Privacy Policy
Last updated: 30 October 2026. This policy explains what BPMN Studio collects, why, who else sees it, and what you can do about it. If anything here is unclear, email the address below and ask.
Who is responsible
BPMN Studio (bpmnstudio.com) is an independent project built and operated by Emilis Mikalajūnas, who is the data controller for the purposes of the EU General Data Protection Regulation (GDPR).
Contact: mikalajunas.emilis@gmail.com
There is no appointed Data Protection Officer - the project is below the threshold that requires one.
What we collect
| Data | Why | Legal basis |
|---|---|---|
| Email address and authentication credentials, or, if you sign in with Google, the name, email address and profile picture Google shares with us | To create and secure your account | Contract (Art. 6(1)(b)) |
| Process descriptions and conversation messages you type | To generate your diagram | Contract |
| Generated BPMN diagrams, their XML and version history | To save your work and show it in your library | Contract |
| Comments you leave on diagrams | To let collaborators discuss a diagram | Contract |
| Email addresses of people you invite to a project | To let them join the project you shared | Contract (with you); legitimate interest (Art. 6(1)(f)) towards the invitee |
| Plan, trial dates, usage counters, credit spend | To enforce plan limits and bill correctly | Contract |
| Product events in our own database - for example "trial started", "upgrade screen shown", "checkout started", and the optional answer to "what stopped you from upgrading?" - linked to your account, no cookies | To see where people get stuck between signing up and paying, and improve that | Legitimate interest |
| Which product emails we sent you, and whether you unsubscribed | To send each email once and respect your choice | Legitimate interest (Art. 6(1)(f)); for tips and offers, the EU "soft opt-in" for customers of our own service (ePrivacy Directive Art. 13(2)) |
| Billing details (card data handled by Stripe, never by us), and the time you asked for your plan to start | To take payment and record your request under consumer law | Contract, legal obligation (tax and consumer-law records) |
| Aggregate page-view counts (Vercel Web Analytics, no cookies, no identifier) | To see which pages are visited | Legitimate interest |
| Analytics events - pages viewed, referrer, approximate region, device type, your account's random ID and plan | To understand which parts of the product are useful | Consent only (Art. 6(1)(a)) |
| Session recordings - clicks, scrolls and page layout, with text masked | To find where people get stuck | Consent only |
| Server logs, rate-limit counters, error traces | To keep the service available and resist abuse | Legitimate interest |
We do not buy data about you, we do not sell or rent your data, and we do not run advertising profiling.
Emails we send
Besides account emails (confirming your address, resetting a password), we send a few short emails from the founder about your account: a welcome note, a reminder before your free Pro trial ends, a note when it has ended, a heads-up when you run out of monthly AI credits, and the occasional tip or product update. Every one of them has an unsubscribe link, and you can opt out when you sign up. Unsubscribing never affects your account or your diagrams. Replies come straight to us.
Your prompts and the AI model
This is the disclosure that matters most for a tool like this, so it gets its own section.
The process descriptions you type are sent to OpenAI. BPMN Studio has no model of its own. When you talk to the wizard or press Generate, your conversation is transmitted to OpenAI's API, which returns the wizard's reply or the BPMN XML. The wizard's replies are written by that AI model, not by a person.
What this means in practice:
- Do not paste confidential or personal data into a process description. Describe roles ("claims handler"), not named individuals; describe steps, not customer records. Anything you type leaves our servers.
- Under OpenAI's API data usage policy, data submitted through the API is not used to train OpenAI's models, and is retained by OpenAI for up to 30 days for abuse monitoring before deletion.
- OpenAI processes this data in the United States. See International transfers below.
- No other AI provider receives your prompts. OpenAI is the only model provider in the stack.
Sharing with collaborators
When you share a project, the people you invite see the project's diagrams, version history and comments, and they see your email address as the owner. When you join someone else's project, its owner and other members see your email address and the comments and diagrams you add. Only invite people you are entitled to share that content with.
