Data Processing Addendum.

Roles

For customer content and workspace data, the customer is generally the controller or business and Fl8ws is generally the processor or service provider. For account, billing, security, and product operations, Fl8ws may act as an independent controller as permitted by law.

Subject matter and duration

Processing covers providing Fl8ws, including account management, generation workflows, storage, support, billing, security, analytics, and compliance. Processing lasts for the subscription term and any period needed for deletion, legal, billing, security, or dispute obligations.

Data subjects and data categories

• Customer users, team members, contractors, prospects, and people included in submitted content.
• Account, contact, authentication, billing, support, usage, prompt, asset, output, and technical log data.

Instructions and subprocessors

Fl8ws processes customer personal data according to customer instructions reflected in the service, agreement, and applicable law. Fl8ws may use subprocessors for hosting, storage, model processing, payments, analytics, support, security, and communications.

Security and confidentiality

Fl8ws uses reasonable technical and organizational measures designed to protect customer personal data and limits personnel access to those who need it for product, support, security, billing, or legal purposes.

International transfers

Where transfer safeguards are required, Fl8ws will use appropriate mechanisms such as standard contractual clauses or other lawful transfer tools when available and applicable.

Assistance and deletion

Fl8ws will provide reasonable assistance for data subject requests, security incidents, audits, impact assessments, and deletion requests as required by applicable law and the customer agreement.

Request a signed DPA

Teams that need a signed DPA or vendor review can contact us with company name, country, expected use case, and required clauses.