Controller
MMR Labs GmbH, Carl-Benz-Straße 6, 89269 Vöhringen, Germany. Email: info@liquiflow.app
Overview
- We set cookies only for signing in to the free account. Both are technically necessary. There is no tracking, no visitor statistics, no analytics or advertising services. That is why there is no consent banner.
- We load no scripts, fonts or images from third-party servers. The Inter font is hosted on our own server.
- The tools run in your browser. Images you open there are not sent to us.
- We process personal data when a page is requested (server logs at Cloudflare), when counting free images (only a salted hash of your IP address), for the free account (your email address and the proof record of your images; the images themselves only as a preview if you add them to the library on the Enterprise plan) and when you write to us.
Hosting with Cloudflare
The website consists of static pages and a few server functions for the free account. Both run on Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare acts as our processor (Art. 28 GDPR).
When a page is requested, Cloudflare processes technically necessary data: IP address, time, requested address, amount of data transferred, browser and operating system, and the previous page if your browser sends it. No page can be delivered without this data. It also serves security and protection against attacks. The legal basis is our legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR). We do not use this data for statistics and do not combine it with other data.
Cloudflare may process data in the USA. Cloudflare is certified under the EU-US Data Privacy Framework. The data processing agreement with Cloudflare includes the EU standard contractual clauses.
Tools in your browser
Adding a label, checking and writing metadata, the labelling check and the other tools run entirely in your browser. Images are not uploaded and not sent to us. Your answers in the labelling check are also evaluated by your browser. Files you download are created on your device.
Hints on the page
On guide pages, a “How can we help?” choice may appear at the bottom right, and on desktop a hint pointing to the labelling tool when you leave the page. So that neither appears again and again, your browser stores only the time a hint was shown or closed in local storage, and in session storage that one was already shown in this tab. This information never leaves your device; no cookies are set and nothing is sent to us. You can delete it in your browser at any time.
Free images without signing in
With “Label an AI image” and “Write the AI note into the file” you can download up to 3 images in total per internet connection in 30 days without signing in. To count them, your browser tells our server which tool and which kind of label or note you chose when you download. The image and its file name are not sent. We store a salted hash of your IP address, the kind of label and the time, not the IP address itself. We delete these entries automatically after 31 days. The legal basis is our legitimate interest in distributing the free offer fairly and protecting it from abuse (Art. 6(1)(f) GDPR).
To prevent abuse, we also limit how often a connection can call our server functions within a short time. For this, too, we store only salted hashes and delete them once the time window has passed.
Free account and sign-in
For more images you create a free account with 30 images a month. There is no password: you enter your email address, and we send you a 6-digit code valid for 10 minutes. We store your email address and when you created the account. For the proof record we store, for each image you download while signed in: time, tool, kind of label or note, the file name, width and height in pixels, the SHA-256 checksum of the finished file, and the position, language, size and colour of the label. We do not transfer the image itself, unless on the Enterprise plan you expressly add a preview to the library (see below). We store the file name as you chose it. If you save a template, we store these settings too. If you record a decision in the labelling check, we store per image the file name, the SHA-256 checksum of the original file, your answers and the result with citations; your browser calculates the checksum and the image stays on your device. Sign-in codes and sessions are stored only as hashes. The data is kept in a Cloudflare database (Cloudflare D1), see “Hosting with Cloudflare”. The legal basis is providing the account you create (Art. 6(1)(b) GDPR).
We send the sign-in code through the email service Resend (Resend, Inc., USA) as our processor. Resend processes your email address and the content of the message for this. The transfer to the USA is based on the EU standard contractual clauses.
When you request a code, we set a technically necessary cookie for 15 minutes (__Host-al_login) that binds the code to your browser. After signing in, we set a technically necessary session cookie (__Host-al_sitzung, 30 days) so you stay signed in. Neither is used for tracking. The legal basis for storing them in your browser is Section 25(2) no. 2 TDDDG.
If you go to sign in from the tool, it briefly keeps your image and settings in your own browser's storage (IndexedDB) so they are there again after signing in. The image never leaves your device. The entry is deleted as soon as you return and discarded after 30 minutes at the latest.
