Privacy Policy
Last updated: [PLACEHOLDER: Date]
1. Data Controller
WarshaFlow is operated by [PLACEHOLDER: Legal company name]. For inquiries regarding your personal data and privacy rights, contact:
Email: [PLACEHOLDER: Contact email]
Address: [PLACEHOLDER: Full business address]
For complete legal information, see our Impressum.
2. Data Collection
We collect the following categories of data:
- Account Information: Name, email address, workspace name, timezone, and currency preferences.
- Project & Client Data: Information you enter into your projects, clients, time entries, and invoices (this is your data, not ours).
- Usage Analytics: Pages visited, features used, device type, browser type, and IP address (collected for service improvement and debugging).
- Payment Information: Processed by Stripe. We do not store full payment card details.
- Cookies: Essential session cookies, authentication tokens, and optional analytics cookies. See our Cookie Policy for details.
- Communications: Support emails, feedback forms, and contact requests.
3. Purpose and Legal Basis
We process your data for the following purposes (Legal Basis under GDPR Article 6):
| Purpose | Legal Basis |
|---|---|
| Account creation and authentication | Performance of contract (Art. 6(1)(b)) |
| Providing the WarshaFlow service | Performance of contract (Art. 6(1)(b)) |
| Payment processing and billing | Performance of contract (Art. 6(1)(b)) |
| Service improvement and debugging | Legitimate interest (Art. 6(1)(f)) |
| Security and fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Customer support | Performance of contract (Art. 6(1)(b)) |
| Marketing and newsletters (if opted in) | Consent (Art. 6(1)(a)) |
4. Data Retention
We retain your data as follows:
- Account data: Retained while your account is active. After account deletion, we retain anonymized usage data for 30 days, then permanently delete all personal data.
- Project & Client data: Retained until you delete your workspace. Deleted data is removed from our production systems within 30 days.
- Payment information: Retained per Stripe's policies (typically 7 years for tax and accounting purposes).
- Analytics data: Retained for 12 months, then aggregated and anonymized.
- Support communications: Retained for 24 months after your last interaction, then deleted.
5. Third-Party Processors
We use the following service providers to operate WarshaFlow. Each processor has signed a Data Processing Agreement (DPA) and complies with GDPR/DSGVO:
| Service | Purpose | Data Transferred | Privacy Policy |
|---|---|---|---|
| Supabase (PostgreSQL + Auth) | Database hosting and user authentication | Account data, project data, workspace config | supabase.com/privacy |
| Stripe | Payment processing | Billing email, subscription info (not card details) | stripe.com/privacy |
| Vercel | Web hosting and CDN | IP address, user agent, request logs | vercel.com/privacy |
| Anthropic API | AI-powered features (if enabled) | Project/client text you submit to AI | anthropic.com/privacy |
| Upstash Redis | Session caching and rate limiting | Session tokens, IP addresses | upstash.com/privacy |
6. Your Rights (GDPR Articles 15–21 & CCPA)
If you are in the EU/EEA (GDPR):
- Right to Access: You can request a copy of all your personal data. Download your data anytime from your account settings.
- Right to Rectification: You can correct inaccurate data through your account settings or by contacting support.
- Right to Erasure ("Right to be Forgotten"): You can request deletion of your account and all associated data. We will comply within 30 days (excluding legal obligations).
- Right to Portability: You can export your data in standard formats (CSV, JSON) from your account.
- Right to Restrict Processing: You can request that we limit how we use your data.
- Right to Object: You can object to processing of your data for marketing or analytics purposes.
- Right to Withdraw Consent: For activities based on consent (e.g., newsletters), you can withdraw consent at any time.
If you are in California (CCPA):
- You have the right to know, delete, and portability of your personal information.
- You can opt-out of the sale or sharing of your personal information (we do not sell your data).
- You have the right to non-discrimination for exercising your CCPA rights.
To exercise any of these rights, contact us at [PLACEHOLDER: Contact email] with "Data Request" in the subject line.
7. Cookie Usage
We use cookies in accordance with TDDDG (Germany) and the ePrivacy Directive (EU). Essential cookies are always enabled. Analytics and non-essential cookies require your consent.
See our full Cookie Policy for details on each cookie we use.
8. Cross-Border Data Transfers
Some data processors are located outside the EU/EEA (e.g., Vercel, Stripe). We ensure adequate safeguards through:
- Standard Contractual Clauses (SCCs) signed with all processors.
- Privacy Shield certifications where applicable.
- Data Processing Agreements requiring GDPR compliance.
For details on specific transfers, contact [PLACEHOLDER: Contact email].
9. Security
We implement industry-standard security measures:
- End-to-end encryption for data in transit (TLS 1.2+).
- AES-256 encryption for data at rest in our database.
- Regular security audits and penetration testing.
- Restricted access to personal data (employees only on a need-to-know basis).
- Secure authentication (bcrypt hashing for passwords).
However, no system is completely secure. If you believe your data has been compromised, contact us immediately at [PLACEHOLDER: Contact email].
10. Contact for Data Requests
For any privacy-related inquiries, data requests, or complaints, contact:
Email: [PLACEHOLDER: Data Privacy Contact Email]
Address: [PLACEHOLDER: Legal business address]
You also have the right to lodge a complaint with your local data protection authority (e.g., the relevant Datenschutzbehörde in Germany or the ICO in the UK).
11. Changes to This Policy
We may update this Privacy Policy occasionally. We will notify you of material changes via email or a prominent notice on our website. Your continued use of WarshaFlow after changes constitutes acceptance of the updated policy.