Flow Data Processing Agreement

Version: 2026-09-17 · Effective date: September 17, 2026

This Data Processing Agreement (“DPA”) forms part of the Flow Terms & Conditions (the “Agreement”) between Flow Labs LLC (“Flow,” “we,” “us”) and the customer organization that has accepted the Agreement (“Customer,” “you”). It governs Flow’s processing of Personal Data on your behalf.

This DPA is automatically incorporated into the Agreement. You do not need to sign or return it, and you do not need to request one — accepting the Terms & Conditions accepts this DPA. If your procurement process requires a countersigned copy, email support@theflowtool.com and we will provide one.

If this DPA conflicts with the Agreement as to the processing of Personal Data, this DPA controls.

1. Definitions

  • “Controller,” “Processor,” “Data Subject,” “Personal Data,” and “processing” have the meanings given in applicable Data Protection Law. Where a law uses different terms for equivalent concepts (for example, “Business” and “Service Provider” under the CCPA), those terms apply correspondingly.

  • “Customer Personal Data” means Personal Data contained within Customer Content that Flow processes on your behalf under the Agreement.

  • “Customer Content” has the meaning given in the Agreement — all data, files, documents, tasks, deliverables, messages, comments, form responses, invoices, and other material you or your Authorized Users submit to the Service.

  • “Data Protection Law” means all privacy and data-protection laws applicable to the processing of Customer Personal Data, including the California Consumer Privacy Act as amended (“CCPA”) and the comprehensive privacy statutes of other US states.

  • “Security Incident” means a breach of Flow’s security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data. It does not include unsuccessful attempts or incidents that do not compromise the security of Customer Personal Data (such as pings, port scans, or failed login attempts).

  • “Subprocessor” means a third party engaged by Flow to process Customer Personal Data.

2. Roles and Scope

2.1 Roles. For Customer Personal Data, you are the Controller and Flow is the Processor. You determine the purposes and means of processing; we process only on your behalf.

2.2 Flow as Controller. Flow acts as a Controller for a limited set of data it collects for its own purposes — account registration data, billing data, and product-analytics data described in our Privacy Policy. This DPA does not apply to that processing.

2.3 Your responsibilities. You are responsible for:

(a) the accuracy, quality, and legality of Customer Personal Data and the means by which you acquired it;

(b) having a lawful basis for the processing, and providing all notices and obtaining all consents required by Data Protection Law from the individuals whose data you place in the Service;

(c) your instructions to us complying with Data Protection Law; and

(d) configuring the Service’s access controls appropriately and managing which of your Authorized Users can see which data.

This matters in Flow’s specific context. Flow is designed for agencies and teams who invite their own clients into a shared workspace. Where you store information about your clients, their staff, or your own team members, you — not Flow — are responsible for telling those people that their information is held in Flow and for having the right to put it there.

2.4 Prohibited data. As set out in Section 5.5 of the Agreement, you may not submit to the Service any government identification numbers, full payment card numbers, protected health information subject to HIPAA, or other data subject to sector-specific regulation, unless we have agreed in writing in advance. The Service is not designed or certified for such data, and we accept no liability arising from your submission of it.

3. Processing of Customer Personal Data

3.1 Instructions. Flow will process Customer Personal Data only:

(a) in accordance with your documented instructions, including as necessary to provide the Service and to fulfil our obligations under the Agreement;

(b) as necessary to comply with applicable law, in which case we will inform you of that legal requirement before processing unless the law prohibits it; and

(c) as otherwise agreed in writing.

The Agreement, this DPA, and your configuration and use of the Service constitute your complete documented instructions.

3.2 No sale or sharing. Flow will not sell or share Customer Personal Data as those terms are defined by the CCPA, and will not retain, use, or disclose Customer Personal Data for any purpose other than performing the Service, except as permitted by Data Protection Law. Flow will not combine Customer Personal Data with personal information it receives from other sources, except as permitted by the CCPA for a Service Provider. Flow certifies that it understands and will comply with these restrictions.

3.3 No advertising. Flow does not use Customer Personal Data for advertising and does not operate advertising, retargeting, or marketing pixels on the Service.

3.4 No AI or model training. Flow does not use Customer Content or Customer Personal Data to develop, train, or improve artificial-intelligence or machine-learning models. Flow does not currently offer AI features. If Flow introduces them, it will not process Customer Personal Data for model training without first amending this DPA and providing you notice and an opportunity to object.

