Privacy Policy — Agentic Workflow (AWFlow)

The data controller for personal data processed by the Service is:

Dannick Kwengang (operating Agentic Workflow / AWFlow)
Mennonitenstraße 20
67657 Kaiserslautern
Germany
Email: hello@awflow.io

Your privacy is important. The Service is designed to run workflows locally in your browser. This means many operations occur entirely on your device without transmission to our servers. You can use the Service without an account ("local mode"). We receive anonymous usage statistics and error reports only if you allow them (see 3.3). Other data reaches us only when you choose optional features such as an awflow account with cloud sync (see 3.6), the newsletter, or the workflow Marketplace.

We do not sell personal data.

3.1 Data you provide voluntarily

Depending on your use of the Service, you may provide personal data such as:

• Name, email address and password when you create an optional awflow account (we store passwords only in hashed form)
• Email address when you subscribe to our newsletter (you can unsubscribe through the link in every email)
• Submitted workflows, workflow requests, votes or other content in the Marketplace
• Feedback, support requests, or inquiries sent to our email

If you upload workflows or related content to the Marketplace, be mindful not to include sensitive personal data unless you have lawful grounds and valid user consent.

3.2 Data processed locally in your browser

When running workflows:

• Workflow logic executes inside the browser.
• Selected text, HTML, extracted data, page interactions, and workflow context remain on your device unless you explicitly configure a workflow to send data elsewhere (e.g., an API call to a third-party service).
• We do not receive data processed by your local workflows unless you intentionally send data to us (for example, by uploading the workflow itself).

3.3 Usage statistics, error reports and technical data

• Anonymous usage statistics. Counts of product events (for example "a workflow ran"), sent with a random install ID, your browser name, the app version and whether you use the extension or the web app. They are not linked to your account and contain no workflow content. Off until you allow them: the app asks once, and you can change your choice any time in Settings → Privacy, where you can also reset the install ID. The install ID is only created once you allow sharing, and deleted when you turn both usage statistics and error reports off.
• Error reports. When the app itself fails, the error message and stack trace, with workflow data, inputs and email addresses removed. Off until you allow them, like usage statistics; you can change this any time in Settings → Privacy.
• Server logs. Basic logs (IP address, timestamp, user agent) for security and diagnostics.
• Marketplace metrics. Browsing and download counts, in aggregated form.

In Firefox, Firefox asks instead, when you install the extension: usage statistics and error reports are only sent while you allow Firefox's "technical and interaction data" permission (see 3.7), and you can still turn either off in Settings → Privacy.

We do not use tracking cookies, cross-site tracking scripts, or third-party advertising identifiers.

3.4 Cookies

The Service may use essential cookies for:

• Session management
• Security
• Basic site functionality

We do not use cookies for analytics or advertising unless explicitly stated and consented to in the future.

3.5 Third-party integrations

If you configure workflows to interact with external services (e.g., APIs or AI providers), any data processing performed by those services is governed by their respective privacy policies. We do not control third-party data handling.

3.6 Optional account and cloud sync

If you create an awflow account and use cloud mode, the following is stored on our servers so it is available on all your devices:

• Your workflows and their settings
• Credentials you save for integrations (for example API keys, tokens, usernames and passwords, OAuth client secrets). Secrets are encrypted at rest.
• Run history and run logs, which can contain data your workflows processed (for example text from a web page)

In local mode (no account), none of this leaves your device. You can delete synced items in the app at any time, and you can ask us to delete your account (see section 10).

3.7 Browser extension permissions and Firefox data consent

The browser extension asks your browser for the permissions it needs (for example access to websites, so workflows can read and act on pages). You can review and revoke them in your browser's extension settings.

In Firefox, the extension uses Firefox's built-in data consent. Nothing is required to install it. The "technical and interaction data" setting controls usage statistics and error reports. When you sign in to an awflow account, Firefox asks your permission to share account data (personal identifiers, authentication information, and website content in synced run logs). If you decline or later revoke it (in about:addons), the extension stops sending account data and you can keep using local mode.

We process personal data only for legitimate purposes, including:

1. Operating and maintaining the Service
Ensuring availability, performance, and security.

2. Managing the Marketplace
Hosting workflows, surfacing content, responding to reports, and moderating violations.

3. Communicating with you
Responding to support requests, sending essential service notices, or contacting you about security issues.

4. Improving the Service
Using aggregate analytics, diagnostics, and non-identifying data to enhance reliability and functionality.

