Privacy Policy

In short

• You can use the editor without an account. In that case, your projects stay only in your browser, on this device, and never reach us.
• A temporary link keeps the published tour for 7 days. After that, it is deleted.
• GuiaFlow Pro subscribers have an account with an email address. We keep the minimum needed for the account, the subscription, permanent links, and usage limits, plus your editor projects, which are saved to your account.
• Payment is made through Stripe. We do not receive or store your card details.
• We do not use advertising or cross-site tracking, and we do not sell data.
• If a published tour asks for your name, e-mail or phone, or if you use the contact form at the end, that data goes to the tour author, who is responsible for it. GuiaFlow only stores and delivers it on the author's behalf.
• On tours published with a permanent link by Pro subscribers, we count visits (how many people opened the tour, which step they reached and whether they clicked the final button) without cookies and without storing IP addresses. If your browser asks not to be tracked (“Do Not Track” or GPC), nothing is measured.

Who looks after your data

GuiaFlow is run by Gustavo Ariel Mistrinelli, an individual based in Brazil, who is the controller of the personal data processed in the service under the Brazilian General Data Protection Law (Law 13,709/2018, LGPD).

For any privacy matter, including exercising your rights, write to [email protected]. This is the channel for data subject requests.

Using it without an account: everything stays in your browser

The editor works without logging in. Projects, captured screens, texts, audio, and themes are kept in the browser's own storage (IndexedDB and localStorage), on this device. This content is not sent to GuiaFlow unless you publish a link.

The browser also keeps simple preferences, such as language, appearance, and notices you have already dismissed.

If you clear the site's data in your browser, the projects are gone. To keep a copy, use the project export.

If you add your own AI key (for example, OpenRouter) or voice key (Cartesia), the key is kept in the browser or in the desktop app, and requests go straight from your device to that provider, under its terms and policy. GuiaFlow does not receive that key.

Temporary links

When you create a temporary link, the tour content (title, screens, texts, and audio) is uploaded and stored in Vercel Blob, Vercel's file storage. No account is needed.

The link is valid for 7 days from the first publication. A daily routine deletes expired tours.

Anyone who has the link address can view the tour. Do not publish screens with passwords, customer data, or other information that should not be seen by whoever receives the link.

Chrome extension and desktop app

The “GuiaFlow — Captura” extension exists to take pictures of the product screens you want to show. It requests these Chrome permissions:

• activeTab, tabs, and scripting: see which tab is active and take a picture of it when you capture or click during a recording;
• storage and unlimitedStorage: keep the captures in Chrome itself until you create the project;
• downloads: save the project file, if you ask for it;
• access to guiaflow.pro: deliver the captures to the editor open in your browser.

A picture is only taken when you capture. The images stay in Chrome until you create the project, download the file, or cancel. The extension does not send captures to any server.

The desktop app only captures the window it opens itself and keeps projects on your computer.

GuiaFlow Pro account

When you subscribe to GuiaFlow Pro, we process this data:

• Email: identifies the account and receives the sign-in links;
• Password, if you create one: we only keep a cryptographic digest (hash), never the password itself;
• Name, optional: only when an administrator sends an invitation or grants complimentary access;
• Subscription data: plan, billing interval, status, end of the paid period, and the Stripe customer and subscription IDs;
• Content you publish on permanent links: the tour's title, screens, texts, and audio;
• Monthly usage counters: how many texts were generated with AI and how many seconds of audio were narrated, to apply the plan limits;
• Technical records: payment notifications sent by Stripe and a log of actions taken in the admin panel;
• Editor projects: the full content of each project, including screens, texts, audio, custom themes, and the permanent link address (see below).

This data is kept in a Postgres database, on a server in Brazil (São Paulo), contracted by GuiaFlow and managed with the Coolify tool.

Sign-in is done with a link sent by email, which is valid for 15 minutes and can only be used once, or with a password. The activation link in a GuiaFlow Pro invitation is valid for 7 days and can also be used only once. After sign-in, the browser keeps a session token in local storage (localStorage), valid for 12 hours. The admin panel uses a session cookie with the HttpOnly and Secure protections.

Projects saved to your account (Pro)

With Pro active and your account connected in the editor, every project in this browser is uploaded to your account. After that, each change is sent automatically. On another browser or device, just sign in to the same account and your projects appear.

We keep the full content of each project: title, screens, texts, audio, settings, custom themes, and the permanent link address, if any. Images and audio are stored as private files of your account, identified by a digest (hash) so the same file isn't stored twice. Only your signed-in account can download them. The limits are 15 MB per file, 1 GB of media per account, and 500 projects.

