Privacy Policy

This Privacy Policy explains how Workflood LLC, an Illinois limited liability company that provides services under the Workflood brand ("Workflood," "we," "us," or "our"), collects, uses, discloses, and protects personal information when you use workflood.dev and our workflow automation services (the "Services").

If you use the Services for an organization, that organization controls the workflow data and other information it submits. Workflood generally processes that information on the organization's behalf. The organization's own privacy notices may also apply.

1. Information we collect

• Account and identity information: email address, password hash, email-verification status, multi-factor authentication settings, workspace membership, role, and session information.
• Google sign-in information: your Google account identifier, verified email address, and authentication tokens or assertions needed to sign you in. Workflood requests only the OpenID, email, and basic profile scopes used for authentication.
• Customer content: workflow code, configuration, schedules, webhook payloads, action inputs and outputs, run history, logs, tags, and other content submitted to or generated through the Services.
• Connection and secret data: API keys, access tokens, webhook URLs, allowlists, and other credentials you choose to store for connected services. Secrets are intended to be encrypted at rest.
• Billing information: subscription tier, billing status, customer and subscription identifiers, and transaction metadata. Payment card information is collected and processed by Stripe rather than stored by Workflood.
• Usage and device information: IP address, browser and device information, timestamps, pages and features used, request metadata, error details, security events, and audit records.
• Communications: messages, support requests, feedback, and notification preferences.

2. How we use information

We use information to:

• provide, operate, secure, troubleshoot, and improve the Services;
• authenticate users and administer accounts, workspaces, and permissions;
• execute workflows, schedules, webhooks, integrations, and customer instructions;
• process subscriptions, enforce plan limits, and maintain transaction records;
• send service, security, billing, and support communications;
• detect, investigate, and prevent fraud, abuse, and security incidents;
• comply with law and enforce our agreements; and
• create aggregated or de-identified insights that do not reasonably identify you.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use customer content or Google user data to train generalized artificial-intelligence or machine-learning models.

3. Google user data

Workflood uses information received from Google only to authenticate you, associate your Google identity with your Workflood account, protect account security, and provide related user-facing features you request.

Workflood's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use Google user data for advertising, sell it, transfer it to data brokers, use it to determine creditworthiness, or use it to train generalized AI models.

4. When we disclose information

We may disclose information in the following circumstances:

• Service providers: vendors that provide hosting, infrastructure, database, storage, email, payment, security, monitoring, and support services, subject to contractual or other appropriate safeguards.
• Customer-directed integrations: third parties and destinations you instruct Workflood to connect with or send data to.
• Your organization: workspace owners and administrators may access and manage workspace information and user activity.
• Legal and safety reasons: when we reasonably believe disclosure is necessary to comply with law or legal process, protect rights or safety, investigate abuse, or secure the Services.
• Business transactions: in connection with a financing, merger, acquisition, reorganization, or sale of assets, subject to appropriate confidentiality and notice requirements.
• With consent: when you authorize or request the disclosure.

5. Data retention

We retain information for as long as reasonably necessary to provide the Services, maintain security and auditability, comply with legal and accounting obligations, resolve disputes, and enforce agreements. Retention varies by data type, workspace settings, subscription plan, and operational need.

When information is no longer required, we take reasonable steps to delete or de-identify it. Deletion from backups and disaster-recovery systems may take additional time. We may retain information when required by law, necessary for security or fraud prevention, or needed to establish or defend legal claims.

6. Security

We use administrative, technical, and organizational safeguards designed to protect information, including access controls, encryption of stored secrets, audit logging, rate limiting, and isolation for customer code execution. No system is completely secure, and we cannot guarantee that unauthorized access, loss, or misuse will never occur. You are responsible for protecting your credentials, configuring integrations appropriately, and limiting the sensitive data submitted to workflows.

7. International data transfers

Workflood and its service providers may process information in the United States and other countries where privacy laws may differ from those in your location. Where required, we use appropriate safeguards for international transfers. Business customers may contact us regarding a data processing agreement.

8. Your choices and privacy rights

Depending on your location and applicable law, you may have rights to access, correct, delete, restrict, object to, or obtain a portable copy of personal information, and to withdraw consent where processing relies on consent. You may also have the right to appeal a decision or complain to a data-protection authority.

You can update certain account information in the Services. To submit another request, email [email protected]. We may need to verify your identity and authority. If your information is controlled by a Workflood customer, direct your request to that customer; we will assist the customer as required.

Workflood does not sell or share personal information for cross-context behavioral advertising and therefore does not offer a sale or sharing opt-out. If our practices change, we will update this Policy and provide any required controls.

9. Cookies and similar technologies

We use cookies and similar technologies that are necessary for authentication, session security, preferences, and operation of the Services. We may use limited measurement or diagnostic technologies to understand performance and reliability. We do not use third-party advertising cookies to build advertising profiles across unrelated services.

10. Children

The Services are intended for business users and are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

11. Third-party services

The Services may connect to third-party products selected by you. Their handling of information is governed by their own terms and privacy policies. Workflood is not responsible for third-party services that it does not control.

12. Changes to this Policy

We may update this Policy as the Services, our practices, or legal requirements change. We will post the updated version with a new effective date and provide additional notice when required by law. Your continued use after an update is subject to the revised Policy, to the extent permitted by law.

13. Contact us

Questions or privacy requests for Workflood LLC may be sent to [email protected].