Privacy policy.
KriyaXlabs (“we”, “us”, “our”) operates SketchXFlow — an AI-powered design-to-code studio at sketchxflow.com and sketchxflow.kriyaxlabs.com. This document explains how we collect, use, disclose, and safeguard your information, including data we receive from Google when you sign in with a Google account.
What we collect
1.1 Account information
When you register, we collect your name, email, and a hashed version of your password. We never store your password in plain text.
1.2 Usage and generation data
We log generation requests (prompt text, token counts, coin usage, timestamps) to enforce plan limits and improve the Service. We do not retain AI-generated outputs beyond your session unless you save the project.
1.3 Project data
Saved projects (design graphs, exported code, uploaded images) are stored in your account and accessible only to you, unless you create a share link.
1.4 Payment information
We never receive, store, or have access to your full card number or payment credentials, whichever of our two payment routes you use.
Design-tool plans, coin packs and marketplace templates are processed by Dodo Payments, the Merchant of Record for those purchases. From them we receive only a transaction confirmation, customer ID, subscription status, and purchase metadata.
Development-services payments are collected through Razorpay, our payment gateway for that business. Because KriyaXlabs issues the tax invoice for development services itself, we do hold the billing details you give us for it — the name or company name to bill, billing address, country, and your GSTIN or equivalent tax registration number where you provide one. We need these to issue a valid tax invoice and we retain them for the statutory period described in § 5. From Razorpay we receive a payment identifier, the amount, and the status — never the card number.
1.5 Automatically collected data
Standard server logs — IP address, browser type, device, pages visited, timestamps — used for security monitoring, abuse prevention, and analytics.
When you are signed in we also keep a record of your account's activity, to run and improve the service and to support you: each sign-in (the time, how you signed in, your browser and operating system, whether it was a phone, and your country — not your IP address), the features you use and how often (for example “AI edit” or “Export & code”, counted per day), and the AI operations you run with their coin and cost. If you allow analytics cookies, we also count which pages of the app you open (the page type, such as “Editor”, never the contents). None of this includes what you write or design. It is kept for about 13 months.
1.6 Information from Google when you sign in with Google
If you choose Continue with Google, we use Google's OAuth 2.0 service to authenticate you. We request only the standard, non-sensitive sign-in scopes:
openid— confirms your identity with Google.https://www.googleapis.com/auth/userinfo.email— your verified email address.https://www.googleapis.com/auth/userinfo.profile— your basic profile (name and profile picture URL).
From these scopes we receive: a stable Google subject ID (sub) used to identify your Google account, your email address, your verified-email status, your name, and your profile picture URL. We do not request access to your Gmail, Calendar, Drive, Contacts, or any other Google service.
We use this information solely to (a) create your SketchXFlow account if you're new, (b) sign you into your existing SketchXFlow account, and (c) display your name and profile picture inside the app. If an account already exists with the same verified email, we link the Google identity to that account so you can sign in with either method — we do not create duplicate accounts.
You can revoke SketchXFlow's access at any time from myaccount.google.com/permissions. Revoking access does not delete your SketchXFlow account; if you also set a password, you can continue to sign in with email and password.
Limited Use of Google user data
SketchXFlow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- We use Google user data only to provide the SketchXFlow sign-in feature and to display your name + photo.
- We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features that are prominent in the SketchXFlow user interface.
- We do not use Google user data for serving advertisements, including retargeting, personalised, or interest-based ads.
- We do not allow humans to read Google user data unless we have your affirmative agreement for specific messages, doing so is necessary for security purposes (such as investigating abuse), to comply with applicable law, or our use is limited to internal operations and the data has been aggregated and anonymised.
How we use your information
- Provide, maintain, and improve the Service.
- Process your account registration and authenticate your sessions.
- Track usage against your plan's coin allocation.
- Process transactions via Dodo Payments and manage your subscription or coin pack purchases.
- Send transactional emails — verification, resets, billing receipts.
- Detect and prevent fraud, abuse, and security incidents.
- Comply with legal obligations.
Third-party services
We share your information only with the following:
- Dodo Payments (Merchant of Record) — handles checkout, billing, taxes, and chargebacks for paid plans, coin packs and marketplace templates. Receives your name, email, and billing address. We never receive your card number. Their handling is governed by their Privacy Policy.
- Razorpay (payment gateway) — collects payments for development services, where KriyaXlabs is the seller and issues the invoice. Receives your name, email, and the invoice amount so it can take the payment, and handles card, UPI, net-banking, EMI and bank transfer rails on our behalf. We never receive your card number. Their handling is governed by their Privacy Policy.
- Resend (email delivery) — delivers our transactional email: verification and password resets, billing receipts, project and invoice notifications. Receives your email address and the contents of those messages, and nothing else. Their handling is governed by their Privacy Policy.
- Cloud infrastructure providers — host the Service and store account and project data with encryption at rest and in transit. They process this data only on our behalf.
