Data Processing Terms

For account administration, security, abuse prevention, product operation, and direct communications, NoriaFlow's individual publisher acts as data controller as described in the Privacy Policy. For personal data that you choose to place in a workflow and that NoriaFlow processes only to execute your instructions, you are normally the controller and the publisher acts as processor. Legal roles depend on the facts and cannot be changed by a label alone.

Your configuration, activation, API requests, and documented support requests are the instructions for processing workflow data. Processing covers receiving, hosting, transforming, transmitting, temporarily logging, and deleting data as necessary to run the workflow. NoriaFlow will not use that data for an unrelated purpose unless required by law, in which case you will be informed where the law permits.

• Subject matter: hosting and executing the visual automations configured by the user.
• Duration: for the lifetime of the account or workflow and the limited retention periods in the Privacy Policy.
• Nature: receiving, organizing, reading, transforming, transmitting, logging, securing, exporting, and deleting data.
• Purpose: performing triggers and actions selected by the user, plus related debugging, reliability, and security.
• Data subjects: the user's members, viewers, staff, customers, contacts, message recipients, and other people whose data enters a workflow.
• Data types: identifiers, account/profile data, messages and content, event metadata, timestamps, provider resource IDs, and other fields deliberately mapped by the user.

• have a lawful basis and provide required privacy information;
• collect only data necessary for a defined purpose;
• configure recipients, retention, permissions, and safeguards correctly;
• respond to data-subject requests and notify NoriaFlow when assistance is needed;
• avoid high-risk processing until a suitable assessment and written arrangement exist.

Access to workflow data is limited to persons and providers who need it to operate, secure, support, or legally protect the Service and who are subject to confidentiality obligations. Current measures include encrypted transport, encrypted OAuth tokens, access controls, rate limiting, secret redaction, logging controls, backups, and incident monitoring. Security is risk-based and no online service can promise absolute security.

The current categories and named providers are listed in the Privacy Policy. They may process only what is necessary for hosting, databases, communications, monitoring, payments if later activated, or actions you direct through integrations. Reasonable notice will be given before adding a sub-processor that materially changes processing, where possible. Applicable transfer safeguards are used for processing outside the EEA.

Taking into account the beta's nature and available information, NoriaFlow will provide reasonable assistance with data-subject requests, security obligations, impact assessments, and regulator enquiries. If a confirmed personal-data breach affects data processed on your behalf, you will be informed without undue delay after NoriaFlow becomes aware, with information reasonably available at that time.

You can export workflows and delete the account using product controls. Workflow data is deleted according to the Privacy Policy, except for narrowly scoped information retained because of a legal obligation, security incident, dispute, or documented legal hold. Residual encrypted backups age out through their normal rotation and are not restored for ordinary product use.

We will provide information reasonably necessary to demonstrate these commitments and cooperate with proportionate reviews. Because this is a free beta run by one individual, intrusive audits require advance agreement and must not expose other users' data, security controls, or confidential information. Contact contact@noriaflow.com.