Sketchflow.ai

GDPR overview

Implementation is explicit and unusually detailed for a young product. A dedicated EU/EEA and UK addendum is incorporated into the Terms and prevails over them for European users. It names TENMENSION, INC. as data controller, tabulates the legal bases relied on — Article 6(1)(b) for the account and billing, 6(1)(f) for analytics, 6(1)(a) for marketing, 6(1)(c) for legal compliance — and lists data-subject rights article by article: access (15), rectification (16), erasure (17), restriction (18), portability (20) and objection (21), plus withdrawal of consent, with a stated 30-day response time. Transfers to the United States are covered by Standard Contractual Clauses under Article 46(2)(c), a copy of which is available on request. Users may complain to their national supervisory authority, or the ICO in the UK. No Article 27 representative and no DPO are named, and no DPA or subprocessor list is published.

Who owns the data?

Under the Terms of Service you keep ownership of what you submit and of what you build: your input, your customer data, and the applications, websites and projects produced with the tool, including — as far as the law allows — the AI output generated for you. In exchange you grant TENMENSION, INC. a worldwide, non-exclusive, royalty-free licence to use, store, process, display and transmit that content solely to operate and improve the service. Two carve-outs sit on the vendor's side: it retains all rights to usage data generated by your activity, usable for analytics, benchmarking and new features, and any feedback you send becomes freely exploitable, with no confidentiality owed to you.

Reuse rights

Yes. What you generate is yours to reuse commercially without asking permission: the Terms state that you own the applications, websites and other projects you build with the service, and that you own the AI output produced for you to the extent applicable law allows. Exported code — React, Vue, Swift, Kotlin or Java — and exported designs in HTML or Sketch can therefore be shipped, sold or handed to a client freely, and nothing in the Terms imposes attribution or a licence fee. Two limits apply, and they concern conduct rather than ownership: you may not reverse-engineer the platform, and you may not use the service to build a competing product. Separately, the vendor keeps the right to exploit usage data and any feedback you provide, without compensation.

Data retention & training

Hosting summary

The vendor states that the service is accessible globally and that personal data is processed in the United States, and potentially in other countries where its servers or service providers are located. Users outside the United States are told explicitly that their data will be transferred to and processed there. For users in the EEA and the United Kingdom, those transfers rely on Standard Contractual Clauses adopted by the European Commission under Article 46(2)(c) GDPR, or other lawful transfer mechanisms, and a copy of the applicable safeguards can be requested by email. Beyond the United States, no specific hosting country is named and no cloud provider is identified in any published document; no subprocessor list exists. During this review the domain resolved to an IP address operated by Amazon and geolocated in the United States, but that is an observation made at collection time and not a statement by the vendor. Security measures are described in general terms only: encryption, access controls and secure hosting, with no certification claimed.