- AI model providers — process the prompts you submit so the Service can generate designs. Prompt text is sent to these providers under their respective data-usage policies; we do not authorise them to train models on your prompts.
- Google Identity Services— when you choose “Continue with Google”, we use Google's OAuth 2.0 service to authenticate you. See section 1.6 above for the full scope and data-handling disclosure.
We do not sell, rent, or trade your personal information to any third party for marketing purposes.
Data retention
Account data is retained for as long as your account is active. Project data is retained until you delete it or delete your account. Generation logs are retained for up to 90 days for billing and abuse prevention. Payment records are retained as required by tax and financial regulations (typically 7 years).
Development services: a project you paid for is a record of a supply, so its invoices, the accepted proposal and terms, the requirements document and the conversation that produced it are kept until 31 March, seven years after the financial year of its last payment (the GST and income-tax retention periods), then deleted. A conversation or proposal that was never paid for is deleted six months after its last activity, or straight away if you delete your account.
Data security
Industry-standard measures: encrypted connections (TLS/HTTPS), hashed passwords (bcrypt), HTTP-only secure cookies for authentication, rate limiting on sensitive endpoints, and encrypted data at rest. No method of electronic transmission or storage is 100% secure; we cannot guarantee absolute security.
Your rights
Depending on your jurisdiction you may have the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate data.
- Request deletion of your data and account.
- Export your project data.
- Object to or restrict certain processing.
- Withdraw consent where processing is based on consent.
To exercise these rights, contact support@kriyaxlabs.com. We respond within 30 days.
6.1 Account deletion
To delete your account and all associated data:
- Sign in and visit /account →Delete account; this irreversibly removes your account, projects, backups, payment records (where retention law permits), generation logs, comments, and any linked Google identity, OR
- Email support@kriyaxlabs.com from the address on file. We confirm by reply within 7 days and complete deletion within 30 days.
If you signed in with Google, account deletion also revokes SketchXFlow's OAuth grant — you can independently revoke it at any time from myaccount.google.com/permissions.
Cookies
Essential cookies: an HTTP-only authentication cookie (access_token) and a refresh token cookie, and sxf_consent, which remembers your cookie choice for about six months, and sxf_region, which holds only the country your connection comes from (refreshed daily) so we can show the right cookie choices. These are always on. Your choice is shared by sketchxflow.com, services.sketchxflow.com and marketplace.sketchxflow.com, so you are asked once, not on each site, and changing it on one changes it on all three.
The cookie banner offers Accept (analytics and advertising), Reject (neither), or Choose, where you can switch analytics and advertising on or off separately. You can change your mind at any time with (also in the footer of every page).
Visitors in the United States.US state privacy laws let people opt out of analytics and advertising cookies rather than opt in, so if you visit from the US and haven't made a choice, analytics and advertising are on and we show a notice instead of a question. Opt out on that notice, or the Do not sell or share my personal information link in the footer, turns advertising off (nothing is sent to Meta and Google's advertising cookies are not set); analytics stays as you chose. If your browser sends a Global Privacy Control signal, we treat it as that opt-out automatically. We do not sell personal information for money; sharing with Meta and Google for ad measurement is what the opt-out stops. Everywhere else nothing but essential cookies runs until you say yes.
Analytics: until you make a choice, and whenever analytics is off, we send Google Analytics anonymous, cookieless measurement — no cookies are set and no identifiers are stored on your device — so we can count visits and clicks on our ads. If you allow analytics, Google Analytics cookies are enabled.
Advertising measurement: only if you allow advertising, Google may set its advertising cookies so Google Ads can measure (and tailor) our ads, and we load the Meta (Facebook/Instagram) pixel, which sets the _fbpcookie, and report a few actions to Meta from our server as well (page views, starting or finishing an audit, signing up, sending a brief, booking a call, paying an invoice) so we can tell whether our ads on Meta work. With those we send your IP address, browser user agent, the page address, and if you are signed in a one-way hash of your account id and email, never the email itself. If you reject advertising, or change your mind later, nothing is sent to Meta. Meta's handling is governed by its Privacy Policy.
Children's privacy
The Service is not directed to individuals under 16. We do not knowingly collect personal information from children. If you become aware a child has provided personal data, contact us — we will delete it.
International data transfers
Your data may be transferred to and processed in countries other than your country of residence, including the United States and India. These transfers are necessary for providing the Service and are protected by appropriate safeguards.
Changes to this policy
We may update this Privacy Policy from time to time. Material changes are posted on this page with an updated date. Continued use after changes constitutes acceptance.
Contact
KriyaXlabs, a sole proprietorship of Amogha Mahantesh Devanaganvi
4-1-143/1A(13), Vertex Workspace
Mahatma Gandhi Road, Ballal Bagh Circle
Mangaluru, Dakshina Kannada
Karnataka 575003, India
GSTIN 29FWDPD0480F1ZP
Email support@kriyaxlabs.com · Web sketchxflow.com
Last updated September 25, 2026. Questions about this document? Email support@kriyaxlabs.com.