Privacy policy

For our website and your account, BorsFlow is the data controller: we decide why and how that data is used.

For the content of a workspace — the contacts in its CRM, submissions to its forms, the recipients of its campaigns, its documents and invoices — the business that owns the workspace is the controller, and we process that data on its behalf and only on its instructions, as its processor. If you filled in a form or received an email sent with BorsFlow by one of our customers, please contact that business first; we will help them answer your request.

Questions about this policy or your data: contact our support team.

• Account data: your name, email address, password (stored only as a one-way hash), profile picture and, if you sign in with Google, the basic profile Google shares with us.
• Workspace content: everything you and your team put into BorsFlow — pages, CRM contacts and notes, pipelines, quotes, invoices, products, forms and their submissions, uploaded files, email campaigns and meeting details.
• Form submission data: what a visitor types into a published form, the page it was filled in on, and a one-way hash of their IP address used only to limit spam.
• Email engagement: for campaigns sent through BorsFlow, whether a message was delivered, opened or clicked, and unsubscribe requests.
• Integration data: if you connect Google Calendar, Zoom or Cal.com, the access tokens (stored encrypted) and the calendar and meeting details needed for the feature.
• Technical data: IP address, browser and device type, and server logs, needed to run and secure the service.
• Website analytics, only if you accept analytics cookies: pages visited, clicks, scrolling and approximate location, collected by Google Analytics and Microsoft Clarity. See the cookie policy.

We do not sell personal data, and we do not use workspace content to advertise to you or to anyone else.

When you use an AI feature, the text you submit and the workspace content needed to answer it are sent to our AI inference provider (Groq) to generate the response. Requests are processed to answer you and are not used by us to train models. Do not submit information to the assistant that your workspace is not allowed to share with a service provider.

We use carefully selected providers, each bound by a data processing agreement:

Some providers are located outside the European Economic Area. Where data is transferred, it is protected by the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.

• Account data and workspace content: for as long as the account or workspace exists.
• After you delete a workspace or close your account, its data is deleted from the live service, and removed from rolling backups as they expire.
• Server logs: kept for a short period for security, then deleted.
• Analytics data: see the retention periods in the cookie policy.
• Invoices and accounting records: for the period required by tax law.

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected, and data deleted;
• restrict or object to processing based on our legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time, for example to analytics cookies, using “Cookie settings” in the footer.

To exercise a right, contact our support team. We reply within one month. You also have the right to lodge a complaint with your local data protection authority.

Data is encrypted in transit (HTTPS). Passwords are hashed, integration tokens are encrypted at rest, uploaded files are only served through short-lived signed links, and access inside a workspace follows the roles its owner sets (viewer, member, admin, owner).

BorsFlow is a business tool and is not intended for anyone under 16.

If we change this policy in a way that matters, we will update the date above and, for significant changes, tell account holders by email or in the app before the change takes effect.