1. Controller
Lyn El-Kadamani, trading as Found and Flow, Gneisenaustrasse 101, 47057 Duisburg, Germany, is responsible for the processing described here. For privacy requests, contact foundandflow.studio@gmail.com.
2. Visiting this website
This website is hosted using Cloudflare Pages and Cloudflare’s delivery and security network, provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare receives technical connection data, including IP address, request time, page address, browser information, response status and referring page, as needed to deliver and protect the website. Cloudflare can process data through its international network, including in the USA. The purposes are page delivery, fault diagnosis and protection against misuse. The legal basis is Article 6(1)(f) GDPR and our legitimate interest in a reliable, secure website. Cloudflare describes customer-data processing and its contractual transfer safeguards at https://www.cloudflare.com/cloudflare-customer-dpa/ and its own processing at https://www.cloudflare.com/privacypolicy/. Cloudflare processes this data on our behalf as a processor under a data processing agreement (Article 28 GDPR). Connection data is processed for request delivery and for as long as needed for security and fault diagnosis. Records associated with an identified attack, fault or legal claim can be kept until the matter is resolved and applicable legal retention periods end. Cloudflare’s own retention criteria include the processing purpose and applicable legal obligations. We do not use hosting records to create advertising profiles.
3. Cookies, fonts and media
Images and fonts are served with this website. We use ordinary links to other services, without embedded social feeds or tracking pixels. The Cookie settings page explains optional analytics, providers and storage periods and always provides controls to accept, reject or withdraw. We store your choice in your browser’s local storage under “found-and-flow:privacy” for up to 6 months. This record contains the analytics choice, the time of the choice, its expiry and the notice/configuration version. It has no unique visitor ID and is not sent to our server. After 6 months, or if this notice or our analytics setup changes materially, we ask again; optional analytics stays blocked until you consent. This preference storage is necessary to respect your requested choice under Section 25(2)(2) TDDDG. Associated processing is based on Article 6(1)(f) GDPR and our interest in respecting and documenting privacy choices. A browser-only message shares a withdrawal with other open tabs; it contains no visitor identifier. If storage is blocked, the choice applies only to the current page. Without JavaScript, optional analytics does not run. Global Privacy Control keeps optional analytics off. Details are on the Cookie settings page.
4. Optional website analytics (Google Analytics)
With your consent, we use Google Analytics 4 with Enhanced measurement enabled to understand visits and interactions and improve this website. The service provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and Google service providers may receive data in providing the service. Found and Flow determines the website-measurement purpose. Google’s processing terms are available at https://business.safety.google/adsprocessorterms/. Optional storage/access is based on Section 25(1) TDDDG; associated personal-data processing is based on Article 6(1)(a) GDPR. Google code loads only after active consent. Refusal leaves the website available and sends no Google Analytics measurement. This consent covers this website, not tracking inside our Canva apps or on Etsy. The measurement uses pseudonymous identifiers and information such as pages viewed, visit times, approximate location and browser/device characteristics. Enhanced measurement also records scrolling, clicks on outbound links (including links to Etsy and Canva) and clicks on download links where present. Depending on the enabled feature and content, it can record search terms derived from URL parameters, interactions with supported embedded videos, and form-start or form-submission metadata. This website currently has no site-search interface, embedded videos or contact form. Measurement does not show purchases on Etsy or activity inside Canva after you leave this website. Interaction data can include link destinations and labels, file names and types, video details, and form identifiers or destinations where applicable. Google receives technical connection information, including the IP address needed for transmission. Google states that GA4 does not log or store individual IP addresses. This does not make the collected information anonymous. For page-view events supplied by our own website code, we remove query strings and fragments from page URLs and limit referring URLs. Automatically measured interactions may also include URLs and URL-derived search terms as described above. We do not deliberately send names, emails, message contents or uploaded photos. Advertising consent remains denied; the site disables Google signals and advertising personalisation. User- and event-level data governed by the GA4 retention controls are deleted after 14 months. Reset on new user activity is switched off, so returning visits do not extend this period. The setting does not extend cookie lifetimes or your consent. We use this period for comparisons across an annual cycle and review the continued need for the data. The Cookies page explains the retention details, cookie names, lifetimes and withdrawal. Data may be processed outside the EEA, including in the USA. Google describes its transfer safeguards at https://policies.google.com/privacy/frameworks. These include the EU–US Data Privacy Framework for covered transfers to certified recipients and standard contractual clauses where applicable. These mechanisms do not remove every risk of foreign public-authority access or difficulty enforcing rights. You can withdraw consent at any time through Cookie settings, by declining analytics or switching it off and saving. Future measurement stops and accessible site analytics cookies are cleared. Withdrawal does not affect the lawfulness of earlier processing or automatically delete data already held. You can also contact us to exercise your rights.
