Privacy Policy

Last updated August 19, 2026

This Privacy Policy explains what information StudioFlow collects, why, and the choices you have about it. It applies to studioflow.sunstave.com, accounts.sunstave.com, and the StudioFlow Studio plugin.

1. Information we collect

We collect information tied directly to how StudioFlow actually works:

Account information: your name, username, email address, and password (stored as a secure hash, never in plain text).
Profile information: a bio and profile picture, if you add one, including a Roblox avatar image if you connect Roblox.
Roblox account information: if you connect Roblox, your Roblox user ID, username, display name, avatar image, and the OAuth tokens needed to keep that connection working (see Section 5).
Project data: the projects, blueprint sections, roadmaps, tasks, comments, and team membership you create in StudioFlow.
Uploaded files and generated content: images, documents, and other assets you upload, and the text/prompt outputs StudioFlow's generation features produce for your projects.
Usage and log information: pages visited, actions taken, approximate timestamps, IP address, browser/device information, and similar technical data, used mainly for security and reliability.
Subscription and billing status: your plan, subscription status, billing interval, and renewal dates, received from our payment provider — see Section 4 for what we do and do not store directly.
Support communications: anything you send us when you contact support.

2. How we use it

We use the information above to: provide and operate StudioFlow (authentication, project features, Roblox and Studio-plugin integration, AI-assisted generation); manage subscriptions, usage credits, and billing; maintain security and prevent fraud or abuse; provide customer support; and improve the product. Where we rely on your consent for a particular use (for example, connecting your Roblox account), you can withdraw that consent at any time, as described in Section 5.

3. AI providers

When you use a generation feature (blueprint, roadmap, task expansion, creative generation, or the project assistant), the relevant prompt — built from your project's name, description, and the context you provide — is sent to the AI provider configured for this StudioFlow deployment (for example, Anthropic or an OpenAI-compatible provider such as Groq) in order to generate a response. We do not control that provider's internal data handling beyond what our agreement with them and their own privacy terms specify, and we encourage you to avoid pasting sensitive personal information into a generation prompt that doesn't need it.

4. Payment providers

Paid subscriptions are processed by our payment provider, Paddle, acting as merchant of record. StudioFlow does not receive or store your full card number — Paddle handles payment collection directly. We receive and store information back from Paddle such as your subscription status, plan, billing interval, renewal dates, and a Paddle-assigned customer/subscription identifier, so we can grant the right access and show you accurate billing information.

5. Roblox

If you connect a Roblox account, we obtain your Roblox user ID, username, display name, and avatar image through Roblox's OAuth sign-in flow, with your explicit authorization at the time you connect. Roblox has its own privacy practices governing the data it holds about you, separate from StudioFlow's. You can disconnect your Roblox account at any time from your Profile page, which removes the stored connection from StudioFlow and attempts to revoke the associated access token with Roblox.

6. Cookies

StudioFlow uses a small number of essential cookies: a session cookie (so you stay signed in across studioflow.sunstave.com and accounts.sunstave.com) and a preference cookie for your light/dark theme choice. We do not use third-party advertising or tracking cookies. If we ever add optional analytics cookies, this section will be updated to describe them and how to opt out.

We share information only where necessary to run StudioFlow: with the AI provider configured for generation features (Section 3), with Paddle for billing (Section 4), with Roblox where you've connected your account (Section 5), with infrastructure providers who host our servers and database, and where required by law, to protect our rights, or to investigate fraud or abuse. We do not sell your personal information.

8. Data retention

We keep your information for as long as your account is active, plus a reasonable period afterward for security, legal, accounting, and dispute-resolution purposes. Some information may persist briefly in backups after deletion from the live system; we don't promise instant, permanent erasure across every backup copy, but backups are not used for anything other than disaster recovery and are cycled out over time.

9. Security

We use reasonable technical and organizational measures to protect your information — including password hashing, encrypted connections (HTTPS), CSRF protection, and access controls scoped to your project memberships — but no online service can guarantee absolute security. We do not claim any specific security certification.

10. International transfers

SunStave operates from India, and StudioFlow's infrastructure and third-party providers (hosting, AI, payments) may process data in countries other than your own. Where required by applicable law, we take reasonable steps to ensure such transfers are appropriately protected.

11. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to our processing of your personal information, to receive a copy of it in a portable format, or to withdraw consent where processing is based on consent. To exercise any of these, contact us at legal@sunstave.com. We will respond consistent with applicable law; we don't promise rights beyond what your jurisdiction actually requires.

12. Children

StudioFlow is not intentionally designed to collect personal information from children in violation of applicable law. If you are a parent or guardian and believe your child has provided us with personal information improperly, contact us at legal@sunstave.com and we will investigate and take appropriate action, which may include deleting the information.

13. Changes to this policy

We may update this Privacy Policy from time to time; the "Last updated" date above reflects the latest revision. For material changes, we'll provide reasonable notice through the product or by email.

14. Contact

Questions about this Privacy Policy can be sent to legal@sunstave.com.

Questions? Contact legal@sunstave.com.