3.5 Aggregated and de-identified data. Flow may generate aggregated or de-identified data from the operation of the Service for its own analytics and product-improvement purposes, provided such data cannot reasonably be used to identify you, any Data Subject, or any individual, and Flow does not attempt to reidentify it.

3.6 Confidentiality. Flow will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations and receive appropriate training, and will limit access to those personnel who require it to provide, secure, or support the Service.

3.7 Details of processing. The subject matter, duration, nature, purpose, categories of Personal Data, and categories of Data Subjects are described in Annex I.

4. Security

4.1 Measures. Flow will implement and maintain the technical and organizational measures described in Annex II, designed to protect Customer Personal Data against a Security Incident. Flow may update these measures over time provided the overall level of protection is not reduced.

4.2 Your backups. You acknowledge that no software is immune from defects or data loss, as described in Section 11 of the Agreement, and that you are responsible for maintaining independent backup copies of Customer Content.

4.3 Security Incident notification. Flow will notify you without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notification will describe, to the extent known: the nature of the incident, the categories and approximate volume of data and Data Subjects affected, the likely consequences, and the measures taken or proposed. Flow will provide reasonable cooperation and information to assist you in meeting your own notification obligations. Flow’s notification is not an acknowledgment of fault or liability.

4.4 Your notification obligations. As Controller, you are responsible for determining whether an incident requires notification to Data Subjects or regulators, and for making those notifications. Flow will not notify your Data Subjects directly unless required by law or requested by you in writing.

5. Subprocessors

5.1 General authorization. You grant Flow general authorization to engage Subprocessors to process Customer Personal Data, subject to this Section 5.

5.2 Current Subprocessors. Flow’s Subprocessors are listed at [theflowtool.com/subprocessors](https://theflowtool.com/subprocessors) and reproduced in Annex III.

5.3 New Subprocessors. Flow will give you at least 30 days’ advance notice before engaging a new Subprocessor that will process Customer Personal Data, by email to your organization administrators and by updating the subprocessor page. You may object on reasonable data-protection grounds within that period by emailing support@theflowtool.com. If we cannot resolve your objection, you may terminate the Agreement without penalty by written notice, and we will refund any prepaid fees covering the period after termination.

5.4 Subprocessor obligations. Flow will impose on each Subprocessor, by written contract, data-protection obligations no less protective than those in this DPA. Flow remains fully liable to you for each Subprocessor’s performance of its obligations.

6. Data Subject Requests

6.1 Self-service. The Service provides functionality allowing you to access, correct, export, and delete Customer Personal Data directly. In most cases you can respond to a Data Subject request without our involvement.

6.2 Assistance. Taking into account the nature of the processing, Flow will provide reasonable assistance — including by appropriate technical and organizational measures, insofar as possible — to help you fulfil your obligation to respond to Data Subject requests, at no additional charge unless the assistance requested is disproportionate.

6.3 Requests received by Flow. If Flow receives a request directly from a Data Subject relating to Customer Personal Data, Flow will not respond to it substantively except to acknowledge receipt and direct the individual to you, and will promptly inform you of the request.

6.4 Government and law-enforcement demands. If Flow receives a legally binding demand from a public authority for Customer Personal Data, Flow will, unless legally prohibited: notify you before disclosing; seek to redirect the authority to request the data directly from you; and disclose only the minimum required. If prohibited from notifying you, Flow will use reasonable efforts to challenge the prohibition.

7. Data Protection Impact Assessments

Flow will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities relating to the Service, taking into account the nature of the processing and the information available to Flow.

8. Audit

8.1 Documentation. On written request, and no more than once per twelve (12) month period, Flow will make available information reasonably necessary to demonstrate compliance with this DPA, including responses to a reasonable security questionnaire and copies of any third-party audit reports or certifications Flow then holds.

8.2 On-site audit. Where the information provided under Section 8.1 is not sufficient to demonstrate compliance, and where required by Data Protection Law, you may request an audit. Any such audit will be: subject to at least 30 days’ written notice; conducted during normal business hours; limited to systems used to process Customer Personal Data; subject to confidentiality obligations; conducted so as not to disrupt Flow’s operations or compromise other customers’ data or Flow’s security; and at your expense, except where the audit reveals material non-compliance, in which case Flow bears the reasonable cost.

8.3 Certification disclosure. Flow is an early-stage company and does not currently hold SOC 2, ISO 27001, or comparable third-party certification. We say so plainly rather than imply otherwise. Annex II describes the measures actually in place.

