Privacy

Last updated: 14 October 2026

This notice explains how TR FLOW processes personal data when you visit trflow.app, sign in, try the hardware trial or contact us.

Who is responsible?

Terapetje, glasbena terapija in druge storitve, Blažka Garmut s.p.
Dragonijeva ulica 3, 2000 Maribor, Slovenia
Business registration number: 9468579000

This business is the controller for TR FLOW account, trial, marketing and support data. Use our contact form for privacy questions or requests.

What we collect and why

• Account and authentication: your email address, account ID, creation date, hashed login challenges and session identifiers. We use these to verify your email, provide access and maintain one active session. This is necessary to provide the service you request.
• Hardware trial: remaining editing time, trial start status, connection leases and transfer counts. We use these to provide and enforce the trial allowance.
• Security: requests are rate limited using hashed keys derived from an IP address or email and time bucket. Hosting providers may process IP addresses, browser/request information and operational logs. We use this for our legitimate interest in protecting the service from abuse.
• Optional marketing: subscription choice, consent time/version/revision and an audit record. Marketing is based on your consent. You can withdraw it in account settings or through the unsubscribe link in an email; this does not affect your account or previous lawful processing.
• Support: the email address and message you submit through Contact. We use these to answer your request and follow up on the issue, on the basis of requested service or our legitimate interest in customer support.
• Purchases, when checkout is enabled: transaction IDs, product/price identifiers, payment status and license records. These are used to fulfil purchases, handle adjustments and meet applicable record-keeping requirements. Checkout is currently disabled.

Your sounds and patterns

WAV audio, MIDI patterns and project files are processed locally in your browser and exchanged directly with your TR-8S over USB. The normal transfer workflow does not upload these files to our server. Files you deliberately include in a separate support communication would be processed as part of that request.

Cookies and browser storage

TR FLOW uses Secure, HttpOnly session cookies (up to 30 days) for authentication and trial-related cookies for browser identification. Signing in elsewhere replaces your active session. Session storage retains a pending login challenge for up to 10 minutes. Local storage retains workspace preferences such as slots, density and device settings until you clear it. These support the requested service. We have not added advertising trackers or third-party marketing analytics to the application. Hosting infrastructure and Paddle, if checkout is used, may have their own necessary storage and privacy notices.

Service providers and recipients

We use OpenAI Sites and Cloudflare for hosting and database infrastructure, Resend to deliver sign-in and contact emails, and Apple iCloud for the support mailbox. Authorized support staff can access support messages and account records where needed. Paddle processes payment information when checkout is enabled; we do not receive full card details. Providers may process data outside the EEA. Where required, transfers must use an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses.

Provider information: OpenAI, Cloudflare, Resend, Apple and Paddle.

Retention

Login links/codes expire after 10 minutes and sessions after 30 days. Expiry prevents use; it does not itself mean the underlying database record has been erased. Account and trial records are retained to operate access and trial limits, until an appropriate deletion request or retention review. Consent and unsubscribe records are retained as needed to respect your preference and document consent. Support messages are kept while resolving a request and for necessary follow-up. Purchase and dispute records are retained as required for accounting, legal obligations and claims. We review deletion requests individually and explain any records that must be retained.

Your rights

Depending on the processing and applicable law, you may request access, correction, deletion, restriction or portability of your data, and object to processing based on legitimate interests. You can withdraw marketing consent at any time. We may need to verify your identity before acting on a request. You may complain to the Slovenian Information Commissioner at ip-rs.si or your local supervisory authority.

Updates

We update this notice when our processing changes and display the revised date here.