonts | Name, email, profile picture (only if you use Google sign-in) | |
| AI inference providers | Turning your prompt into a parametric model | The text of your prompt (not your account identity) |
We may also disclose information if required by law, to protect the rights and safety of our users, or as part of a merger or acquisition (in which case this policy continues to apply to data collected before the change).
4. Data retention
- Waitlist emails are kept until you receive access or ask to be removed.
- Account data and designs are kept while your account is active. If you delete your account, we delete or anonymise your personal data within 30 days, except where the law requires longer retention.
- Server logs are retained for up to 90 days for security and debugging, then deleted or anonymised.
5. Security
All traffic to the Service is encrypted with TLS. Passwords are stored only as salted one-way hashes. Database access is restricted, credentialed, and encrypted in transit. Our public endpoints are rate limited, and we log security-relevant events (sign-ins, password changes) to an audit trail. No system is perfectly secure — if we learn of a breach affecting your personal data we will notify you without undue delay.
6. Your rights
Depending on where you live (including under India's Digital Personal Data Protection Act, 2023, the EU/UK GDPR, and similar laws), you have the right to:
- Access the personal data we hold about you and receive a copy of it;
- Correct inaccurate or incomplete data;
- Delete your data ("right to erasure"), including your waitlist entry or your entire account;
- Object to or restrict certain processing, and withdraw consent where processing is based on consent;
- Complain to your local data protection authority.
To exercise any of these rights, email sahilmaniyar@orionflow.in from the address associated with your account. We respond within 30 days.
7. Children
The Service is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.
8. International transfers
Our infrastructure providers may store and process data in regions outside your country (including Australia, the United States, and the European Union). Wherever data is processed, we require protections consistent with this policy.
9. Changes to this policy
We may update this policy as the Service evolves. If we make material changes we will update the date at the top of this page and, where changes significantly affect you, notify you by email or an in-product notice before they take effect. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.
10. Contact
OrionFlow · Established 2026
Questions, requests, or complaints about privacy: sahilmaniyar@orionflow.in