Privacy Policy

This policy covers the ChronoFlow product and these public pages. It describes the software’s own behaviour. The organization that operates your deployment (the “Customer”) controls the deployment, its database, and the data inside it, and may publish its own privacy notice alongside this one.

ChronoFlow is licensed for self-hosted and private deployments. If your organization uses a deployment that someone else operates for it, that operator holds the data and its own privacy notice applies alongside this one.

• Account details — name, email address, a hashed password (or the identity returned by your single sign-on provider), role, organization membership, and whether two-factor authentication or a security key is enrolled.
• Session records — a signed session cookie and server-side session and refresh-token records, used only to keep you signed in and to let an administrator end a session.
• Work content — the workflows, forms, submissions, tasks, approvals, comments and files that you or your colleagues create in the deployment.
• Audit records — for sensitive actions, the actor, the action, the target, the outcome, a correlation ID and a timestamp. These are written to the deployment’s own database so an auditor can reconstruct what happened, who decided it, and when.
• Technical logs — request and error logs written by the deployment, kept according to how its operator configures it.
• Billing identifiers — only where self-serve billing is enabled for the deployment: the plan, seat count and subscription identifiers returned by the payment provider. Card details are entered at the payment provider and are not stored by the product.

• Session cookie — set when you sign in, for authentication only. Blocking or deleting it signs you out.
• CSRF token cookie — a value the browser’s own scripts echo back with state-changing requests, so another site cannot submit them on your behalf. It is tied to your session, not to your behaviour.
• Local preferences — theme, display density and cached organization branding are kept in your browser’s local storage. They stay on your device.
• No trackers — the product sets no third-party marketing or analytics cookies, and it does not embed third-party advertising or behavioural analytics scripts.

The database, uploaded files, and audit records live in the Customer’s own deployment — on infrastructure the Customer, or the operator the Customer has chosen, runs. Access is scoped to your organization, and the deployment’s administrators control the underlying host, backups and network.

Because the deployment is your organization’s, questions about hosting location, backups and disaster recovery are answered by the operator of that deployment, not by this page.

• People in your organization see the work their role allows. Your administrators can see organization-wide settings and audit activity.
• We do not sell personal data, and the product contains no third-party marketing or analytics trackers.
• Data may be disclosed where the law requires it, or where it is necessary to protect the security of a deployment.
• Support access, when you ask for it, is arranged with your organization’s administrators and limited to what the request needs.

The software does not impose a fixed retention period on your content. Workflow content stays until someone in your organization deletes it or the deployment is removed. Audit records are retained according to your organization’s configuration and its own legal obligations, because they exist to be available after the fact.

Ask your workspace administrator for your organization’s retention practice, including how backups are aged out.

Because the data sits in your organization’s deployment, requests to access, correct, export, or delete it go to the organization that operates that deployment. Your workspace administrator is the right first contact, and can act on the request directly.

If you reach us instead, we will point you to that organization and, where it asks us to, act on its instructions.

The product stores passwords as hashes, is designed to scope tenant data to your organization, supports two-factor authentication and security keys, records sensitive actions in the audit trail, and keeps integration secrets and API keys out of API responses. File download links are signed and time-limited. Tenant isolation is enforced in the application; it has not been independently audited, and the deployment operator can verify the scope of your data from the readiness checks in the product.

This page does not claim a certification or an audit report. For the current security documentation that applies to your deployment, ask your administrator or account team.

If your deployment is connected to external services — an AI provider, a mail server, a webhook destination, a single sign-on identity provider, or a payment provider for self-serve billing — data is sent to those services when the relevant feature is used. Those integrations are configured by your organization, and each service handles data under its own terms.

We may update this policy. The “last updated” date at the top of the page changes when we do, and material changes are announced in the product or to your administrators.

For questions about this policy, contact the ChronoFlow team. For a request about your own data, contact your workspace administrator first — they operate the deployment that holds it.

This document is a standard starting template, not legal advice. It describes the software’s behaviour and deliberately makes no claim it cannot support: no data processing agreement, no subprocessor list, no certification, and no fixed retention period. Your counsel should review it, and add anything your organization’s jurisdiction and procurement rules require, before you rely on it.