Who we are
Flexiwind ("we", "us") runs Flexiwind and Flexiwind Pro: the website, the documentation, the command line tool and the registry it installs components from. We are the controller of the personal data described on this page.
You can reach us about anything on this page at hello@contact.unoforge.com.
You can read the documentation and browse the public components without an account. We only hold personal data about you if you sign in, buy a plan, or are invited to a team.
What we collect
Your account
- Email address and name. Flexiwind has no passwords: you sign in with a one-time link sent to your email. When an account is created, the name starts as the first part of your email address; you can change it in your profile.
- Sign-in links. For each link we request: the email, the IP address and browser (user agent) of the request, and when it was used. A link works once and expires after 15 minutes.
- Sessions. While you are signed in we keep a session, with your IP address and browser, so the site recognises you from one page to the next.
Your subscription and payments
- Plan records. The plan you bought, its price and currency, its status and dates, and the references Chariow gives us for the sale (sale and transaction identifiers).
- What we send to Chariow to open the payment page: your email, your first and last name, the phone number and country you enter at checkout, and the product you are buying. We do not store the phone number you enter: it is passed on to Chariow.
- Buying a single template. You pay on Chariow's own store page, not on our site. Chariow collects what it needs to take payment and deliver the file, under its own privacy policy. We receive a notice that a sale happened (its identifier and the product, not your details) and keep no account for you.
- Payment details. Cards, mobile money and bank details are entered on Chariow's payment page. We never see or store them.
Using the CLI and the registry
- CLI tokens. The name you give a token, a short prefix, when it was last used and from which IP address. The token itself is stored only as a one-way hash, so we cannot read it back.
- Download log. Each time a Pro component is installed through the CLI or our MCP server we record your account, the token used, the component, the channel and your IP address. We use it to stop abuse and to answer "did this token download that?".
Teams
- If you own a Team plan, the email addresses you invite, who sent each invitation, and whether it was accepted. If you join a team, the owner can see that your account holds a seat.
Technical logs
- Our servers log requests (address requested, time, status, IP address, browser). We also keep a record of each payment notification Chariow sends us (its identifier and type, never your payment details).
Why we use it
| Purpose | Data | Legal basis |
|---|---|---|
| Sign you in and keep you signed in | Email, name, sign-in links, session | Contract (providing your account) |
| Sell you a plan and give you access to Pro | Plan records, Chariow references, checkout details | Contract |
| Serve the CLI and registry; enforce your seat or plan | CLI tokens, download log | Contract; legitimate interest in protecting a paid service |
| Prevent abuse, fraud and attacks; keep the service running | IP addresses, technical logs, rate limits | Legitimate interest |
| Keep invoices and accounting records | Plan and payment records | Legal obligation |
| Reply to your support requests | What you send us | Contract; legitimate interest |
| Understand how some pages are used | Analytics (see below) | Your consent, where the law requires it |
We do not sell your personal data and we do not use it for advertising or to train AI models.
Who receives it
We share data only with the services we need to run Flexiwind:
- Chariow, the platform that processes payments. It receives what is listed above to open the checkout and process the payment, under its own terms and privacy policy. It tells us when a payment succeeds, fails or is abandoned.
- Our email provider, to deliver sign-in links, invitations and replies.
- Our hosting and infrastructure providers, where the application and its database run.
- Google Analytics and Bunny Fonts, as described in the next section.
- Authorities and advisers, when the law requires it or to defend a legal claim.
Some of these providers may process data outside your country. Where the law requires safeguards for that, we rely on the mechanisms those providers offer, such as standard contractual clauses.
Cookies and analytics
- Essential cookies. A session cookie keeps you signed in and a security cookie protects forms against forgery. Without them the site does not work, so they do not need your consent.
- Local storage. Your browser remembers your light or dark theme choice. It stays on your device.
- Fonts. The site loads its text font from Bunny Fonts (fonts.bunny.net), a European font service that does not track visitors. Your IP address reaches it when a page loads.
- Analytics. On some pages of the production site, such as the block previews, we use Google Analytics 4 to count visits and see which blocks are popular. Google may set cookies and receive your IP address and browser details. You can refuse or block it in your browser or with a content blocker; the site works the same without it.
How long we keep it
- Sign-in links are deleted automatically about a day after they expire.
- The download log is deleted automatically after 90 days.
- Account, plan and token records are kept while your account exists. When you ask us to delete your account we delete or anonymise them.
- Accounting records (what was bought, when and for how much) are kept for as long as accounting and tax law require, even after your account is deleted.
- Support messages are kept as long as needed to help you and handle follow-ups.
Your rights
Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, limit or object to how we use it, and send it to another service. Where we rely on your consent you can withdraw it at any time.
To use any of these rights, write to hello@contact.unoforge.com from the email address of your account, so we can be sure the request is yours. We reply within one month. If you think we have not handled your data properly, you can complain to your local data protection authority.
Security
Sign-in links and team invitations are signed, single-purpose and short-lived. CLI tokens are stored as hashes and can be revoked at any time from your account. Access to Pro is checked on every request, and the site is served over HTTPS. No system is perfectly secure; if we learn of a breach that affects your data we will tell you and the authorities as the law requires.
Flexiwind is not directed at children under 16, and we do not knowingly collect their data.
Changes and contact
When we change this page in a way that matters, we update the date at the top and, for significant changes, tell account holders by email. Questions about this policy: hello@contact.unoforge.com.
See also our Terms of Service and License.