Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) for the processing of personal data on this website is:

Egor Iskhakov
Essenheimer str 131
Mainz 55128
Germany

For privacy questions or to exercise your rights you can reach me at: main@w-flow.tech

This website (w-flow.tech) is operated by me. Where third-party services are integrated (see the sections below), they are named explicitly.

2. Hosting / VPS

This application runs on a dedicated server (virtual private server, VPS) or — for a self-installed copy — on the machine or server of the respective operator. The hosting provider I use is:

STRATO GmbH
Otto-Ostrowski-Straße 7, 10249 Berlin, Deutschland
Deutschland

The hosting provider supplies computing power, storage and network access and processes the technical connection data required for this (in particular IP address and time of the request). A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

Purpose: providing and operating this website.
Legal basis: Art. 6 (1) lit. b GDPR (performance of a contract) and Art. 6 (1) lit. f GDPR (legitimate interest in secure and stable operation).

3. Cloudflare

This website is delivered and protected through the network of Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA). As a reverse proxy, Cloudflare provides DNS resolution, TLS encryption and protection against attacks (including DDoS protection and a web application firewall).

For every request Cloudflare processes the technically necessary connection data, in particular the IP address, time, requested URL, browser and operating system details and security metadata. This data is used for operation, security and attack analysis.

Purpose: secure, fast and resilient delivery of the website.
Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in security and availability).
Processor: a data processing agreement pursuant to Art. 28 GDPR is in place with Cloudflare.

4. Database and files

User accounts, sessions, workflows, execution logs, settings and encrypted credentials are stored in a database. By default this is a SQLite file on the same server; alternatively a PostgreSQL database can be used — for a self-installed copy, on your own server if you wish.

Files you upload or your workflows write (“My files”) are kept in your account's own folder on the same server and are accessible only to your account.

Credentials and secrets (e.g. API keys) are stored encrypted (AES-256-GCM); passwords are stored only as a hash. The database operator has no access to decrypted secrets without the installation's key.

SQLite-Datenbank auf dem eigenen STRATO-Server in Deutschland

Purpose: storing and providing your data.
Legal basis: Art. 6 (1) lit. b GDPR (performance of a contract), Art. 6 (1) lit. c GDPR (statutory retention) and Art. 6 (1) lit. f GDPR (security of operation).

5. User registration

Using the workflow builder requires registration. The following data is collected:

• e-mail address
• password (stored only as a hash, never in plain text)
• Anzeigename sowie freiwillige Profilangaben (Bio, Website, Avatar)
• time of registration

Providing this data is necessary for use; without it no account can be created.

Purpose: providing the user account, attributing your workflows and agents, abuse prevention.
Legal basis: Art. 6 (1) lit. b GDPR (performance of a contract / pre-contractual measures) and Art. 6 (1) lit. f GDPR (abuse prevention).
Retention period: until the account is deleted (see sections 10 and 11).

6. Login / authentication

Sign-in uses a secure server-side process: your password is verified with a salted procedure (scrypt); only the hash is stored. After a successful sign-in a session is created and set as a technically necessary session cookie (ein technisch notwendiges Session-Cookie (HttpOnly) sowie die lokale Speicherung Ihrer Cookie-Auswahl).

The session cookie is used solely to keep you signed in. Optionally, Google or GitHub login (OAuth) can be used; in that case only the data needed to sign in (provider, identifier, e-mail) is processed.

For password resets and e-mail confirmation, single-use tokens are generated that become invalid after a short time.

Purpose: authentication and maintaining the session.
Legal basis: Art. 6 (1) lit. b GDPR (performance of a contract) and Art. 6 (1) lit. f GDPR (security).
Retention period: 14 Tage bzw. bis zur Abmeldung

6a. Connected accounts (Google and other services)

In workflow nodes you can connect an account with a third-party service, such as Google (Gmail, Google Drive, Google Sheets, Google Calendar, Google Docs), Microsoft, GitHub, Slack or Notion. You sign in directly with that service and grant W flow a permission there (OAuth). I never receive your password for that service.