The content of each project (texts and settings) is kept in the account's Postgres database, on a server in Brazil (São Paulo). Images and audio are kept in DigitalOcean Spaces, DigitalOcean's file storage, in the United States (San Francisco), as private files. Daily database backups are also kept there, for up to 14 days.

If the subscription ends, nothing is deleted: the projects stay saved in the account. Syncing stops, the editor keeps working with this browser's copies, and new changes stay only there. When you come back to Pro, syncing resumes and your saved projects show up again.

A project deleted in the editor is also deleted from the account. Only an empty record remains, to tell your other browsers. To delete everything at once, ask for account deletion at [email protected].

Payment

The subscription is paid through Stripe Checkout, by card, Pix, Apple Pay, or Google Pay, depending on what is available to you. Payment details are entered on Stripe's pages and processed by Stripe, under its privacy policy.

GuiaFlow does not receive or store card numbers or bank details. From Stripe we receive only what is needed to activate and maintain the plan: email, customer and subscription IDs, status, and dates.

AI texts and narrated audio (Pro)

When you request an AI text, the request (the step text and the instructions, without the images) goes through our server and is sent to OpenRouter, which forwards it to the chosen AI model.

When you generate audio, the narration text is sent to Cartesia, which returns the audio file.

Avoid putting personal data or confidential information in these texts.

API, MCP and AI agents (Pro)

Pro subscribers can connect AI tools (such as Cursor, Claude or ChatGPT) to their account, with an API key or OAuth sign-in, to create, edit and publish tours. These tools act on your behalf and only with the permissions you chose; what they send becomes part of your projects, handled as described above.

For this we store: each key's name, last 4 characters, permissions and dates; the names of apps connected through OAuth; and a usage log (app or key, action, result, date and time, and a digest of the IP made with a secret key, which cannot be turned back into the IP). Keys and tokens are stored only as digests (hashes), never in full. The usage log is shown to you under API keys and deleted after 90 days.

When you pass an image URL, the GuiaFlow server downloads that file (public https addresses only). You can revoke a key or disconnect an app at any time, and access ends immediately. If the subscription ends, the API stops accepting calls.

Through the API and MCP, when an agent asks for AI text for a step (ai permission), that step's screenshot is also sent to OpenRouter with the request so the AI can read the screen (the agent can turn this off with useImage:false). Narrations requested through the API go to Cartesia as in the editor. Both count toward the same monthly Pro quota. Analytics returned by the API are counts only, with no personal data about viewers.

Emails

Service emails are sent by Resend, from [email protected]: sign-in links, invitations, and notices about the subscription. We do not use your email for marketing.

Contacts from tour visitors (Pro)

Authors with GuiaFlow Pro can ask, before a tour published on a permanent link, for the viewer's name, e-mail and/or phone. They can also offer, at the end of the tour, a contact form with name, e-mail, phone (optional) and message.

In these cases, the tour author is the controller of that data: they decide to ask for it, what to use it for and how long to keep it. GuiaFlow is the processor: it stores the data on the author's behalf, shows it only to them in the editor (with CSV export) and sends form messages to the author's account e-mail, through Resend, from [email protected]. We don't use this data for any other purpose.

For each contact we store:

• the details the visitor filled in (name, e-mail, phone and, in the form, the message);
• the consent record: the text shown and the date and time the box was ticked;
• the link the contact came from and, for the form, whether the e-mail notification was delivered.

The IP address is used only at submission time, to limit attempts and prevent abuse, and is not stored with the contact.

Submission depends on the visitor's consent (art. 7, I, of Brazil's LGPD): nothing is sent unless the box is ticked. To access, correct or delete your data, contact the tour author. If you can't, write to [email protected]; we'll forward the request to the author and help as far as a processor can.

Visits to published tours (Pro analytics)

When a Pro subscriber publishes a tour with a permanent link (including when it is embedded on another site), the player records how the tour was watched to show the author aggregated analytics: views, completion, where people drop off, clicks on the final button and where visits came from. Temporary links, the editor and exported HTML or video are not measured.

For each visit we only store:

• the tour events: opened, started, steps seen and the time on each (up to 10 minutes per step), whether the visitor finished or left (and how: Esc, clicking outside, closing or leaving the page), and whether they saw or clicked the final step button (WhatsApp, link, e-mail or form);
• the context: whether the tour was embedded on a site, the domain of the referring page (not the full address), the link's UTM parameters, the device type (mobile or desktop) and the browser language;
• a random visit identifier that lives only in the page's memory and disappears when the page is closed;
• a code to estimate unique visitors, computed on the server from the IP address, the browser and the link together with a random value that changes every day and is deleted. The IP address and browser are not stored, and once the day's value is deleted the code cannot reveal who the visitor was.

We do not use cookies or store anything in the visitor's browser for this. If the browser sends the “Do Not Track” (DNT) or Global Privacy Control (GPC) signal, the player sends no data at all. The author's own visits opened from the editor as a preview are not counted either.

