FlowKeyOps Privacy Policy

FlowKeyOps LLC

This Policy explains how FlowKeyOps LLC handles personal information through its website, accounts, subscriptions, support, and SaaS control plane. FlowKeyOps enhances customer-hosted n8n. The information we receive depends on the features and connections you enable and may include workflow definitions, configuration information, and secrets submitted through designated features.

1 Scope and our role

FlowKeyOps LLC is an Ohio limited liability company. For website visitors, account contacts, billing contacts, and support correspondents, we determine the purposes and means of processing the personal information described here. This is often called acting as a controller or business under privacy law.

When an organization submits or authorizes retrieval of personal information within workflows, repositories, configurations, or other Customer Content, we process that information to provide the service on the organization’s instructions. In that context, the organization ordinarily acts as the controller and FlowKeyOps acts as its processor or service provider, as applicable. A data processing agreement may be required for that relationship.

This Policy does not govern the organization’s own use of n8n or the privacy practices of a connected third party. If your information is in a customer’s workflow or environment, contact that organization first. We will assist it with applicable requests as required by law and our agreement.

2 Information you provide

Account and organization information includes names, business email addresses, organization names, user roles, account identifiers, and account settings. Authentication information is processed as needed for sign-in and account security.

Billing information includes billing contact details and addresses, selected plans, order and subscription references, transaction amounts, tax information, renewal status, and payment or dispute records. A billing address collected for payments or taxes is different from an address advertised as our public contact channel.

Support and communications include messages, tickets, attachments, feedback, and preferences. You may choose what to include. Avoid sending plaintext secrets, payment-card details, or unrelated personal information in support requests.

Customer Content includes materials you submit or authorize us to retrieve through enabled features. This can include workflow definitions and versions, repository content, environment names and endpoints, configuration and mapping data, credential metadata, secrets placed in designated features, and approval or audit records. Names, identifiers, email addresses, URLs, comments, and embedded values in those materials can be personal information.

3 Information collected through service use

We receive technical information needed to operate and protect the service, such as IP addresses, device and browser details, timestamps, request information, session activity, errors, and security events. Account activity can include sign-ins, feature use, actions requested, changes made, and identities associated with approvals and audit records.

Enabled agents and connectors communicate with the FlowKeyOps service and provide the information needed for the capabilities you use. We do not provide hosting of your n8n runtime. Connecting it does not mean all of its runtime data is collected. The scope depends on enabled features, permissions, and the data actually transmitted.

Workflow definitions can themselves contain personal information or hardcoded values. Logs, error reports, and support attachments can also contain information from your environment. Review what you submit and the permissions you grant. Do not assume the absence of runtime hosting means that no personal information can reach FlowKeyOps.

We may receive payment confirmation and fraud-related information from Stripe, subscription information from our checkout system, and information from an authorized administrator or integrated service. We use it for the purposes described below.

4 How we use information

We use personal information to create and administer accounts, authenticate users, deliver purchased features, carry out authorized actions, and maintain subscription entitlements. We also use it to process and reconcile payments, determine applicable transaction taxes, communicate about accounts and renewals, and resolve billing questions.

We use support information to investigate issues and respond to requests. Technical and audit information helps diagnose errors, protect accounts, detect misuse, maintain records of authorized actions, and improve service reliability. We also process information to meet legal duties, defend claims, and enforce valid agreements.

We use contact details for optional marketing only where permitted by law and, where required, with consent. You can unsubscribe from marketing messages using their instructions or by contacting us. Account, security, billing, and legal notices may continue because they are necessary for the service.

We do not use Customer Content to train a general-purpose AI model without your separate express authorization. Any optional AI feature that sends Customer Content to an external provider must be identified with its relevant data practices before you enable it. This Policy does not authorize undisclosed AI processing.

Where a legal basis is required, we rely on performance of a contract for information needed to provide an individual’s requested service; legitimate interests in business administration, security, and service operation where those interests are not overridden by individual rights; legal obligations for required records; and consent where required for optional activities. Processing of Customer Content follows the customer’s lawful instructions and any applicable data processing agreement.

5 Payments bookkeeping and service providers

Stripe processes payments. It receives payment details through the payment interface and may process information for its own purposes, including fraud prevention and legal compliance, as described at https://stripe.com/privacy. We receive transaction information and payment-method references needed for subscriptions and reconciliation. Our intended payment integration does not store full payment-card numbers or card security codes in FlowKeyOps application records.

Our website and subscription stack uses WordPress, WooCommerce, and YITH subscription software. Support and customer communications may use Fluent software. These are software products, and their developers do not necessarily receive your information merely because their software is installed. Our actual hosting and enabled integrations determine where the data is processed.