Instead of the code you can sign in with Google once this option is offered. We then redirect you to Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google confirms your email address to us in a signed token; we receive no other data from your Google account. We do not load any Google script on our pages for this. For the duration of the sign-in we set a technically necessary cookie (al_oidc, 10 minutes) that binds the request to Google to your browser. The legal basis is providing the account (Art. 6(1)(b) GDPR), and for the cookie Section 25(2) no. 2 TDDDG. Google's privacy policy applies to processing at Google.
You can delete your account yourself at any time on the account page. This deletes your email address, your sessions, the proof record and your template; as a team owner also the team's library, share links and audit log. You can download the record as CSV beforehand.
Store scan
If you enter a store address in the store scan, our server retrieves the public pages and image files of that store (robots.txt, sitemap, pages, images) and passes the images to your browser for the check. None of it is stored; the store sees the request with the identifier “AI-Label-Scan”. With an account we save to your history the store, the time, the counts and the list of images with AI traces or marking (image and page address, traces found), without image data. The legal basis is providing the tool (Art. 6(1)(b) GDPR). The history is deleted with the account.
Teams, audit log and library
On the Organisation and Enterprise plans, several people work in a shared workspace. If someone invites you, we process your email address, the intended role and who invited you, and send the invitation through Resend. The invitation is valid for 7 days; we store the link only as a hash. If you join, the people in the team see your email address and your role, and what you label in the team appears with your email address in the shared proof record. For the data in a workspace we act on behalf of the company that booked the plan (Art. 28 GDPR); its privacy notice applies in addition.
In the audit log we store, for each action in the team, the time, the email address of the person acting, the type of action and its details, such as file name and checksum, invited address and role, or whether the sign-in used a code or Google. Entries cannot be changed. They remain when a person leaves the team or deletes their account, because they document the team's work, and are deleted when the owner's account is deleted.
The library is part of the Enterprise plan. Only if you expressly choose “Add to the library” when downloading do we transfer a reduced preview of the labelled image (longest side 640 pixels) with file name, dimensions, checksum, time and your email address. The original image stays in your browser. Anyone with a share link sees the shared previews with file name, date and checksum, but no email addresses; we only count the views. We store the link encrypted. Previews remain until someone in the team deletes them or the owner's account is deleted.
Notification when an app launches
On some pages you can ask to be notified as soon as our app is available for a particular store system. A button opens a prepared email in your email program. There is no form and no database on this website: we only receive something once you send the email yourself.
We then process your email address and the content of your message, for example the store system and, if you provide it, your store's address. We use this information only for that one notification and to answer questions, not for advertising or any other purpose. The legal basis is your consent (Art. 6(1)(a) GDPR), or Art. 6(1)(b) GDPR where your request concerns a contract.
The email is kept in our mailbox at our email provider. We delete it after the notification. You can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR); a short message to info@liquiflow.app is enough. On request we delete your email immediately.
Widget on other websites
Operators of other websites can embed our widget, which adds the AI label to images they have marked. The browsers of their visitors then load the file widget.js from www.ai-label.app. Cloudflare processes the technical data listed under “Hosting”, including the IP address.
The widget sets no cookies and stores nothing in the browser. The icons are included in the file. Only for languages other than German and English does it also load a small text file with the label text from ai-label.app; as with any request, our host sees the IP address. It only reads the images of the page it runs on and sends nothing about them to us. The operator of the website that embeds it is responsible for doing so.
Contact by email
If you write to us, we process your details to answer your request (Art. 6(1)(b) GDPR where a contract is concerned, otherwise point (f)). We delete them when they are no longer needed for this purpose and no retention obligation applies.
Links to other websites
Many pages link to sources such as EUR-Lex, the European Commission or help pages of store systems. Your browser only connects to such a website once you follow the link. Their privacy policies apply there.
Retention
- Server logs at Cloudflare: according to Cloudflare's retention periods.
- Count of free images (salted IP hash): 31 days.
- Sign-in codes: 10 minutes. Sessions: 30 days or until you sign out.
- Account, proof record and template: until you delete the account; the template earlier if you delete it yourself.
- Team invitations: 7 days. A team's audit log, library and share links: until deleted in the team or until the owner's account is deleted.
- Requests to be notified: until the notification or until you withdraw consent.
- Emails to us: as long as needed for your request and no retention obligation applies.
Your rights
You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15 to 20 GDPR). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR).
Right to object: Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). An informal email is enough.
You can also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.
Use of the tools and the widget is also governed by the terms of use.
Last updated: 12 October 2026