If the visitor fills in the tour's start step and ticks the consent box, the visit is linked to that contact, and the analytics show the author how many visits came from people who left their contact. Without that consent, the visit is not linked to anyone.

Here too the tour author is the controller and GuiaFlow is the processor, processing this data only to produce the author's analytics. The legal basis is the author's legitimate interest in understanding how their own tour is used (art. 7, IX, of Brazil's LGPD), with minimal data; linking a visit to a contact relies on the consent given in the start step (art. 7, I). Per-visit data is kept for 90 days; daily totals (Brasília time) for 25 months. Everything is deleted earlier if the author deletes the link. To exercise your rights, contact the tour author or write to [email protected].

Cookies and usage measurement

GuiaFlow does not use advertising pixels or cross-site tracking. The visit measurement for published tours described above does not use cookies.

• The editor uses the browser's local storage to work, as explained above.
• The admin panel uses a session cookie.
• Cloudflare, which delivers the site, may use technical security cookies.
• Stripe uses its own cookies on the payment pages.
• The “Feedback” button opens a Tally form, which is loaded in the editor. If you answer it, the answers go to Tally.
• When you connect an AI app through OAuth, the authorization page uses a 1-hour session cookie, only for that screen.

What we use it for and on what legal basis

• Performance of a contract (LGPD art. 7, V): creating and maintaining the account, charging the subscription, storing links, generating texts and audio, and sending service emails;
• Legal obligation (art. 7, II): keeping payment and tax records for the period required by law;
• Legitimate interest (art. 7, IX): security, abuse prevention, and usage limits, always to the minimum necessary;
• Consent (art. 7, I): when you choose to send something optional, such as a feedback response.

Who the data is shared with

We do not sell or rent personal data. For the service to work, we use these providers, which process data on our behalf or as responsible for their own service:

• Vercel (USA): hosting of the site and of temporary links;
• Cloudflare (USA, global network): DNS and site delivery;
• Hostinger (server in São Paulo): server for the Pro account, permanent links and visit analytics;
• DigitalOcean (USA): images and audio of projects saved to Pro accounts, and database backups;
• Stripe (USA and Ireland): payments;
• Resend (USA): sending emails;
• OpenRouter (USA) and the provider of the chosen model: AI texts;
• Cartesia (USA): narrated audio;
• Tally (Belgium): feedback form.

We may also provide data when the law or a court order requires it.

International transfer

Several of these providers are located outside Brazil, mainly in the United States. The transfer happens because it is necessary to provide the service you requested, and it is carried out with the contractual and security safeguards offered by these providers, in accordance with LGPD art. 33.

How long we keep it

• Projects in the browser: until you delete them or clear the site's data;
• Temporary links: 7 days from the first publication;
• Permanent links: until you delete the link or the account is deleted;
• Email sign-in links: the sign-in link is valid for 15 minutes and the activation link in an invitation is valid for 7 days;
• Visitor contacts: until the tour author deletes them, deletes the permanent link or closes the account;
• Visits to published tours: per-visit data for 90 days and daily totals for 25 months, or until the author deletes the link;
• Projects saved to your account (Pro): until you delete the project in the editor or the account is deleted, even after the subscription ends;
• API keys and connected apps: until you revoke them or the key expires; the API usage log for 90 days;
• Account and subscription: for as long as the account exists. After a deletion request, we delete the account data, except what the law requires us to keep, such as payment and tax records, for the legal period.

Your rights

Under the LGPD (art. 18), you may request at any time:

• confirmation that we process your data and access to it;
• correction of incomplete, inaccurate, or outdated data;
• anonymization, blocking, or deletion of unnecessary data or data processed in breach of the law;
• data portability;
• deletion of data processed based on your consent and withdrawal of that consent;
• information about who we share your data with;
• objection to processing that does not comply with the law.

To make a request, write to [email protected], preferably from the account email, so we can confirm it is you. We reply within 15 days. You may also file a complaint with the Brazilian National Data Protection Authority (ANPD).

Data that stays only in your browser is under your control: you can export or delete projects in the editor itself.

Security

We use HTTPS connections, passwords stored only as hashes, short-lived sign-in links, session tokens that expire, and restricted access to the server. No system is completely immune to failures; if an incident occurs that may cause significant risk or harm, we will notify those affected and the ANPD, as required by law.

Children and teenagers

GuiaFlow is a work tool and is not directed at children or teenagers. The Pro subscription is for adults aged 18 or over.

Changes to this policy

We may update this policy when the product changes. The date at the top shows the latest version. If the change is significant, we will notify subscribers by email before it takes effect.

Contact

Questions or requests about privacy: [email protected].