9. Retention, Return, and Deletion

9.1 Retention. Flow will retain Customer Personal Data only for as long as necessary to provide the Service, or as required by applicable law.

9.2 Export window. During the term and for 30 days after termination or expiration of the Agreement, you may export Customer Content using the Service’s export tools or by written request to support@theflowtool.com.

9.3 Deletion. After the export window in Section 9.2, Flow will delete Customer Content from production systems within 30 days, and will delete or anonymize associated account information within 90 days of a verified deletion request. Copies held in encrypted backups are purged on a rolling basis within 90 days. Server and application logs are retained for 6 months.

9.4 Exceptions. Flow may retain Customer Personal Data to the extent required by applicable law or by a legal hold, provided it maintains the confidentiality of that data and processes it only as necessary for the purpose requiring retention.

9.5 Certification. On written request, Flow will certify in writing that deletion has been completed in accordance with this Section 9.

10. International Transfers

Flow and all of its Subprocessors process Customer Personal Data in the United States. Flow does not currently transfer Customer Personal Data outside the United States.

The Service is not offered in the European Economic Area, the United Kingdom, or Switzerland, and this DPA therefore does not incorporate the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Addendum. Do not use the Service to process the personal data of individuals located in those regions. Should Flow offer the Service in those regions, it will amend this DPA to incorporate the appropriate transfer mechanism before doing so.

11. CCPA-Specific Terms

To the extent Flow processes Personal Information (as defined by the CCPA) on your behalf, you are a Business and Flow is a Service Provider. Flow will:

(a) not sell or share such Personal Information;

(b) not retain, use, or disclose it for any purpose other than performing the services specified in the Agreement, including not retaining, using, or disclosing it for a commercial purpose other than providing the Service;

(c) not retain, use, or disclose it outside the direct business relationship between Flow and you;

(d) not combine it with personal information received from another source, except as permitted by the CCPA;

(e) comply with the applicable obligations of the CCPA and provide the same level of privacy protection it requires;

(f) notify you if Flow determines it can no longer meet its obligations under the CCPA; and

(g) grant you the right, on notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Information.

Flow certifies that it understands the restrictions in this Section 11 and will comply with them.

12. Liability and General

12.1 Liability. Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Agreement.

12.2 Term. This DPA takes effect when you accept the Agreement and continues until Flow has deleted all Customer Personal Data in accordance with Section 9.

12.3 Changes. Flow may update this DPA where required by a change in Data Protection Law, in its Subprocessors, or in the Service, provided the update does not materially reduce the protections afforded to Customer Personal Data. Material changes will be notified at least 30 days in advance.

12.4 Governing law. This DPA is governed by the law and subject to the venue specified in the Agreement.

12.5 Severability. If any provision of this DPA is held unenforceable, the remainder remains in effect.

12.6 Order of precedence. In the event of conflict: a signed data processing agreement between the parties, then this DPA, then the Agreement.

ANNEX I — Details of Processing

Roles. Customer is Controller; Flow is Processor.

Subject matter. Flow’s provision of the Flow project-management and client-collaboration platform under the Agreement.

Duration. The term of the Agreement, plus the retention periods in Section 9.

Nature and purpose of processing. Hosting, storage, organization, structuring, retrieval, transmission, display, backup, and deletion of Customer Content, in order to provide project management, task tracking, deliverable review and approval, file storage and versioning, messaging, form collection, invoicing, calendaring, and notification functionality to Customer and its Authorized Users.

Categories of Data Subjects:

  • Customer’s personnel — administrators, managers, and team members with Flow accounts

  • Customer’s own clients and their personnel — invited into Customer’s workspace as client-portal users

  • Third parties whose personal data Customer chooses to include in Customer Content (for example, individuals named in a document, message, form response, or invoice)

Categories of Personal Data:

Category

Examples

Identity and contact data

Name, email address, username, profile photograph

Account and role data

Organization membership, role (admin / team / client), sub-role (manager / member), permissions, authentication events

Communications data

Direct messages, channel messages, comments on projects and deliverables, feedback and revision requests

Work-product data

Projects, tasks, assignments, deadlines, milestones, phases, deliverables, documents, uploaded files and their versions

Form response data

Answers submitted through Flow’s form builder, which may include contact details, business information, and uploaded files

Commercial data

Invoices Customer issues to its own clients, including amounts, line items, and payment status

Usage and technical data

Timestamps, activity and notification records, IP address and device information in server logs

Special categories of Personal Data. None. The Agreement (§5.5) and this DPA (§2.4) prohibit Customer from submitting special-category or sector-regulated data, and the Service is not designed for it.

