1. Who processes your data and how to contact us
The data controller is not yet provided, with registered office at not yet provided.
For privacy requests, or to exercise the rights described in this policy, write to not yet provided.
When the Service is used by an organization to manage data about its own customers, contacts, employees or other data subjects, that organization may act as data controller, and the technical provider of the Service may act as data processor, under the applicable agreements.
2. Data we process
The Service is a configurable management tool for entities, structured data, automations, forms and integrations. Depending on how the organization configures it, we may process:
- account and organization data, such as name, email address, role, sign-in identifiers and preferences;
- data entered or imported by users into the tool, including any personal data contained in the configured entities;
- technical and security data, such as IP address, access logs, device and browser information, sessions, events and audit logs;
- data related to workflows, scripts, webhooks, public forms, email communications and support requests;
- credentials, keys and tokens needed to use external connectors. We protect this information with appropriate safeguards and, where the application provides it, store it encrypted.
We recommend that users do not enter special categories of personal data or judicial data unless it is strictly necessary, and only when an appropriate legal basis and configuration are in place.
3. Purposes and legal bases
We process personal data for the following purposes:
- to provide, administer and protect the Service and user accounts; the legal basis is the performance of a contract or pre-contractual measures;
- to configure and run the workflows, automations, forms and connectors that the organization requests; the legal basis is the performance of a contract or the legitimate interest of the organization, as applicable;
- to prevent unauthorized access, abuse and fraud, to manage logs and backups, and to ensure continuity and security; the legal basis is our legitimate interest and, where applicable, compliance with legal obligations;
- to respond to support requests, to establish or defend legal claims, and to comply with legal obligations; the legal basis is the performance of a contract, a legal obligation or our legitimate interest;
- to send marketing communications, only where the law requires it and on the basis of consent or another appropriate legal basis.
4. Connectors and external platforms
At the initiative and under the configuration of an authorized user, the Service may connect to third-party platforms such as Google, Microsoft, Slack or other available providers.
Access and data obtained through these platforms are used solely for the internal purposes of the organization: to run the connectors, to carry out workflows and automations, and to synchronize or process the data strictly needed for the operations the user requests. We do not use such access or data for advertising profiling, sale to third parties, data brokering, or any purpose unrelated to the connector or the configured workflow.
The authorized user chooses the connection and grants the permissions requested by the provider. Permissions must be proportionate to the functions actually enabled. Access can be revoked from the Service, where available, or from the account settings at the external provider. The terms and privacy notices of the external provider continue to apply to its service.
Data is sent to an external provider only when this is necessary for the action set by the connector or workflow. The organization that configures the integration is responsible for checking that it has the necessary grounds and for informing data subjects where required.
Use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. Recipients, processors and transfers
Personal data may be processed by authorized staff and by providers that support the delivery of the Service, such as hosting, email, infrastructure, security and support providers, and services connected to the connectors that are enabled. Where required, these providers act as data processors or as independent controllers, depending on their role.
If connectors or providers are located outside the European Economic Area, a transfer takes place only where permitted by applicable law, for example on the basis of an adequacy decision, standard contractual clauses or other appropriate safeguards.
We do not sell personal data.
6. Retention
We keep data for as long as necessary for the purposes for which it was collected, for the duration of the contract, and to meet legal obligations. Where available, the organization can configure retention and deletion rules for the entities it processes. Technical and security logs are kept for a period proportionate to the security and operation of the Service. Residual copies may remain in backups for the time technically needed to rotate them.
7. Security
We adopt technical and organizational measures that are reasonable and proportionate to the risk, including access controls, permission management, audit logs, protection of credentials and tokens, encryption where provided, updates and backup procedures. No system is completely secure, however. Users must keep their credentials safe, use individual accounts, and promptly report any incident or suspicious access.
8. Your rights
Where applicable law provides for it, you may request access to, rectification, erasure, restriction, objection to, and portability of your data, and you may withdraw consent without affecting the lawfulness of processing carried out before the withdrawal. You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).
Requests about data processed on behalf of a customer organization should first be addressed to that organization. The provider of the Service will cooperate with it within the limits of the applicable agreements.
9. Changes to this policy
We may update this policy to reflect changes to the Service or to the law. We will publish the new version with its updated date. For material changes, we will use additional means of communication where appropriate.