5. Contacting us
If you contact us by email or phone, we process the contact details, message and attachments you send, or the content of the call, in order to answer your request. Calls are not recorded. For requests connected with a contract or steps before a contract, the legal basis is Article 6(1)(b) GDPR; for other enquiries, it is our legitimate interest in answering messages under Article 6(1)(f) GDPR. Providing information is voluntary, but we need a reply address and enough detail to respond. Messages are deleted when no longer needed to resolve the request, unless statutory retention obligations or the establishment, exercise or defence of legal claims require further storage. Our email service provider processes messages to deliver and store our correspondence: Gmail, a Google service; see https://policies.google.com/privacy. For EEA users, Google Ireland Limited is the responsible provider of Google consumer services; Google LLC and service providers can also process data, including in the USA. Google describes retention criteria and transfer mechanisms in its privacy policy and at https://policies.google.com/privacy/frameworks. Please send only information needed for your request and avoid unnecessary sensitive or client information.
6. External links
This website links to the Found and Flow Etsy shop, relevant Canva pages, and our Instagram and Pinterest profiles. Following a normal link opens the external provider’s service, where its terms and privacy notice apply. The links are not embedded shop, social-media or advertising widgets. Purchases are completed through Etsy; this website has no checkout. Our own handling of Etsy buyer information is described below.
7. Etsy orders: responsibility and data
Found and Flow is responsible as an independent controller for the buyer information we use to run our shop and fulfil your order. Etsy is separately responsible for its marketplace and platform processing. Etsy’s privacy policy does not replace this notice for our own use of your information: https://www.etsy.com/legal/privacy/. On Etsy, Etsy may process account, browsing, device and transaction information to operate and secure its services, process purchases, analyse usage and personalise search, recommendations or advertising in accordance with its privacy policy and your available privacy choices. These platform practices are governed by Etsy’s notices and settings. Depending on the order and the information Etsy makes available, we may receive your name or Etsy username, email address, postal or billing address, order and product details, transaction amounts and payment status. We also receive the messages, attachments and optional personalisation information you send us. These data come from you directly or through Etsy. We request only information needed for your order or enquiry. This website does not collect payment-card numbers or payment passwords; payment details should be entered only in the relevant checkout.
8. Etsy orders: purposes and necessary sharing
We use order information to provide the purchased digital product, answer product questions, resolve download or access problems, and handle cancellations, refunds or other contractual requests. The legal basis is Article 6(1)(b) GDPR. We keep records required by tax or accounting law under Article 6(1)(c) GDPR. Where necessary to establish, exercise or defend legal claims or prevent misuse, we rely on Article 6(1)(f) GDPR; our interests are protecting our business and resolving disputes fairly. Information is shared only as needed for these purposes: with Etsy to operate the order and support process; with our email provider if you contact us by email; and, where required, with tax authorities or professional advisers dealing with the relevant legal or accounting matter. We do not add buyers to a mailing list or send promotional messages merely because they made a purchase or contacted us. Etsy buyer data is not used for unsolicited advertising.
