Privacy Policy

Welcome to OnFlow (www.onflowapp.com and app.onflowapp.com). This website and the OnFlow product are operated by Aaptera Ltd, trading as OnFlow ("we", "us", or "our").

This policy explains what personal data we collect, how we use it, our lawful basis for processing, who we share it with, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It covers people who browse this website or use our contact form, and customers and users of the OnFlow app, for the personal data we control about them.

Data that you or your organisation store inside OnFlow ("Customer Content") is processed by us on your organisation's instructions under our Data Processing Agreement. Your organisation is the controller of that data. This policy does not by itself make you or your organisation compliant with the UK GDPR, the EU GDPR, or any other law. You remain responsible for your own compliance.

For the personal data described in this policy, the controller is:

If you have a concern, please contact us first at [email protected]. We will respond within one month. You can also complain to the Information Commissioner's Office (ICO), the UK supervisory authority (www.ico.org.uk). If you are in the EEA, you may complain to your local supervisory authority.

Information you give us

When you use our contact form you may give us your name, work email, company, team size, the reason for your enquiry, and your message. There is no phone number field. Providing contact-form data is voluntary.

This form is itself an OnFlow record type — submissions route straight into our own workspace. Our automations process those submissions, including an AI step that reviews the enquiry (for example to flag possible spam), may change its status, and may add an internal comment explaining that review. The AI step uses Google Vertex AI in the global location and may be processed outside the United Kingdom and the European Union. We do not use contact-form content to train models.

Information we collect automatically

If you consent to analytics cookies, Google Analytics collects technical data (such as IP address, browser type and version, time zone setting, and operating system) and usage data (such as pages viewed and time on the site). Google acts as our processor for this analytics data under the Google Analytics data processing terms, which we have accepted. Analytics data is often aggregated.

Cloudflare delivers the website and the app. Cloudflare processes connection data, such as IP address, as our processor to provide content delivery, DDoS protection, and TLS termination.

When you sign up for or use OnFlow, we are the controller of:

• account information (name, work email, and sign-in details, including Google sign-in where you use it);
• billing information handled by Stripe (we do not store full card numbers);
• security and usage logs (IP address, device, sign-in times, and actions taken);
• AI usage metering; and
• support correspondence and service emails.

We use this data:

• to provide and secure your account (contract);
• to bill you and keep tax and invoice records (contract and legal obligation — we keep invoices for 6 years);
• to send service emails (contract);
• to prevent abuse and secure the service (legitimate interests); and
• to improve the product using aggregated usage information that does not identify you (legitimate interests).

Account and billing data is needed to provide the service under our contract with you. We do not make decisions about you based solely on automated processing that has legal or similarly significant effects. AI features in the app act on your organisation's instructions or, for our own contact-form workspace, as described in section 3.

Customer Content (records, files, prompts, and similar material your organisation stores) is processed by us as processor under the Data Processing Agreement. Contact your organisation about that data.

In-app AI (chat, agent and MCP actions, and daily briefings) and the generation of search embeddings use Google Vertex AI in the global location. Google may process that data outside the United Kingdom and the European Union.

Core application hosting, and storage of records and files, is in the United Kingdom (Google Cloud region europe-west2). Embedding vectors are stored with the service in the United Kingdom after they are generated.

Neither OnFlow nor Google Vertex trains or fine-tunes models on Customer Content, prompts, or contact-form content.

Processing of AI and embeddings in the UK or the EU is available on Enterprise plans by agreement. Contact [email protected].

We use personal data only when the law allows us to.

To respond to enquiries

We use contact-form data to respond to you and to run the automations described in section 3.

Lawful basis: Legitimate interests — responding to direct enquiries and running our business.

To understand website use

We use Google Analytics, where you have consented, to understand how visitors use the site and to improve it.

Lawful basis: Consent, given via our cookie banner. You can withdraw consent at any time via Cookie preferences in the site footer. Withdrawal does not affect processing that took place before withdrawal.