Frequency of processing. Continuous, for the duration of the Agreement.

ANNEX II — Technical and Organizational Measures

These are the measures actually implemented as of the effective date of this DPA.

1. Access control and authentication

  • Authentication, session management, and the user directory are operated by Clerk, a specialist provider. Flow never receives or stores user passwords; passwords are stored in hashed form by Clerk.

  • Multi-factor authentication (TOTP) with recovery backup codes is available to all users and can be enabled from account settings.

  • Step-up reverification is enforced for sensitive account operations, including password change, MFA enrollment and removal, and account deletion.

  • Access to the Service is invitation-only; accounts are provisioned by Flow or by a Customer administrator. There is no public self-service registration.

  • Role-based access control within each workspace distinguishes administrators, managers, team members, and client users, with capabilities enforced per role.

2. Tenant isolation

  • Every application data row is keyed to the Customer’s organization identifier, and PostgreSQL row-level security enforces that isolation at the database, not merely in application code. A request bearing one organization’s credentials cannot read, modify, or delete another organization’s rows, including through direct API access. Real-time subscriptions inherit the same policy.

  • Unauthenticated access is denied entirely, and a session without an active organization matches no rows.

3. File storage

  • Uploaded files are stored in a private object-storage bucket. Stored objects are not publicly addressable and cannot be retrieved by URL alone.

  • File reads are served through an authenticated server-side endpoint that verifies the caller’s session, confirms the object belongs to the caller’s organization, and issues a short-lived signed URL. Bucket listing is not exposed to clients.

  • Write and delete operations are restricted to the owning organization’s object prefix.

4. Encryption

  • In transit: TLS for all connections to the application, database, storage, and API endpoints.

  • At rest: encryption at rest is provided by our hosting and database Subprocessors.

5. Application and data integrity

  • Writes to application data fail closed: a read that cannot be completed raises an error rather than returning an empty result, preventing a failed read from being mistaken for absent data and overwriting stored records. Save failures surface to the user with an explicit warning to reload before making further changes.

  • Server-side endpoints performing privileged operations verify the caller’s session and organization membership independently of the client.

6. Analytics minimization

  • Session replay is disabled. No screen recordings or reconstructions are captured.

  • The visible text of interacted elements is stripped from analytics events before transmission, so Customer Content — client names, project titles, message content, financial figures — cannot reach the analytics Subprocessor.

  • Personal-data masking is applied to automatically captured events.

  • Analytics do not run until the user has consented to analytics cookies.

7. Network and platform security

  • The application is hosted on Vercel, with platform-level DDoS protection and TLS termination.

  • Security response headers are applied to all responses, including X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and a restrictive Permissions-Policy disabling camera, microphone, and geolocation access.

  • Privileged credentials (service-role database keys, provider API keys) are held in server-side environment variables and are never exposed to the browser.

8. Organizational measures

  • Personnel with access to Customer Personal Data are bound by confidentiality obligations.

  • Access to production systems is limited to personnel who require it.

  • Customers who joined during our Beta Program are bound by a written non-disclosure agreement.

  • Changes are managed through version control with peer review before deployment to production.

9. Business continuity

  • Database backups are maintained by our database Subprocessor.

  • Customers are responsible for maintaining independent backups, as stated in Section 4.2 and in Section 11 of the Agreement.

10. Measures Flow does not currently have

Stated for transparency, so that you can assess them against your own requirements:

  • No SOC 2, ISO 27001, or equivalent third-party certification.

  • No formal penetration-testing program.

  • No contractual uptime or recovery-time commitment.

  • No customer-accessible audit log of administrative actions within a workspace.

ANNEX III — Subprocessors

The current list is maintained at [theflowtool.com/subprocessors](https://theflowtool.com/subprocessors) and is incorporated into this DPA by reference. As of the effective date:

Subprocessor

Purpose

Location

Vercel Inc.

Application hosting, CDN, serverless functions

United States

Supabase, Inc.

Database and file storage

United States

Clerk, Inc.

Authentication, session management, user directory

United States

PostHog, Inc.

Product analytics (does not receive Customer Content)

United States

Google LLC

Business email (support correspondence)

United States

Planned, not yet active: Stripe, Inc. — payment processing, on launch of paid plans.

Flow Labs LLC · 13620 Weinstein Court, Centreville, Virginia 20120 · support@theflowtool.com