Only the following is stored:

• the service's access token and, where issued, its refresh token — encrypted (AES-256-GCM) in this installation's database
• the e-mail address or name of the connected account, so you can pick it on a node
• the permissions (scopes) you granted

A Telegram account is connected with your phone number instead: the number is sent only to Telegram so it can deliver the sign-in code. Afterwards only the Telegram session is stored, also encrypted.

Use: Data from your connected account is used only to carry out the actions you define in your own workflows — for example sending an e-mail through Gmail, writing a row to Google Sheets or creating a calendar event — and only while a workflow runs. Content from your accounts is processed only within that run and, like every run result, stored in your own account's execution log. It is passed on only to services you configure yourself in the same workflow.

AI providers: for AI nodes, agents and the AI workflow builder you add your own API key from an AI provider (e.g. Anthropic, OpenAI, Google). Your input is sent directly to the provider you chose and processed there under that provider's privacy terms.

Workflows übermitteln nur die Daten, die Sie selbst in einem Knoten konfigurieren, an den dort gewählten Dienst (z. B. KI-Anbieter, E-Mail-, Chat- oder Cloud-Dienste). Diese Übermittlung erfolgt in Ihrem Auftrag.

I do not sell this data, do not share it for advertising, do not use it for advertising and do not use it to train AI models. People only look at it with your explicit consent (for example for a support request), where needed for security or to investigate abuse, or where the law requires it.

Google user data: W flow's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access: you can disconnect an account at any time — in W flow under “Credentials” (the stored tokens are deleted) and in the service's account settings; for Google at myaccount.google.com/permissions.

Purpose: running the workflows you build with your own accounts.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(a) GDPR (your consent when connecting the account).
Storage period: until you disconnect the account or delete your W flow account.

7. Confirmation e-mails

When you create an account, reset your password or confirm your e-mail address, the server sends an e-mail to the address on file. The message contains a single-use link or code.

For delivery I use an e-mail service provider or my own SMTP server. The data transmitted includes your e-mail address, the time of sending and technical metadata of the mail server.

checkdomain GmbH (E-Mail-Postfach der Domain w-flow.tech)

Purpose: confirming the e-mail address, account security, password reset.
Legal basis: Art. 6 (1) lit. b GDPR (performance of a contract) and Art. 6 (1) lit. f GDPR (account security).
Processor: a data processing agreement pursuant to Art. 28 GDPR is in place with the delivery provider.

7a. Payments and licences (Stripe)

W flow can be used on the free plan without any payment details. If you book a paid plan (Pro or Team), payment is handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You enter your payment details (e.g. card number) directly with Stripe; I never receive them.

I store only: the Stripe customer and subscription identifiers, your plan, the status and term of the subscription and — for a self-installed copy — your licence key. A Team plan request also stores the number of accounts, an optional company name and your message.

Licence check: a self-installed copy regularly asks w-flow.tech whether its licence key is valid. Only the key is sent (plus, for technical reasons, the copy's IP address); no account, workflow, run or credential of the copy ever reaches me.

More on privacy at Stripe: stripe.com/privacy.

Purpose: handling the subscription, unlocking the plan, licence checks.
Legal basis: Art. 6 (1) lit. b GDPR (performance of a contract) and Art. 6 (1) lit. c GDPR (tax and commercial retention).
Retention period: until the subscription ends; invoice data up to 10 years (§ 147 AO, § 257 HGB).

8. IP addresses / server logs

On every visit to the website and every execution through the API, the server automatically records technical access data:

• IP address of the requesting device
• date and time of the request
• page, file or API endpoint accessed
• amount of data transferred and status code
• browser type, browser version and operating system
• referrer URL

This data serves to ensure trouble-free operation, error analysis and defence against attacks. It is not combined with other data sources or evaluated for marketing purposes.

Purpose: operational security, error analysis, abuse and attack detection.
Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in secure and stable operation).

9. Cookies / local storage

This website uses technically necessary cookies and your browser's local storage (localStorage). Specifically:

• session cookie for sign-in (technically necessary)
• cookie and local entry storing your cookie choice (honours your decision)
• local editor settings (e.g. auto-save, maximum log entries)
• language choice of the legal pages

On your first visit a notice banner asks whether you allow optional preferences in addition to the technically necessary cookies. You can change your decision at any time in the settings. Technically necessary cookies are required for operation and are set on the basis of Art. 6 (1) lit. b and lit. f GDPR; optional storage is based on your consent pursuant to Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG.