We also use personal data to provide the OnFlow service, bill you, keep the service secure, and send service email, as described in section 4.

We do not sell your personal data.

We do not knowingly collect data from children. This website is not intended for anyone under 13. OnFlow is a business service and is not intended for anyone under 18.

We share personal data with these processors, only as needed to run the website and the service:

• Google (Google Analytics): website analytics, as our processor under the Google Analytics data processing terms, which we have accepted.
• Cloudflare, Inc.: content delivery, DDoS protection, and TLS termination for onflowapp.com and app.onflowapp.com.
• Google Cloud, including Vertex AI / Gemini: application hosting, storage, backups, and the AI and embedding processing described above.
• Stripe: payments, invoicing, and tax calculation. We do not store full card numbers.
• Resend: transactional email, including signup, verification, and notifications.

The current list for Customer Content is in Annex III of the Data Processing Agreement. We notify account owners of subprocessor changes as that agreement describes (at least 10 business days beforehand), by email to the account owner and by updating the DPA page.

Our company is in the United Kingdom, and core hosting of records and files is in the United Kingdom (europe-west2). Some processors are outside the United Kingdom. AI and embedding requests sent to Google Vertex AI in the global location may be processed outside the United Kingdom and the European Union.

Where we transfer personal data internationally, we use safeguards recognised under UK GDPR. Those safeguards include the EU Standard Contractual Clauses, as amended for the United Kingdom by the UK Addendum, and the SCCs for transfers from the EEA. Google Analytics transfers are covered by the Google Analytics data processing terms we have accepted. Google Cloud processing, including Vertex AI, is covered by Google's Cloud Data Processing Addendum.

We keep personal data only for as long as we need it for the purposes above, or for as long as the law requires.

• Contact form data: for as long as we need to handle the enquiry, typically up to 24 months after our last communication, unless a customer relationship is formed.
• Analytics data: according to our Google Analytics settings, typically 14 to 26 months, after which it is deleted.
• Account data: for the life of the account, and then deleted from production systems within 30 days of closure, subject to the backup period below, unless the law requires us to keep it longer.
• Invoices and billing records: 6 years.
• Backups: 7 days. Longer backup retention is available on Enterprise plans by agreement.
• Customer Content: as set out in the Data Processing Agreement. After the agreement ends, the customer may export Customer Content for 30 days. We then delete it from production within 30 days, and from backups as those backups expire.

We use cookies to remember your cookie choice and, with your consent, to measure the site.

• cookie_consent (OnFlow): stores whether you accepted or rejected non-essential cookies. Duration: 1 year. This cookie is strictly necessary to remember that choice.
• _ga (Google): distinguishes visitors for Google Analytics. Duration: 2 years. Set only with consent.
• _ga_2LNPEQXSW6 (Google): stores session state for Google Analytics property G-2LNPEQXSW6. Duration: 2 years. Set only with consent.

Analytics cookies are non-essential. We ask for consent in the cookie banner before Google Analytics is loaded. You can withdraw consent via Cookie preferences in the footer. You can also block cookies in your browser.

We protect personal data with access controls and authentication, encryption in transit (TLS), encryption at rest where our infrastructure provides it, logging, and least-privilege access for staff. Further detail is in Annex II of the Data Processing Agreement.

We do not currently hold third-party certifications (for example SOC 2 or ISO 27001).

Under UK data protection law you have the right to:

• Access a copy of the personal data we hold about you.
• Rectification of inaccurate personal data.
• Erasure.
• Restriction of processing.
• Object to processing where we rely on legitimate interests.
• Data portability, where processing is based on contract or consent.
• Withdraw consent at any time, without affecting processing before withdrawal.

To exercise these rights, email the privacy contact at [email protected]. We will respond within one month. You can also complain to the ICO (www.ico.org.uk).

We may update this policy. The version and last updated date at the top of this page will change. If we make a material change to how we use customer or user personal data, we will notify account owners by email or in the app at least 14 days before the change takes effect.