DigitalOcean provides relevant cloud infrastructure, and Cloudflare provides relevant network delivery and security services. Other enabled hosting, storage, email delivery, monitoring, support, or backup providers may process the information needed for their functions. Additional providers actually used are listed here: Rocket.net (managed WordPress hosting for flowkeyops.com: accounts, orders, billing contacts, support tickets and accepted agreements, United States); Stripe, Inc. (card payments and payment records; card data never reaches FlowKeyOps infrastructure); Google LLC (Google Workspace, which sends our transactional and support email, and Google reCAPTCHA, which protects sign-in and account forms against abuse); and AutoEnvo LLC, a FlowKeyOps affiliate (hosts our source code and the registry that serves the agent image, and receives the IP address of a host that downloads it; no workspace content); and Google LLC for Google Analytics 4, which receives website usage information only from visitors who accept analytics cookies.

For bookkeeping, QuickBooks Online may receive order, payment, customer, and tax information. Where enabled, MyWorks synchronizes relevant WooCommerce and Stripe-related transaction information with QuickBooks. Our accountant or tax adviser may access necessary financial records under appropriate confidentiality obligations. Where enabled, sales-tax services receive the location and transaction information needed for tax calculations, registration support, or filings. These recipients do not need access to workflow content or secrets for routine bookkeeping.

We give service providers information needed for their functions and require appropriate contractual protections where applicable. Some recipients, including payment providers and professional advisers, may also have independent legal duties or act as separate controllers for parts of their work.

6 Other disclosures and advertising practices

We disclose information to your organization’s authorized administrators and users according to account permissions, and to connected services as directed by the configurations and actions you authorize. Account administrators may have access to account activity and Customer Content within their roles.

We may disclose information when lawfully required, to respond to valid legal process, or when reasonably necessary to protect rights, prevent fraud, or address a security threat. We may transfer information as part of a merger, acquisition, financing, or sale of relevant business assets, subject to applicable law and appropriate protections. We may also disclose information at your direction or with valid consent.

Sale and advertising sharing statement: FlowKeyOps does not sell personal information and does not share it for cross-context behavioral advertising, so no opt-out is needed.

We do not disclose Customer Content for another business’s independent marketing purposes without your authorization. This restriction does not prevent an authorized operational disclosure described in this Policy or a legally required disclosure.

7 Cookies and tracking choices

Our website uses cookies or similar technologies necessary for functions such as sign-in, account security, checkout, shopping-cart state, and preferences. Payment and security providers may use their own technologies as part of the features you use.

Optional analytics and advertising technologies actually enabled: Google Analytics 4, provided by Google LLC, which measures how visitors use our public website (pages viewed, referring sites, approximate location, device and browser type). It runs only on public pages, never on account or control-panel pages, and only after you accept analytics cookies. It sets the cookies _ga and _ga_ followed by an identifier, which expire after up to 2 years. Advertising features, Google signals and ad personalisation are switched off. Cookie preference controls, where applicable: every visitor is asked before analytics cookies are used, with equal choices to accept or reject. Use the Cookie settings link in the footer of our pages, including this Privacy Policy, to change your choice at any time; rejecting deletes the analytics cookies already set. Your choice is stored in a cookie named fko_consent for 12 months. Necessary technologies also include sign-in, cart and checkout cookies, security cookies set by our firewall, Google reCAPTCHA on sign-in and account forms, and Cloudflare’s bot-protection cookie, which expires after 30 minutes. We will obtain consent before optional technologies where required by law and honor applicable opt-out rights.

You can use browser settings to restrict or delete cookies, although necessary account or checkout functions may stop working. Browser Do Not Track signals are not treated as a universal consent instruction. Legally recognized opt-out signals, including Global Privacy Control where applicable, must be handled for covered processing. Current implementation and instructions: we treat a Global Privacy Control signal as a valid request to opt out of the sale and sharing of personal information, and also as a rejection of analytics cookies: when your browser sends it, Google Analytics does not load and no banner is shown. FlowKeyOps does not sell or share personal information.

Email communications may use delivery or engagement information only as actually enabled and permitted. Current use of email open or click tracking: marketing emails sent through our email marketing tool may record whether they are opened and which links are clicked; account, billing and security emails are not tracked. You can stop marketing emails at any time with the unsubscribe link in each one. Blocking optional tracking does not prevent you from sending a privacy request.

8 Retention account closure and deletion

We keep personal information for as long as reasonably necessary for the purposes described here, considering the active subscription, the type of information, security and dispute needs, contractual requirements, and legal retention obligations. We do not promise that all records are deleted as soon as a subscription is canceled.

