1. Subject matter, nature and purpose of processing

The subject matter is the processing of personal data arising from your use of the platform — in particular content you place into flows, tasks and inputs, the results of execution (run outputs), files you store in the file manager or that are created there automatically from execution results, and the credentials for external services that you store in the platform. Nature and purpose follow from the use you configure: creating, storing and running flows, storing and managing files, and calling the external services you have enabled using the credentials you have stored. Credentials that you store exclusively locally in the host client on your own device are not covered by this processing; they are never transmitted to the platform.

The provider processes the data solely to deliver the contractually agreed services and on the documented instructions of the controller. The controller's configuration of the platform constitutes such an instruction. The provider will not follow instructions that infringe applicable data protection law and will inform the controller accordingly.

2. Types of data and categories of data subjects

Which types of data and categories of data subjects are processed is determined solely by the controller through the content it submits. Types of data are typically master data, contact data and content relating to persons that the controller places into its flows and tasks, the contents of the files it stores in the file manager including the associated metadata (file name, file type, size, time), and the credentials for external services it stores (e.g. API keys, tokens, user name and password) insofar as these can be attributed to a natural person. Categories of data subjects are typically the controller's employees, the users it creates within its organization, and its customers, prospects and business partners, insofar as their data is placed into flows, tasks or files. The provider does not collect this content itself and has no influence over its selection. Special categories of personal data (Art. 9 GDPR) should only be submitted by the controller where it has its own legal basis to do so.

3. Obligations of the provider (processor)

Instruction-bound processing: The provider processes the data only on documented instructions from the controller, including with regard to transfers to third countries, unless required to do so by law.

Confidentiality: The provider ensures that persons authorized to process the data are committed to confidentiality.

Security: The provider implements the technical and organizational measures required under Art. 32 GDPR (see Section 5).

Assistance: The provider assists the controller, as far as possible, in responding to requests from data subjects (Art. 12–23 GDPR) and in meeting its obligations under Art. 32–36 GDPR (security, notification of data breaches, data protection impact assessment). The provider notifies the controller of any personal data breach without undue delay.

Deletion/return: After the end of processing the provider deletes the data or returns it, at the controller's choice, unless a statutory retention obligation applies (e.g. invoice data).

Evidence and audits: The provider makes available to the controller all information necessary to demonstrate compliance with the obligations under Art. 28 GDPR and allows for — and contributes to — audits, including inspections, conducted by the controller or by another auditor mandated by the controller. Evidence is provided primarily by way of appropriate documentation (for example a description of the technical and organizational measures, and certificates and audit reports of the sub-processors used). On-site audits take place after reasonable prior notice, during normal business hours, without disproportionately disrupting operations, and while preserving confidentiality obligations and the rights of other customers; a mandated auditor must not be a competitor of the provider and must be bound to confidentiality.

4. Sub-processors

The controller grants general authorization to engage the sub-processors listed below. The provider will inform of any intended change (addition or replacement) with reasonable notice; the controller may object for compelling data-protection reasons.

Sub-processors used: Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland (hosting, managed databases, object storage, messaging/pub-sub services, key management and logging; EU region only); Scaleway SAS, 8 rue de la Ville-l’Évêque, 75008 Paris, France (email delivery/SMTP for service messages); Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, Luxembourg (email delivery/SMTP for service messages). The payment service providers Stripe Payments Europe, Limited, The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland, and PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg are not sub-processors within the meaning of this DPA: they process payment data as independent controllers in the course of billing the usage contract between the provider and the user. Payment data is not part of the processed data described in Section 1 and does not pass through this processing on the controller's behalf; details are set out in the Privacy Policy.

Not sub-processors within the meaning of this DPA are the external API/AI services you integrate yourself (e.g. OpenAI, Anthropic, Google/Gemini). These are called using your own credentials based on your own decision; in that respect you are independently responsible and conclude your own agreement with the respective provider where necessary.

The provider concludes a contract with every sub-processor that imposes on it the same data protection obligations as are set out in this DPA, in particular the obligation to provide sufficient guarantees of appropriate technical and organizational measures under Art. 32 GDPR and to process solely on documented instructions. Where a sub-processor fails to meet its data protection obligations, the provider remains liable to the controller for the performance of that sub-processor's obligations (Art. 28(4) GDPR).

5. Technical and organizational measures (Art. 32 GDPR)

The provider applies in particular: encryption of data at rest — stored credentials and the content held in the file area are additionally encrypted at application level using AES-256-GCM with per-organization keys; all other data at rest, in particular flow and task definitions as well as execution and result data held in the databases, is encrypted at storage and database infrastructure level (AES-256); encryption in transit (TLS); an access and role model with tenant separation per organization; multi-factor authentication (TOTP) and security logging; hosting exclusively in the EU region; pseudonymization where possible (e.g. hashed identifiers).

6. Place of processing and third-country transfers

Processing by the provider takes place exclusively in the EU. The provider does not process data in third countries, unless this results from the external services you integrate yourself — in which case it is your responsibility. For any US group companies of the service providers used, and for the payment service providers named in Section 4 — which act as independent controllers in that respect — the safeguards described in the Privacy Policy apply (EU-U.S. Data Privacy Framework or EU Standard Contractual Clauses).

7. Term

This DPA applies for the duration of your use of the platform as a business and ends upon termination of the underlying usage contract. Section 3 (deletion/return) survives.

8. Final provisions

In the event of conflicts between this DPA and the GTC, the provisions of this DPA prevail with regard to data processing. The law of the Federal Republic of Germany applies. Should any provision be invalid, the validity of the remaining provisions remains unaffected.