5. Legal compliance
Meeting obligations under German and EU law, including data protection and security requirements.

We do not use personal data for profiling or automated decision-making.

We process personal data under one or more of the following lawful bases:

• Art. 6(1)(b) — performance of a contract or preparation for using the Service
• Art. 6(1)(a) — your consent, where required
• Art. 6(1)(f) — legitimate interests (e.g., security, fraud prevention, operating the Marketplace)
• Art. 6(1)(c) — compliance with legal obligations

We do not sell personal data. We only share personal data in these circumstances:

1. Service providers
Limited third-party vendors (e.g., hosting providers) who help us operate the infrastructure. They are bound by confidentiality and data-processing agreements.

2. Marketplace hosting
When you upload workflows or associated content, it becomes publicly viewable by other users.

3. Legal requirements
If required by law, court order, or regulatory authority.

4. Security or misuse investigations
If necessary to investigate abuse, fraud, or security incidents.

We do not share personal data with advertisers or marketing brokers.

If personal data is transferred to countries outside the European Economic Area (EEA), we ensure appropriate safeguards consistent with GDPR requirements (e.g., Standard Contractual Clauses or adequacy decisions).

Personal data is stored only for as long as necessary for the purposes described in this Policy:

• Server logs: retained for short periods for security and diagnostic purposes
• Account data and cloud-synced workflows, credentials and run logs: retained until you delete them or your account
• Usage statistics and error reports: retained for limited periods for product improvement and diagnostics
• Marketplace uploads: retained until you remove them
• Email correspondence: retained as needed for communication history or legal compliance

We may retain minimal residual information as required by applicable law (e.g., for fraud prevention, security, or audit obligations).

We implement technical and organizational measures to protect personal data, including:

• Encrypted connections (HTTPS)
• Access controls and authentication
• Monitoring and rate-limiting of servers
• Minimizing collected data to reduce risk
• Isolation of Marketplace uploads from core execution logic

Because workflows run on the client side, you are responsible for the security of your own device, browser, and any credentials you use in workflows.

You have the following rights regarding your personal data:

1. Right of access — request a copy of your personal data
2. Right to rectification — correct inaccurate or incomplete data
3. Right to erasure — request deletion (subject to lawful exceptions)
4. Right to restriction — limit processing under certain conditions
5. Right to data portability — receive your data in a machine-readable format
6. Right to object — object to processing based on legitimate interests
7. Right to withdraw consent — where processing relies on consent
8. Right to lodge a complaint — with your local data protection authority (in Germany, this is the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI))

You may exercise your rights by emailing hello@awflow.io.

The Service is not intended for children under 16. We do not knowingly collect personal data from children under 16. If you believe a minor has provided personal data, contact us, and we will take appropriate steps to delete it.

Workflows or uploaded content may reference third-party websites or APIs. We are not responsible for their privacy practices. Review the privacy policies of all external services you interact with through workflows.

We may update this Policy periodically. Updates will be posted with a new effective date. Your continued use of the Service indicates acceptance of the updated Policy.

For privacy inquiries, data requests, or GDPR rights, contact:

Dannick Kwengang (operating Agentic Workflow / AWFlow)
Mennonitenstraße 20
67657 Kaiserslautern
Germany
Email: hello@awflow.io

This Privacy Policy is provided for informational purposes only. If you require legal guidance or compliance verification, consult a qualified legal professional.

• The site remembers the colour theme in this browser (localStorage key `awf-theme`).
• The site remembers whether animations are paused in this browser (localStorage key `awf-motion`).
• The site remembers a signed-in Academy hint in this browser (localStorage key `awf-me`).
• Signing in on awflow.io uses the AWFlow account session cookie shared on `.awflow.io` (the same account as the extension).
• Academy progress, quiz attempts and certificates are stored in the account. A certificate page is public and shows the name, track, score and date.
• The monthly digest uses double opt-in: an address is added only after the confirmation link is clicked.
• The community forum at /community signs in with the AWFlow account. Forum posts are stored in a separate community database run by AWFlow.
• Forum posts, the account display name, the avatar and the member profile page (`/community/u/<id>`, with the join date) are public.
• Members can edit their own posts for 24 hours and delete them at any time. Moderators can hide content that breaks the forum rules.
• When an account is deleted, its forum posts are kept and the author is shown as "Deleted member".
• Search runs on the site; no third-party search service is used.
• The website is hosted on Vercel.