Ordinary cancellation preserves paid access through the end of the paid billing cycle. Before that date, use available exports to retrieve information you need. Account or workspace deletion is a separate request and can end access earlier if you expressly request immediate deletion after notice of that consequence.

The operational retention schedule is: the workspace database, Git repository and credential vault are deleted within 7 days after paid access ends. Before removal, FlowKeyOps takes a final encrypted backup, keeps it for 30 days so the workspace can be restored on request, and then deletes it. Security and audit logs: workspace audit history is kept for at least the retention period of the plan (30 days on Free, 90 days on Individual, 365 days on Team, 730 days on Enterprise, or as stated in a Custom contract), and security and access events for at least 365 days on every plan. Billing, tax, and legal records: billing, tax and accounting records are kept for 7 years after the transaction, and signed agreements for 7 years after they end.

Backup or archive copies may remain until their scheduled expiry, with access restricted and use limited to permitted recovery, security, or legal purposes. If a backup is restored, applicable deletion requests must be reapplied. Legal holds can delay deletion of affected records. Retention of financial records does not justify retaining workflow content or secrets that are no longer needed.

We will assess a valid deletion request under applicable law and any data processing agreement, explain exceptions where appropriate, and take steps to delete or deidentify information no longer needed. This Policy does not promise recovery of information already deleted or a post-expiry customer export window.

9 Security and incident communications

We use safeguards appropriate to the nature of the information and the risks of processing. These include access restrictions and measures intended to protect information during transmission and storage. The specific controls depend on the system and information involved. We limit access to Customer Content to operational need, authorized support, your instructions, and legal requirements.

No system is completely secure. You also have a role in security: protect account and recovery credentials, limit integration permissions, keep your n8n environment secure, and avoid placing secrets in files or messages not designed for them. We do not claim that staff or infrastructure access to every stored item is technically impossible.

If a security incident triggers a notification duty, we will notify affected customers, individuals, or authorities as required by applicable law and any binding data processing agreement. This Policy does not replace incident-notification obligations owed to a customer under such an agreement.

10 Your rights and choices

Depending on applicable law, you may have rights to request access, correction, deletion, a copy or portability of information, restriction of processing, or an objection to certain processing. You may also have rights to withdraw consent, opt out of covered sales, sharing, targeted advertising, or certain profiling, appeal a denied request, and complain to a supervisory authority. The availability of each right depends on your location and the circumstances.

Submit a request to legal [at] flowkeyops.com or use the Support page in your FlowKeyOps control panel. Describe your request and account relationship without sending passwords, full payment-card details, or secrets. We may request proportionate verification of identity or an authorized agent’s authority before disclosing or deleting information. We will respond within applicable legal deadlines and explain a denial or extension where required.

To appeal a privacy decision where a right to appeal applies, use the same channel and identify the decision you wish to appeal. We will not discriminate or retaliate against you for exercising a legally protected privacy right. Some information is needed to provide the service, so deletion or restriction can affect functionality; we will explain relevant consequences.

An organization may administer its own account data. If a request concerns Customer Content processed for that organization, we may direct you to it and assist with the request under our agreement. Withdrawing consent does not undo processing that was lawful before withdrawal. Marketing withdrawal does not end necessary service notices.

11 International processing

FlowKeyOps operates from the United States. Information may be processed in the United States and in other locations used by our actual providers. A selected infrastructure region does not by itself guarantee that website, billing, support, or security information remains in that region.

Where a restricted international transfer requires safeguards, the required lawful mechanism and contractual protections must be in place, such as applicable standard contractual clauses or another valid mechanism. We do not claim membership in a privacy certification framework solely because a vendor participates in it. Contact us for information about safeguards relevant to your data.

12 Children and links to other services

FlowKeyOps is intended for adults using it for business purposes and is not directed to children under 18. We do not knowingly collect children’s information through direct registration. Do not intentionally submit children’s personal information in Customer Content unless you have a lawful basis and we have expressly agreed to any required protections. If you believe a child has provided information improperly, contact the privacy channel so we can investigate and take appropriate action.

Links and connected third-party services have their own policies. Review them before providing information. Their policies do not reduce FlowKeyOps’s obligations for information we process.

13 Policy updates and contact

We may update this Policy as our service or legal obligations change. We will post the revised Policy with its effective date and give additional notice or obtain consent when required for a material change. We will not retroactively expand a consent-dependent use without the required consent.

Privacy contact for FlowKeyOps LLC: legal [at] flowkeyops.com, or the Support page in your FlowKeyOps control panel where a form is offered. General support and billing: support [at] flowkeyops.com. These are online contact channels; no phone call is required to request help or exercise privacy rights.