01What this covers
This addendum (DPA) is part of the agreement between Opscend LLC (Opscend, we, us) and the customer who uses OpFlow (you), made up of the Terms of Service. It applies when we process personal data in your workspace on your behalf. That means data about your own customers, contacts and staff that your bots, agents and connected apps move through OpFlow.
For this data, you are the controller (or the processor, if you act for someone else) and we are your processor (or sub-processor). For your own account and billing details, we are a controller and the Privacy Policy applies instead.
It covers all workspaces you own, from the day you accept the Terms. No separate signature is needed. If you want a countersigned copy, ask for one (see the end of this page).
02What we process
Subject matterRunning your bots, agents and connected apps on OpFlow, and keeping their history.
DurationWhile your account is open, then up to 30 days to return or delete it (section 9).
Nature and purposeStoring, transmitting, reading and writing data in the apps you connect, at your direction, so your bots run. Showing you run history.
Types of personal dataWhatever your bots handle. Typically names, email addresses, phone numbers, messages, appointment and order details. You decide what goes in.
People it is aboutYour customers, leads, contacts, employees and anyone else whose data your bots touch.
Special categoriesOpFlow is not built for sensitive data such as health records or payment card numbers. Do not send them through a bot unless you have talked to us first.
03What we promise
- We process personal data only on your documented instructions. Your use of OpFlow, your bots, and your settings are your instructions. We tell you if an instruction breaks the law, as far as we can see.
- Everyone at Opscend who can reach your data is bound to keep it confidential, and only the people who need it can reach it.
- We do not sell your data, share it for advertising, or combine it with data from other customers.
- We do not use your workspace content to train AI models. Our AI providers act on our instructions under their business terms.
- We keep a record of our processing and make it available to you on request, so you can show a regulator.
04How we protect it
- Encryption in transit between you, OpFlow and the apps you connect (TLS).
- Credentials for connected apps are encrypted at rest with AES-256-GCM, with the key held outside the database.
- Workspaces are separated by row-level security in the database, so one workspace cannot read another's.
- Roles inside a workspace (Owner, Admin, Builder, Viewer) limit who can build, connect apps, invite people and see billing.
- An audit trail of changes to people, bots, connections and tokens, which Owners and Admins can read and export.
- Access inside Opscend is limited to the people who need it, and administrative actions are logged.
- Backups and provider-level protections from the services listed in section 5.
We do not hold a SOC 2 report. We have not started an audit. We will tell you when we do. If a measure you need is not above, ask before you buy and we will say whether we can meet it.
05Who helps us (sub-processors)
You agree that we may use these sub-processors. Each is bound by terms that protect your data to the same standard as this addendum, and we stay responsible for them.
SupabaseDatabase, sign-in and file storage. United States (us-west-1).
CloudflareHosting, edge network and the run engine. Global edge.
StripePayments, subscriptions and invoices. United States. Holds card details; we do not.
AnthropicAI model provider for the assistant, the agent builder and AI steps that use OpFlow's model access. United States.
Lovable AI gatewayRoutes AI requests to model providers when an AI step uses the built-in model.
Google WorkspaceSends OpFlow's own email to you, such as invitations and plan notices. United States.
The apps you connect (Gmail, Notion, Podio and the rest) and any AI provider whose key you give an AI step are your own choices. They are not our sub-processors.
We email you at least 30 days before we add or replace a sub-processor. If you object on reasonable data protection grounds in that time, tell us. We will work with you, and if we cannot, you may end the affected service and we refund the unused part of your prepaid period.
06Helping you with requests
If someone asks us about their data in your workspace, we pass the request to you and do not answer it ourselves, unless the law requires us to. Most of what you need is in the app: you can find, export and delete run history, and remove a connection. We help with the rest, including your data protection impact assessments, as far as the information is ours to give.
07If something goes wrong
If we learn that personal data in your workspace has been lost, taken or seen by someone who should not have it, we tell you without undue delay and no later than 72 hours after we become aware. We tell you what happened, what data is involved, what we are doing, and what you may need to do. We take the steps needed to contain it.
08Data that leaves your country
OpFlow is run from the United States and your data is processed there. Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to us, the Standard Contractual Clauses (Module 2, controller to processor, and Module 3 where you are a processor) are part of this addendum. The UK Addendum and the Swiss amendments apply for those regions. In the clauses: the docking clause is not used, the option for general authorization of sub-processors is chosen with 30 days' notice, the governing law and courts are those of Ireland, and the annexes are sections 2, 4 and 5 of this page.
09When you leave
When your account closes, or you ask, we return your data in a standard format or delete it, within 30 days. Backups age out on the providers' schedule. We keep what the law makes us keep, such as billing records, and say so if you ask. You can also delete your own data in the app at any time.
10Checking our work
We answer security and data protection questions in writing, and give you the information you reasonably need to check that we meet this addendum. If that is not enough, or a regulator requires it, you may audit us once a year with 30 days' notice, during business hours, at your cost, under confidentiality, and without reaching other customers' data.
11US state privacy laws
For California and other US states, we are your service provider (or processor). We process personal information only for the business purposes in this addendum and the Terms. We do not sell it or share it for cross-context behavioral advertising, we do not keep, use or disclose it outside our direct relationship with you, and we do not combine it with other data. We tell you if we can no longer meet these duties, and you may take reasonable steps to stop and fix any unauthorized use.
12How this fits with the rest
This addendum is subject to the Terms of Service, including their limits on liability. If this addendum and the Terms disagree about personal data, this addendum wins. If the Standard Contractual Clauses disagree with this addendum, the clauses win. We may update this addendum when the law or our services change. We email you before a change that matters takes effect.
13Get a signed copy
This page is the addendum and it applies as it stands. If your company needs a countersigned PDF, or a security questionnaire answered, write to [email protected] with your company name and who should sign. We send it the same working day. Questions about how we handle data: [email protected].