Privacy Policy

AUTOMATIONFLOWLAB (PTY) LTD, company registration number 2026/796103/07, South Africa, is responsible for personal information used to manage its own website, accounts, enquiries and business operations.

Send privacy requests to Automationflowlab.info@proton.me, marked “Privacy request”.

For customer-controlled records processed through a workspace, integration or professional-service engagement, the customer ordinarily determines the purpose and means of processing and acts as the responsible party or controller.

We act as its operator or processor where we process those records on its documented instructions. Our role depends on the actual activity. A separate Data Processing Agreement governs customer-directed processing where required.

Depending on the features and services you use, we process contact and account information such as your name, email address, organisation, role and account identifiers; enquiries, support correspondence and feedback; and technical information such as IP address, device and browser details, timestamps, errors and security events.

For professional services, we may also process service enquiries, proposals, contracts, project requirements and correspondence, authorised client-system access information, test data, deliverables, acceptance records, support and retainer records, and invoicing or payment-status records where relevant to the engagement.

Although app checkout is inactive, separately agreed professional work may still generate invoicing and payment records.

Submit credentials only through an agreed appropriate channel, not ordinary enquiry forms or emails.

Tools may process uploaded spreadsheets, documents, business records, workflow instructions, approval records, generated reports and related metadata.

Integrations may process identifiers, connection permissions and access tokens needed for authorised operations, together with selected records from connected systems.

We may obtain information from you, your organisation’s authorised administrators and providers you connect.

Required fields should be identified when collected. Without essential information we may be unable to provide the requested account, support, tool or professional service. Optional information is voluntary.

Do not submit special personal information, children’s data or highly sensitive records unless the relevant feature or professional-service agreement and written safeguards expressly permit it.

In-app payments are inactive, so the free app does not require card details.

We use information to provide requested features, manage accounts and permissions, respond to enquiries, troubleshoot problems, protect the service, maintain necessary records and meet legal obligations.

For professional services, we also use necessary information to prepare proposals, agree scope, deliver and support projects, manage client approvals, administer agreed retainers and maintain contractual and invoicing records.

Customer-directed records are processed for the customer’s authorised purposes.

Depending on the activity and applicable law, processing is based on performance of an agreement, legal obligations, appropriately assessed legitimate interests or consent.

Consent is obtained separately where required, including for optional tracking and marketing. You may withdraw consent without affecting lawful processing already undertaken. We do not treat account creation or a service enquiry as permission for unrelated promotional messages.

We send necessary operational messages about accounts, security, projects and requested services.

Promotional electronic messages are sent only where legally permitted, including required consent or a qualifying existing-customer exception. Promotional messages provide an unsubscribe option.

We do not sell personal information.

We disclose necessary information to providers supporting hosting, storage, authentication, email delivery, technical support and security, and to integration or AI providers where the relevant feature or agreed service requires them.

Provider access must be limited to the applicable purpose and protected by appropriate contractual arrangements.

Workspace administrators and authorised members may access records according to their permissions. Personnel authorised to deliver professional services may access necessary project information within the agreed scope.

We may disclose information to professional advisers or authorities where reasonably necessary and legally justified. If a business restructuring affects information, applicable safeguards and notice requirements will apply.

The named providers, their purposes and processing locations must be available in the service’s current provider register before affected processing begins.

Optional AI processing must identify the provider and data sent before use. We do not use confidential customer content for general-purpose model training without a separate lawful basis and explicit agreement.

AutomationFlowLab operates from South Africa. Providers or integrations may process information in other countries.

We must identify relevant destinations and recipients before transfers and use a lawful transfer mechanism, including the safeguards required by POPIA section 72.

Where other privacy laws apply, their transfer requirements also apply. For example, applicable European transfers may require an adequacy decision, standard contractual clauses or another permitted mechanism.

Global availability alone does not mean every country’s law applies to every activity. Contact us for information about safeguards relevant to your records.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, applicable legal obligations, justified security needs or the establishment, exercise or defence of legal claims.

Account records are retained while needed to manage the relationship. Customer files and job records follow the applicable tool and processing agreement. Support and security records are retained according to their purpose.

Professional-service proposals, contracts, project records, deliverables and invoicing records are retained according to the relevant engagement, legal recordkeeping requirements and justified claim or dispute needs.

Client-system access must be withdrawn when no longer authorised or necessary.

Deletion requests are subject to identity and authority checks and lawful retention exceptions. We explain relevant exceptions where permitted.

Deleted information may remain temporarily in restricted backups until the normal backup cycle removes it. If a backup is restored, applicable deletion instructions must be reapplied.

Specific operational retention periods must be documented for each data category and communicated where required.

We are required to apply appropriate and reasonable organisational and technical safeguards. No system can guarantee absolute security.

Do not send passwords, access tokens or unredacted confidential records in an ordinary email.

Suspected compromises will be investigated and notified to affected parties and authorities where required by applicable law. Customer-directed incidents will also be handled under the applicable processing agreement.

Depending on applicable law, you may request confirmation of processing, access, correction, deletion, restriction, objection or a portable copy of relevant information.

You may withdraw consent and object to direct marketing. Rights are subject to legal conditions and exceptions.

Email us with the request and sufficient information to locate the record. We may verify identity proportionately. Please do not send an identity document unless specifically requested through an appropriate channel.

We respond within applicable legal deadlines and explain any lawful refusal or extension.

Where we process records for a customer, we may refer your request to that customer and assist it as required.

You may complain to South Africa’s Information Regulator at https://inforegulator.org.za, or an applicable authority in your jurisdiction. You do not have to contact us first to exercise that right.

PAIA access requests follow the Legal and Safety page and the company’s completed PAIA Manual.

The website, app and services are intended for adult and business users and are not directed at children under 18.

Do not upload children’s personal information through ordinary tools.

Any specially agreed processing involving children must first establish lawful authority and appropriate safeguards. Contact us if you believe a child’s information has been submitted improperly.

The Cookie Policy explains cookies and browser storage. Optional analytics or marketing tracking requires the choices described there.

Where enabled or agreed within a professional-service engagement, AI or automated tools may analyse inputs and suggest outputs.

Review results before acting and do not rely solely on automated output for decisions with legal or similarly significant effects without the required lawful safeguards.

We will identify material new processing before it begins and update this policy with its publication date and version. Where required, we will provide additional notice and obtain consent.

Privacy commitments apply to the actual service configuration. A policy update cannot replace necessary technical or contractual safeguards.