Who else processes your data
These are our sub-processors. Each has access only to what its function requires.
| Sub-processor | Purpose | Data it sees | Location |
|---|---|---|---|
| Supabase | Database, authentication, account emails | Account email, diagrams, process descriptions at rest | EU (Frankfurt) |
| OpenAI | Wizard conversation and diagram generation | Process descriptions and conversation content | US |
| Stripe | Payments, subscription management, receipts | Name, email, card data (collected directly by Stripe) | US / EU |
| Vercel | Hosting, serverless functions, cookieless page-view counts | Request metadata, IP address in transit | Global edge |
| Resend | Sending product emails | Your email address and the email's content | US |
| Google (Sign-In) | Signing in with your Google account, only if you choose it | Your Google name, email address and profile picture | US / EU |
| Google (Tag Manager, Analytics 4) | Loading tags; site analytics only if you consent | Tag Manager: IP address in transit. Analytics: pseudonymous usage events | US / EU |
| Microsoft (Clarity) | Session recordings and heatmaps - only if you consent | Masked page interactions, device and browser details | US / EU |
| PostHog | Product analytics, session recordings and error reports on the site and in the app - only if you consent | Pseudonymous usage events with your account's random ID and plan (the kind of action, never your chat messages, diagrams or names), masked page interactions, error messages with quoted text removed, device and browser details | EU (Frankfurt) |
Card numbers never reach our servers: checkout happens on Stripe's own hosted page.
International transfers
Some of the processors above are in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. You can request a copy of the relevant transfer safeguards at the contact address above.
Cookies and analytics
Google Analytics, Microsoft Clarity and PostHog run only after you accept the Analytics category. Until then they are not triggered at all: no analytics cookies are set and no analytics data is sent. Rejecting costs you nothing and no feature is withheld.
Two things do run for everyone, because the site needs them or because they identify no one:
- Google Tag Manager loads on every page so that the tags above can start the moment you consent. Loading it means your browser contacts Google's servers, which see your IP address in transit. It sets no cookies.
- Vercel Web Analytics counts page views. It sets no cookies and stores nothing on your device.
When you consent, Google Analytics and PostHog receive your account's random ID (never your email) so that visits on different devices are counted as one person, and Clarity links its recordings to the same analytics ID. Clarity and PostHog mask the text on the page and everything typed into fields, so the content of your process descriptions and diagrams is not recorded. We do not enable Google signals or advertising features.
The full cookie inventory, and the control to change your mind at any time, is on the Cookie Policy page.
How long we keep things
| Data | Retention |
|---|---|
| Account and profile | Until you delete your account |
| Diagrams, versions, comments and conversations | Until you delete them, or until account deletion |
| Pending project invites | Until accepted, revoked, or the inviting account is deleted |
| Google Analytics event data | 14 months |
| Clarity session recordings | 30 days |
| PostHog session recordings | 30 days |
Consent record (bs_consent) |
12 months, then you are asked again |
| Stripe payment, invoice and withdrawal records | As required by tax law (typically 7–10 years) |
| Server and error logs | Short-lived, retained by Vercel per its platform defaults |
| Product events and the record of emails sent | Until you delete your account |
Deleting your account removes your account, projects, diagrams, comments, conversations and usage history from the database. Backup copies age out on the storage provider's own cycle.
Security
Diagrams and conversations are stored in PostgreSQL with Row-Level Security enabled: policies are enforced in the database itself, so one account's queries cannot return another account's rows even if application code is wrong. Traffic is served over HTTPS. API endpoints are rate-limited. Payment card data never touches our infrastructure.
No system is perfectly secure, and we make no absolute guarantee. If a breach affects your rights, we will notify the relevant supervisory authority within 72 hours and inform you where the law requires it.
Your rights
Under the GDPR you can:
- Access - request a copy of the data we hold about you
- Rectify - have inaccurate data corrected
- Erase - delete your account and data yourself in Settings → General → Delete account, or ask us to
- Port - receive your data in a machine-readable format (your diagrams also export directly from the app)
- Restrict or object - to processing based on legitimate interest
- Withdraw consent - for analytics, at any time, via Cookie settings, with no effect on processing already carried out
- Complain - to your national supervisory authority. In Lithuania this is the State Data Protection Inspectorate (VDAI)
Email the contact address to exercise any of these. We aim to respond within 30 days.
Children
BPMN Studio is a business tool and is not directed at children under 16. We do not knowingly collect data from them. If you believe a child has created an account, tell us and we will delete it.
Changes
Material changes to this policy will move the Last updated date above, and - where the change affects how we use your data - you will be asked for consent again before it takes effect.