9. Etsy orders: retention and your requests
We retain order and correspondence data for as long as needed to complete the order, provide related support and deal with outstanding legal claims. Tax-relevant documents are retained for the statutory period applicable to the document type (in Germany generally 10 years for books and annual accounts, 8 years for invoices and accounting vouchers and 6 years for business correspondence, Section 147 AO, Section 257 HGB); retention is not extended to unrelated customer information merely because one document must be kept. After the relevant purposes and mandatory periods end, data under our control is deleted or anonymised. Etsy determines retention of data it controls independently. The rights described under “Your rights” below apply to our processing of Etsy buyer data. You can contact foundandflow.studio@gmail.com or message our shop about information we hold. Requests concerning your Etsy account or Etsy’s own records should also be directed to Etsy through its privacy controls or support. We cannot delete Etsy’s independently maintained records on its behalf.
10. Screen Mockups app
Screen Mockups identifies device-screen areas and adds editable image placeholders within Canva. Screen detection runs in your browser using a bundled background worker, with a browser-based fallback. You can choose a photo from your device or scan photos on the current Canva page. For page photos, the app reads image references and placement information from Canva and downloads the image through a temporary Canva URL. Local files are read in the browser. When you choose Add to design, the app sends the screen shapes and any generated photo overlays to Canva. If you selected a local photo, that photo is also sent to Canva for insertion into your design. Canva stores design content according to its own services and privacy policy. The app does not send photos to a Found and Flow server or to an external AI service. It contains no app analytics, advertising trackers or persistent browser storage. Photos, previews and detection results are held temporarily in the app session; the app clears its references when you reset it or close the app. This does not remove content already added to a Canva design. The app does not create a separate Found and Flow account. You choose the photo to process; without an image the app cannot detect screens. The app does not request your Canva account profile, payment details or access to unrelated designs. Processing necessary to provide the functionality you request is based on Article 6(1)(b) GDPR where applicable. If you contact support, the contact section of this notice applies. These statements concern the Found and Flow app; optional website analytics does not activate app analytics. Canva may separately collect account, technical and app-usage data as the platform provider, including platform analytics, under https://www.canva.com/policies/privacy-policy/. Use Canva’s account controls or contact Canva for requests about data it controls.
12. International transfers
The hosting, email, analytics and external platform services described here can involve recipients outside the EEA. For our transfers, an applicable adequacy decision under Article 45 GDPR or appropriate safeguards under Article 46 GDPR are required. The provider-specific information linked in this notice explains the mechanisms available for the relevant service, including standard contractual clauses and, for covered US transfers, the EU–US Data Privacy Framework. Information about Cloudflare’s contractual safeguards: https://www.cloudflare.com/cloudflare-customer-dpa/. Canva, Etsy, Meta and Pinterest explain their own processing locations, recipients and safeguards in the linked policies. Their independent processing is not governed by this website’s analytics consent. You may contact us for further information about safeguards relevant to our processing and how to obtain a copy, subject to protection of third-party confidential information.
13. Your rights
Subject to the conditions of the GDPR, you may request access, correction, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests for reasons relating to your situation. Where processing relies on consent, you may withdraw it at any time for the future. Contact foundandflow.studio@gmail.com to exercise your rights. You may also complain to a supervisory authority, including the authority where you live, work or believe a breach occurred. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany: https://www.ldi.nrw.de/kontakt. Visiting this informational website does not involve automated decision-making with legal or similarly significant effects. Providing data for optional analytics is voluntary and is not a contractual requirement. Necessary technical data is required to deliver the site. Order details and relevant contact information are needed to fulfil a purchase or answer a request; without them we may be unable to provide that particular service. We do not make decisions producing legal or similarly significant effects solely by automated processing.
Your right to object (Article 21 GDPR) Where we process your data based on legitimate interests (Article 6(1)(f) GDPR), for example for hosting and security, email enquiries or our social-media profiles, you may object at any time on grounds relating to your particular situation. We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. We do not use your data for direct marketing. If we ever did, you could object to it at any time without giving reasons, and we would stop. An informal email to foundandflow.studio@gmail.com is enough.
