Data Processing Addendum
Version 2026-10-01
Highlighted passages (8) are waiting for an owner decision or legal review and are not final. Everything else describes how Flowyn works today.
1. Parties and scope
This Data Processing Addendum ("DPA") forms part of the Flowyn Terms of Service between the customer ("Customer", controller) and Pending owner decision: legal name, registration number and registered address of the company that operates Flowyn ("Flowyn", processor). It applies when Flowyn processes personal data contained in Customer Data on Customer's behalf. Terms not defined here have the meaning in the GDPR, the UK GDPR or other applicable data protection law. Pending legal review: review against GDPR article 28, UK GDPR and the US state laws that apply to customers (for example CCPA service-provider terms)
2. Details of processing (Annex I)
| Item | Description |
|---|---|
| Subject matter | Providing the Service under the Terms. |
| Duration | The term of the agreement, plus the time needed to delete data as described in section 9. |
| Nature and purpose | Storing, converting, transmitting, retrying and displaying Customer Data as Customer instructs through the dashboard and API. |
| Categories of data subjects | Determined by Customer. Typically Customer's end users, employees and contacts whose data appears in files, events, job requests or agent records. |
| Categories of personal data | Determined by Customer. Any personal data Customer puts in files, event payloads, job URLs, headers and bodies, monitor targets, flag rules and agent run records. |
| Special categories | None intended. Customer must not submit special categories unless it has assessed the Service as appropriate. |
| Frequency | Continuous, while Customer uses the Service. |
3. Flowyn's obligations
- Process personal data only on Customer's documented instructions, which are the Terms, this DPA and Customer's configuration and use of the Service, unless the law requires otherwise; in that case Flowyn will tell Customer first unless the law forbids it.
- Tell Customer if it believes an instruction breaks data protection law.
- Make sure people authorized to process the data are bound by confidentiality.
- Apply the security measures in Annex II.
- Help Customer, taking into account the nature of the processing, to respond to data subject requests, carry out data protection impact assessments and consult authorities.
- Not sell Customer personal data, not use it for its own purposes, and not combine it with other data except as needed to provide the Service.
4. Subprocessors
Customer gives general authorization for Flowyn to use the subprocessors listed on the Subprocessors page. Flowyn imposes data protection terms on each subprocessor that are no less protective than this DPA and remains responsible for them.
Flowyn will announce a new or replacement subprocessor on the Subprocessors page and by email to workspace owners Pending owner decision: notice period, for example 30 days before it processes Customer personal data. Customer may object on reasonable data protection grounds within that period; the parties will discuss it in good faith, and if they cannot resolve it Customer may terminate the affected Service and receive a refund of prepaid fees for it.
5. International transfers
Where Customer personal data is transferred from the EEA, the UK or Switzerland to a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module 2 controller to processor, and Module 3 where Customer is itself a processor) apply, with the UK International Data Transfer Addendum for UK transfers. Pending legal review: complete the clause options (docking clause, clause 9 option, clause 11 option, clauses 17 and 18 governing law and courts) and the competent supervisory authority
6. Personal data breaches
Flowyn will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data, and give the information Customer reasonably needs to meet its own obligations as it becomes available. Pending owner decision: decide whether to commit to a fixed notification window, for example 72 hours
7. Audits
Flowyn will make available the information reasonably necessary to demonstrate compliance with this DPA, including written answers to security questionnaires and its subprocessors' certifications and reports where they allow sharing. Flowyn holds no independent certification of its own. If that information is not enough, Customer may audit once a year with reasonable notice, at its own cost, under confidentiality, in a way that does not disrupt the Service or other customers.
8. Data subject requests
Flowyn will forward to Customer any request it receives from a data subject about Customer personal data and will not answer it except as Customer instructs. Customer can read Customer Data through the dashboard and API and can delete schedules, endpoints, alert channels, credentials and incomplete uploads itself. Completed files, jobs and events cannot yet be deleted one by one; they are removed by the plan history window where it applies, or by deleting the workspace. Until individual deletion exists, Flowyn will delete specific records on Customer's written request. Pending owner decision: commit to a response time for such requests
9. Deletion and return
Customer can delete resources at any time. When a workspace is deleted, Flowyn deletes its database records and the bytes of its stored files. Removing stored file bytes can finish shortly after the records are deleted. Deleted data may remain in the database provider's backups until they expire. Flowyn does not yet offer a one-click full workspace export; until it does, Flowyn will help Customer export its data on request before deletion. Pending owner decision: confirm backup retention and commit to a deletion timeline, for example within 30 days of termination
10. Order of precedence
If this DPA conflicts with the Terms, this DPA wins for the processing of personal data. If the Standard Contractual Clauses apply and conflict with this DPA, the Clauses win.
Annex II: technical and organizational measures
- Encryption in transit: the API, dashboard and website are served over HTTPS.
- Encryption at rest: the database and file storage are encrypted at rest by Supabase. Flowyn additionally encrypts webhook signing secrets, provider credentials, OAuth tokens and stored idempotent responses with AES-256-GCM before writing them.
- API keys are stored only as SHA-256 hashes with their last four characters; plaintext is shown once at creation.
- Tenant isolation: every request is authorized against the workspace and environment derived from the credential, never from a client-supplied workspace id.
- Access to production systems is limited to Flowyn personnel who need it. Pending owner decision: describe personnel access controls, multi-factor authentication and offboarding
- Logs and error reports redact keys, secrets and tokens; server error reports do not include user identity or request bodies.
- Outbound requests are checked to block private and internal network addresses.
- Rate limiting and per-workspace concurrency limits.
- Not yet in place and not claimed: application-level encryption of job headers and bodies, independent penetration testing, SOC 2 or ISO 27001 certification.