legal / privacy
Privacy Policy
This policy explains, in plain language, what personal data we collect when you use this website and join the work.flow waitlist, why we collect it, what we do with it, how long we keep it, and the rights you have over it. It is written to meet the requirements of Regulation (EU) 2016/679 (the General Data Protection Regulation, known in Poland as RODO). The short version: we collect your email address if you give it to us, we use it to send you your invite, and we collect nothing else — no cookies, no analytics, no tracking.
1. Who is responsible for your data
The controller of your personal data is Work.Flow, an exempted company incorporated in the Cayman Islands, with its registered office at c/o International Corporation Services Ltd., Harbour Place, 2nd Floor, 103 South Church Street, PO Box 472, George Town, Grand Cayman KY1-1106, Cayman Islands, company registration number [COMPANY-REG-NO] (referred to below as “work.flow”, “we”, “us”). For any matter concerning your personal data you can reach us at [PRIVACY-EMAIL]. We have not appointed a Data Protection Officer, because the scale of our processing does not require one; the contact above reaches the people directly responsible.
Work.Flow is incorporated outside the European Economic Area. Because we offer the waitlist to people in the EU, Regulation (EU) 2016/679 applies to that processing under its Article 3(2), alongside the Cayman Islands Data Protection Act (2021 Revision). Where this policy says GDPR, we mean to satisfy both regimes.
2. What this policy covers
This policy covers the work.flow website and the early-access waitlist. It does not cover the work.flow desktop application itself, for one simple reason described fully in section 6: the application runs on your computer and does not send your files or your data to us, so when you use it, we are not processing your data at all.
3. What we collect
3.1 Waitlist data (only if you sign up)
- Your email address — the only piece of personal data you give us.
- Signup metadata — the date and time you joined, your position in the queue, and your invite status (waiting, invited, joined).
- Referral association — if you share your referral link and someone joins through it, we record that association to move you up the queue, as described on the site and in our Terms.
3.2 Correspondence
If you email us, we keep the correspondence for as long as needed to handle the matter and to document that we handled it.
3.3 Technical server logs
Our hosting provider (section 7) keeps short-lived technical logs — IP address, request time, requested URL, browser user-agent — as every web host does, for security, abuse prevention and diagnostics. We do not use these logs to identify visitors and they expire automatically after a short period.
3.4 What we deliberately do not collect
- No cookies and no similar identifiers (see the Cookie Policy — the site sets none).
- No analytics, no advertising pixels, no fingerprinting, no session recording.
- No accounts, no passwords, no payment data — none exist during the beta.
- No data from the desktop app: your files, prompts and API keys stay on your machine.
4. Why we process it, and on what legal basis
- Running the waitlist and sending your invite — because you asked us to. Legal basis: your consent, Article 6(1)(a) GDPR, given when you submit the form. You can withdraw it at any time (section 9).
- Operating the referral queue — to honour the queue positions the referral program promises. Legal basis: Article 6(1)(b) GDPR (steps taken at your request prior to entering an agreement) and our legitimate interest in running the program fairly, Article 6(1)(f).
- Security, abuse prevention and diagnostics — keeping the site up and the queue honest (for example, filtering bot signups). Legal basis: our legitimate interest, Article 6(1)(f) GDPR.
- Legal obligations — where the law requires us to keep or produce records. Legal basis: Article 6(1)(c) GDPR.
We do not use your data for advertising. We do not sell it, rent it, or share it with anyone for their own marketing. We send no newsletter — the waitlist emails are the invite mechanics you signed up for, nothing else.
5. Automated decisions and profiling
We make no automated decisions about you that produce legal or similarly significant effects, and we build no profiles. Queue position is arithmetic — signup order plus referral credits — not profiling.
