Privacy Policy

01Introduction

Entflow (“we”, “us”, “our”) operates the workflow mapping service at entflow.app (“the Service”). This Privacy Policy explains what data we collect, how we use it, how we store it, and your rights regarding your data.

By using the Service, you consent to the practices described in this policy.

02Data We Collect

2.1 Data from HubSpot

When you connect your HubSpot portal, Entflow reads the following from your account:

• Workflow configurations - names, actions, enrollment criteria, status, and metadata
• Property definitions - property names and types (not property values on CRM records)
• Pipeline and stage metadata - pipeline names, stage labels, and display order
• Marketing email metadata - email names and subject lines (not email content, analytics, or recipient data)
• List metadata - list names and IDs (not list members or contact data)

The duplicate feature is the only part of Entflow that writes to HubSpot. When you run it, Entflow creates new workflows as drafts in a target portal you select. It never modifies or deletes your existing workflows, and never writes to your CRM records.

2.2 Data we do NOT collect

We do not collect, store, or process:

• CRM records of any kind (contacts, companies, deals, tickets) - including field values and even aggregate record counts
• Email content, templates, or analytics
• Form submissions or activity data
• HubSpot user accounts, passwords, or personal information of your team
• Website tracking or analytics data from your HubSpot portal (our own website analytics are covered in 2.8)
• Any personally identifiable information (PII) of your contacts or customers

2.3 Account data

When you create an account, we collect and store your name and email address. If you sign in via Google or GitHub, we receive your name and email from the OAuth provider. We use your email address to:

• Authenticate your account and manage your session
• Send transactional emails related to your account (subscription confirmations, plan changes, password resets)
• Send product updates, tips, and relevant communications about the Service

You can unsubscribe from non-transactional emails at any time using the unsubscribe link in any email or by updating your preferences in Settings.

We also record your account in our own HubSpot CRM account, which we use to manage our customer relationships. The only fields we send are your email address, your first and last name, your signup or purchase stage, and your Entflow plan name. This is account data about you as an Entflow customer. None of your connected portal's workflow or CRM data is ever sent to our HubSpot account.

2.4 Authentication data

We store OAuth access tokens and refresh tokens issued by HubSpot to maintain your portal connection. These tokens are encrypted at rest using AES-256-GCM encryption. We also store your HubSpot portal ID and portal name.

2.5 Payment data

Payment processing is handled by Paddle.com Market Ltd, our merchant of record. Paddle collects and remits applicable sales tax / VAT in your jurisdiction and issues tax-compliant invoices on our behalf. We do not store credit card numbers, bank account details, or other payment credentials. We store only your Paddle customer ID and subscription ID to manage your plan.

2.6 Usage data

We store data you create within the Service, including canvas elements (sections, shapes, sticky notes, text, connectors), workflow tags, node positions on the map, and custom edges. This data is associated with your portal ID.

2.7 Session data

We use httpOnly cookies to maintain your session. For full details on the cookies we use, see our Cookie Policy.

2.8 Analytics data

We use Google Analytics to understand how visitors use our website. Google Analytics collects anonymised data such as page views, referral sources, and device information using cookies. This data helps us improve the Service. No personally identifiable information is sent to Google Analytics. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

03How We Use Your Data

We use the data we collect to provide, improve, and communicate about the Service:

• Syncing workflow configurations to build the dependency map
• Detecting conflicts and property collisions between workflows
• Generating changelog entries by comparing workflow snapshots between syncs
• Rendering the visual map with your saved positions and canvas elements
• Enforcing plan limits (workflow count, feature access)
• Processing subscription payments through Paddle (our merchant of record)
• Sending transactional emails about your account and subscription
• Sending product updates, feature announcements, and tips to help you get more from the Service

04Data Storage and Security

Your data is stored in a PostgreSQL database hosted on Neon (neon.tech), a serverless database provider. The application is deployed on Vercel with automatic HTTPS encryption for all data in transit.

Security measures include:

• OAuth tokens encrypted at rest using AES-256-GCM
• HTTPS/TLS encryption for all data in transit
• HttpOnly, secure, SameSite session cookies
• No storage of payment credentials (handled by Paddle)
• Database access restricted to the application layer

05Data Retention

We retain your data for as long as your HubSpot portal is connected to the Service. Specifically:

• Workflow data is refreshed on each sync and reflects your current HubSpot configuration
• Workflow snapshots and changelog entries are retained indefinitely to support the diff and changelog features
• Canvas elements, tags, and positions are retained until you delete them or disconnect your portal
• Sync logs are retained for operational monitoring

When you disconnect your HubSpot portal through the Settings page, your access and OAuth token are removed immediately. If you are the only user connected to that portal, all of its data — workflows, dependencies, conflicts, canvas elements, tags, positions, changelog entries, snapshots, sync logs, and OAuth tokens — is permanently deleted at the same time. If the portal is shared with teammates, your link is removed and the shared portal's data is retained for the remaining users until the last person disconnects. You can also revoke Entflow at any time from HubSpot's Connected Apps settings.

06Third-Party Services

The Service integrates with the following third-party services:

• HubSpot - OAuth authentication and workflow data access for your connected portal. We also use a separate HubSpot account of our own as our customer CRM, holding your name, email, signup or purchase stage, and plan name (see section 02). Subject to HubSpot's Privacy Policy.
• Paddle - Merchant of record (payment processing, sales tax / VAT collection, invoicing, fraud detection). Subject to Paddle's Privacy Policy.
• Vercel - Application hosting. Subject to Vercel's Privacy Policy.
• Neon - Database hosting. Subject to Neon's Privacy Policy.
• Google Analytics - Website analytics. Subject to Google's Privacy Policy.
• Anthropic - AI analysis (Claude). A workflow's definition is sent only when you run Deep AI analysis, a paid feature. Free health scores are calculated in your browser and are never sent. Subject to Anthropic's Privacy Policy.

We do not use advertising or ad-targeting services. We do not sell your data to any third party.

07Your Rights

You have the right to:

• Access - View your synced data through the Service's interface (dashboard, map, changelog, settings)
• Deletion - Delete all your data by disconnecting your portal in Settings. Deletion is immediate and permanent.
• Portability - Export your workflow map data using the Export feature (PNG, SVG, PDF, CSV)
• Revoke access - Disconnect the Entflow integration from your HubSpot portal at any time, either through Entflow's Settings page or through HubSpot's Connected Apps settings

If you are located in the European Economic Area (EEA), you may also have additional rights under the General Data Protection Regulation (GDPR), including the right to lodge a complaint with your local data protection authority.

To exercise any of these rights, email hello@entflow.app.

08Children's Privacy

The Service is not intended for use by anyone under the age of 18. We do not knowingly collect data from children. If you believe a child has used the Service, please contact us and we will delete their data.

09Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes by updating the “Last updated” date at the top of this page. Continued use of the Service after changes constitutes acceptance of the revised policy.

10Contact

If you have questions about this Privacy Policy or how we handle your data, contact us at hello@entflow.app.