No analytics, tracking or advertising cookies are used.

Retention period: 14 Tage bzw. bis zur Abmeldung

10. Data deletion

You can delete your account at any time. Deleting it removes the account, your workflows, agents, credentials, variables, data tables, files and execution logs. Published templates can also be removed individually from your profile.

You can delete your account via: die Kontoeinstellungen (Einstellungen → Konto) oder eine formlose E-Mail. Alternatively, a message to main@w-flow.tech is sufficient; I will then delete the data without undue delay, unless statutory retention obligations apply.

Where statutory retention obligations exist (e.g. commercial or tax law for paid services), the affected data is kept for the duration of the obligation and deleted afterwards.

Legal basis: Art. 6 (1) lit. c GDPR (statutory retention) and Art. 17 GDPR (right to erasure).

11. Storage periods

I store personal data only for as long as is necessary for the stated purposes or as required by law:

• account data: until the account is deleted
• workflows, agents and configurations: until they or the account are deleted
• execution logs: until they or the account are deleted
• files (“My files”): until they or the account are deleted
• invoice and payment data: up to 10 years (statutory retention)
• sessions: 14 Tage bzw. bis zur Abmeldung
• cookie choice: until withdrawn, at most 180 days

Server-Logs: 7 Tage; automatische Datenbank-Sicherungen: 14 Tage; Konto-, Workflow- und Ausführungsdaten: bis zur Löschung des Kontos

Once the respective period expires, the data is deleted or anonymised so that it can no longer be attributed to you.

12. Legal bases

The processing of personal data is based on the following legal bases of the GDPR:

• Art. 6 (1) lit. a GDPR — consent (e.g. optional cookies, social login via a third party)
• Art. 6 (1) lit. b GDPR — performance of a contract or pre-contractual measures (account, workflow builder, e-mail confirmation)
• Art. 6 (1) lit. c GDPR — compliance with legal obligations (in particular retention obligations)
• Art. 6 (1) lit. f GDPR — legitimate interests (operational security, error analysis, abuse prevention)

No processing of special categories of personal data (Art. 9 GDPR) takes place. Where you run your own workflows that process personal data, you are responsible for them; the builder and the services you configure process data solely on your instructions.

13. Data-subject rights

As a data subject you have the following rights:

• Art. 15 GDPR — access to the data processed
• Art. 16 GDPR — rectification of inaccurate or incomplete data
• Art. 17 GDPR — erasure of your data
• Art. 18 GDPR — restriction of processing
• Art. 20 GDPR — data portability (export in a common format)
• Art. 21 GDPR — objection to processing based on legitimate interests
• Art. 7 (3) GDPR — withdrawal of consent with effect for the future

To exercise these rights, a message to main@w-flow.tech is sufficient. An export of all your data is also available directly in the account settings. You also have the right to lodge a complaint with a supervisory authority (see section 15).

14. International data transfers

Some integrated services may process data outside the European Union or the European Economic Area, in particular in the USA (Cloudflare, Inc. and — for paid plans — Stripe, Inc.). Such a transfer only takes place where necessary for operation or permitted by law.

Cloudflare and Stripe are certified under the EU-U.S. Data Privacy Framework, so transfers rely on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR) and additionally on the EU standard contractual clauses (Art. 46 GDPR).

You can request a copy of the safeguards in place at main@w-flow.tech.

15. Supervisory authority / right to complain

Without prejudice to any other administrative or judicial remedy, you have the right under Art. 77 GDPR to lodge a complaint with a supervisory authority — in particular in the member state of your habitual residence, place of work or place of the alleged infringement.

You are welcome to raise any concerns with me first; I will then deal with your request without undue delay.

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz

Weitere Maßnahmen: TLS-Verschlüsselung (HTTPS), verschlüsselt gespeicherte Zugangsdaten, Passwort-Hashing (scrypt), Firewall und tägliche Datensicherungen.