6. The desktop application and your data
work.flow is local-first by design. The application executes your workflows on your computer. Your files are read and written by your machine and are not uploaded to us. When a workflow uses an AI model, the application calls the provider you configured, with your own API key, directly from your machine — that traffic goes to your chosen provider under your agreement with them (or to a local model, in which case it goes nowhere at all). We operate no intermediary servers for it, which means that for data processed in the app, work.flow the company is neither a controller nor a processor — we never have the data. For business customers this also means there is ordinarily no data-processing agreement (DPA) to sign with us for the app: there is nothing we process on your behalf.
7. Who receives your data
Your waitlist data is handled by a small number of service providers acting on our documented instructions as processors under Article 28 GDPR:
- Vercel Inc. (USA) — hosts this website and receives the technical server logs described in 3.3. Transfers are safeguarded as described in section 8.
- [EMAIL-PROVIDER] — delivers the waitlist and invite emails on our behalf.
Beyond that, data may be disclosed only where the law compels it (for example to a competent authority on a lawful request), or to professional advisers bound by confidentiality, and only to the extent necessary.
8. Transfers outside the EEA
Work.Flow is established in the Cayman Islands and our hosting provider in the United States, so your data is processed outside the EEA. For EEA users these transfers are safeguarded with the mechanisms of Chapter V GDPR: the European Commission's adequacy decision for the EU–US Data Privacy Framework for certified recipients and Standard Contractual Clauses (Article 46(2)(c) GDPR) with supplementary measures where applicable. Processing in the Cayman Islands is additionally governed by the Cayman Islands Data Protection Act (2021 Revision). Copies of the relevant safeguards can be requested via [PRIVACY-EMAIL].
9. How long we keep it
- Waitlist data — until you receive access and complete onboarding, or until you withdraw, whichever comes first; in any case no longer than 12 months after the public launch, after which remaining waitlist records are deleted.
- Withdrawal — if you withdraw consent or ask to be removed, we delete your email from the waitlist without undue delay, at the latest within one month.
- Correspondence — for as long as needed to handle the matter, then up to the applicable limitation periods where a record is legally prudent.
- Server logs — retained transiently by the host and rotated automatically, typically within days.
10. Your rights under the GDPR / RODO
You have every right the GDPR grants, and we honour all of them:
- Access (Art. 15) — ask what data we hold about you and receive a copy.
- Rectification (Art. 16) — correct inaccurate data (for example, a mistyped email).
- Erasure (Art. 17) — have your data deleted (“right to be forgotten”).
- Restriction (Art. 18) — limit what we do with it while a matter is resolved.
- Portability (Art. 20) — receive your data in a structured, machine-readable format.
- Objection (Art. 21) — object to processing based on legitimate interest.
- Withdraw consent (Art. 7(3)) — at any time, with effect for the future, without affecting the lawfulness of prior processing.
You also have the right to lodge a complaint with a supervisory authority. If you are in the EU/EEA, that is your national authority — in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl). Complaints about our handling of personal data may also be made to the Office of the Ombudsman of the Cayman Islands, which supervises the Cayman Islands Data Protection Act.
11. How to exercise your rights
Email [PRIVACY-EMAIL] from the address you signed up with (that is usually all the verification needed, since it is the only data we hold). We respond within one month; if a request is unusually complex the GDPR allows an extension, and we would tell you why within that first month. Exercising your rights is free.
12. Children
The website and waitlist are not directed at children under 16, and we do not knowingly collect their data. If you believe a child has joined the waitlist, tell us and we will delete the entry.
13. Changes to this policy
If we change this policy in a way that matters — new purposes, new recipients, new retention — we will update this page, adjust the effective date above, and, where the change affects waitlist members materially, tell you by email before it takes effect. We will never quietly repurpose your email address.
14. Contact
Work.Flow, an exempted company incorporated in the Cayman Islands
c/o International Corporation Services Ltd., Harbour Place, 2nd Floor, 103 South Church Street, PO Box 472, George Town, Grand Cayman KY1-1106, Cayman Islands
Privacy: [PRIVACY-EMAIL] · General: [CONTACT-EMAIL]
Full registration details are on the company details page.