Privacy Policy

Last updated: 31 July 2026

This policy explains what descflow ("we", "us") collects when you use descflow.com and the descflow service, why we collect it, and what we do with it. descflow is operated by an individual sole trader based in Türkiye. Contact: support@descflow.com.

Information we collect

• Account information. Your email address and your Google account identifier, received when you sign in with Google.
• Google authorisation. If you connect a Google service to a flow, we store the resulting access and refresh tokens and the list of permissions you granted, so scheduled flows can run without you being present.
• Workflow content. The flows you create, their configuration, the generated code for each step, and the record of each run.
• Google Workspace data. Only the data covered by the permissions you explicitly approve for a specific flow — for example selected Gmail message headers, Drive files, Sheets ranges, Calendar events, Forms responses, Tasks, Docs, Slides, or Contacts.
• Usage data. Basic technical information such as IP address, browser type and request timestamps, used for security, abuse prevention and diagnostics.
• Payment information. We never receive or store your card details. Payments are handled entirely by our payment provider.

How we use it

• To provide, operate and maintain the service.
• To build, test, run and monitor the flows you create.
• To enforce usage limits and subscription entitlements.
• To detect, prevent and investigate abuse or security incidents.
• To respond to support requests you send us.

We do not sell your personal data, and we do not use your workflow content or your Google data for advertising.

Google user data

descflow's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We request permissions incrementally — only when a step in one of your flows actually needs them, never bundled at sign-up.
• We request the narrowest permission that can perform the action. For example, reading email metadata rather than full message content, where the narrower permission is sufficient.
• Google user data is used only to provide and improve the specific features you have set up. It is not transferred to others except as needed to provide the service, to comply with applicable law, or as part of a merger or acquisition with notice to you.
• Google user data is not used for advertising, and is not sold.
• We do not allow humans to read your Google user data, except where you give explicit consent for a specific support request, where it is necessary for security purposes or to comply with applicable law, or where the data has been aggregated and anonymised.
• You can disconnect descflow's access at any time from your Google Account permissions page, or from within descflow. Flows depending on a revoked permission stop rather than continue in a degraded state.

Service providers we use

We rely on a small number of providers to run the service, and share data with them only as needed for that purpose:

• Amazon Web Services — hosting, storage of your account and workflow data, and flow execution.
• OpenRouter (which routes to the DeepSeek model) — the plain-language description you write for a step is sent to this provider so a flow step can be generated. It is used at build time only.
• Polar — subscriptions and payments. Polar acts as merchant of record and handles your payment details directly; we never see them.
• Google — sign-in, and the Workspace APIs your flows call.

International transfers

We are based in Türkiye, and our providers operate infrastructure in the European Union and the United States. This means your data may be processed outside your country of residence. Where required, transfers rely on the safeguards offered by those providers, such as the European Commission's standard contractual clauses.

Data retention

We keep your account and workflow data for as long as your account is active. If you delete your account, we permanently delete your account data, flows and run history within 30 days. Google access and refresh tokens are deleted immediately when you disconnect a service or delete your account. We may retain limited records for longer where legal, tax or accounting rules require it.

Security

Data is encrypted in transit using TLS, and encrypted at rest by our infrastructure providers. Google tokens are stored encrypted. Access to production systems is restricted. No system is perfectly secure, and we cannot guarantee absolute security.

Your rights

Depending on where you live — including under the EU/UK GDPR and under Türkiye's Personal Data Protection Law (KVKK) — you may have the right to access, correct, export or delete your personal data, to withdraw consent, and to object to or restrict certain processing. To exercise any of these, email support@descflow.com. You also have the right to complain to your local data protection authority.

Children

descflow is not intended for people under 16, and we do not knowingly collect their data.

Changes to this policy

If we make a material change, we will update the date at the top of this page and, where the change significantly affects how we handle your data, notify you by email before it takes effect.

Contact

Questions about this policy: support@descflow.com