Privacy Policy
Last updated: 11 August 2026
Who is responsible
Dana Sofía Noriega Arciniegas, trading as Muktiflow, in Bogotá, Colombia. For anything about your data, including asking for it to be deleted: sofia@muktiflow.com.
This policy covers muktiflow.com and the demos hosted on the same domain.
What is stored, and when
Nothing is asked of you to open a demo. No email, no name, no card.
That said, here is exactly what does get stored:
- When the demo finishes, the answers you gave to configure it (say, “vet clinic, 4 sites”) are stored along with the result it produced. This happens even if you never leave your details. It records what was tried, and it feeds the point below.
- A hashed version of your IP address, not the address. It counts how many demos came from one place in a day, so no one can burn through everyone's allowance.
- Only if you leave your details at the end of the demo: your name and your email, which are required, and if you write them also your company, your phone, your timeline and whatever you choose to tell me. Leaving them is asking me to write: you get a confirmation email and then I get in touch.
Your run may be shown to someone else
The AI-powered demos have a daily allowance. When it runs out, rather than shutting the door, the site shows a real earlier run as an example. It could be yours.
Your name, email, phone and company are never shown: only what you typed to configure the demo and the result. Even so, don't type anything there you wouldn't want a stranger to read. If you'd rather your run stayed out of that rotation, email me and I'll pull it.
The legal basis
- Your consent, given when you accept before entering and when you tick the authorisation box. You can withdraw it at any time.
- Legitimate interest, solely to keep the demos from being knocked over by abuse (that's the hashed-IP counting).
In the EU and UK that is Article 6(1)(a) and 6(1)(f) of the GDPR. In Colombia it is the authorisation under Law 1581 of 2012.
What it is used for
To write to you about what you need, which is what you asked for by leaving your details. Nothing else.
Your data is not sold. It is not shared with third parties for advertising, not used to train AI models, not used to profile you, and not used to make automated decisions about you.
Who else sees it
Only the providers needed to make this work. Each has its own policy, and here is the link so you can read it:
- Google Cloud (Cloud Run y Firestore). Where the site runs and where runs and contact details are stored. Their privacy policy ↗
- Google Cloud Vertex AI (Gemini). The AI-powered demos. What you type into them passes through here. Their privacy policy ↗
- Resend. Delivery of the confirmation email when you leave your details. Their privacy policy ↗
- Google Fonts. The site's typefaces. Your browser fetches them from Google, which sees your IP. Their privacy policy ↗
None of them may use your data for their own purposes: they process it on my instructions.
It leaves your country
These providers are mainly in the United States and the European Union, so your data leaves whichever country you are in. Where the law requires it, that transfer relies on the European Commission's Standard Contractual Clauses, which form part of the contracts with each provider.
How long
- Demo runs: 12 months, then deleted.
- Hashed-IP counters: 30 days.
- Contact details: while the commercial conversation makes sense, or until you ask for deletion, whichever comes first.
Cookies
This site uses one cookie, mf_consent. It records that you
accepted, so you aren't asked again. It lasts six months, it is signed, and it cannot be used
to track you.
There are no analytics, advertising or third-party cookies. That's why there's no cookie banner: there is nothing else to consent to.
Your rights
Email sofia@muktiflow.com and that's it. No explanation needed, no form to fill in.
- Anywhere in the world: find out what I hold about you, correct it, delete it, and withdraw your authorisation.
- EU and UK (GDPR): additionally, object to processing, ask for it to be restricted, and take your data away in a readable file. You may also complain to your national data protection authority without speaking to me first.
- California (CCPA/CPRA): know what is collected and who it is shared with, ask for deletion, and correct it. I do not sell or share personal information in the meaning of that law, so there is nothing to opt out of. Exercising these rights changes nothing about how you are treated.
- Colombia (Law 1581 of 2012): access, update, rectify, delete, and revoke the authorisation.
- Brazil (LGPD): confirmation, access, correction, anonymisation, portability and deletion.
Replies come within 15 business days, the shortest of all the deadlines that apply; the GDPR allows 30 and they are not used here.
Children
This is not intended for anyone under 16 and their data is not knowingly collected. If you believe a child left theirs, email me and I'll delete it.
If anything changes
The date at the top says when this was last updated. If the change is substantive (a new provider, a new use) anyone who left their email will be told by email.