14. Additional information for US residents
The sections above describe the information we collect, its sources, purposes, recipients and retention. The relevant categories are contact and account identifiers you supply; order and transaction information received through Etsy; correspondence and attachments; and technical, device and website-usage information. We receive these directly from you, through your browser, or through the platform used for an order or message. We do not deliberately request sensitive personal information for website analytics. Depending on your state and whether the relevant law applies, you may have rights to access or confirm processing, obtain a portable copy, correct or delete information, and opt out of sale, sharing, targeted advertising or certain profiling. We do not use this website’s analytics consent to authorise advertising or profiling that makes decisions with legal or similarly significant effects. Global Privacy Control keeps optional analytics off. Google Analytics receives consented measurement data as described above; third-party platforms you visit operate under their own policies and controls. To request access, correction or deletion, email foundandflow.studio@gmail.com with “Privacy request” and describe your request. You can also use the postal address under Controller. We may request proportionate information to verify identity or an authorised agent’s authority; do not send identity documents unless specifically requested and necessary. We respond within the period required by applicable law and explain any refusal. Where a right of appeal applies, reply to the decision with “Privacy appeal” for a further review and information about contacting the appropriate regulator. We will not discriminate against you for exercising applicable rights. The same cookie controls are available to all visitors. A renewed analytics prompt does not cancel a protected sale/sharing opt-out or override GPC. We do not treat acceptance of website analytics as permission for a separate sale, sharing for cross-context behavioral advertising or marketing messages. No identity verification is required to reject optional analytics in Cookie settings.
15. Children
This website and Screen Mockups are not directed to children under 13. We do not knowingly collect personal information from children under 13 through this website. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action, including deletion where required. The app’s eligibility and any higher applicable minimum-age requirements are explained in the Terms of use. This statement is not a parental-consent mechanism.
16. Changes to this notice
We review this notice when our practices change. The date above identifies the current version. Material changes will be highlighted on this website before the new processing takes effect, where required; if a change needs fresh consent, we obtain it before using the data for that purpose. The current notice remains accessible through the Privacy policy link in the footer.
11. Instagram and Pinterest
Our legal notice also covers our Instagram profile @foundandflow.studio and Pinterest profile @foundandflow. The website contains ordinary links, without embedded feeds, social plugins or their tracking pixels. These links do not contact either platform until you follow them. Once you visit a profile, the platform’s own processing also applies. We process your username, information you make visible to us, messages, comments and related interactions to respond, communicate about our work and manage our profiles. Contract-related enquiries rely on Article 6(1)(b) GDPR; ordinary communication and necessary moderation rely on Article 6(1)(f) GDPR and our interests in accessible customer communication and maintaining our profiles. Public interactions may be visible to other people. Email is an alternative way to contact us. Instagram is provided for European-region users by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Privacy information: https://privacycenter.instagram.com/policy/. Pinterest identifies Pinterest Europe Ltd., Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland, and Pinterest, Inc., 651 Brannan St., San Francisco, CA 94107, USA, as joint controllers for its EEA platform processing: https://policy.pinterest.com/en/privacy-policy. This does not mean that Found and Flow controls all platform processing. The platforms process technical, account and usage information to operate, secure, personalise and measure their services, potentially outside the EEA. Where the platforms provide profile or content statistics, we view aggregated reach and interaction summaries to understand interest in our work; we cannot identify individual visitors from these statistics. The legal basis is Article 6(1)(f) GDPR and our interest in understanding how our content is received. For the statistics Meta provides about our Instagram profile (“Insights”), we and Meta Platforms Ireland Limited are joint controllers under Article 26 GDPR. In its Page Insights Controller Addendum, Meta has agreed to take primary responsibility for this processing, including informing you and handling requests to exercise your rights: https://www.facebook.com/legal/terms/page_controller_addendum. For Pinterest Analytics, a comparable joint responsibility may exist for aggregated profile statistics; Pinterest explains its processing in its privacy policy. You may exercise your rights with us or with the platform; for statistics data, the platform is best placed to act on them. Public comments and other identifiable interactions remain personal data. The provider policies explain their own purposes, legal bases, storage periods, privacy controls and transfer safeguards. For communications under our control, we keep information only while needed to handle the interaction, fulfil legal duties or establish, exercise or defend legal claims. Platform storage follows the relevant provider policy; deleting an item from our view does not promise erasure throughout the platform. Contact us for requests about our processing. For platform-held records, use the provider’s privacy contacts and account controls. The rights described below remain available.