Privacy Policy

1. Roles

For data customers enter into the platform (users, requesters, tickets, tasks), each customer is the controller and 4flow is the processor (LGPD, art. 5). For data from this website and trial requests, 4flow is the controller.

2. Data we process

Account: name, email and optional photo. Usage: activity records, sessions and IP address. Content entered by customers. Contacts without an account: name, email and phone. Trial requests: company, name, email and message.

3. Purposes and legal bases

Providing the service (performance of contract), protecting the platform and keeping an audit trail (legitimate interest), complying with legal obligations and, where applicable, sending marketing communications (consent, revocable at any time).

4. Sharing and international transfers

The infrastructure (DigitalOcean) is located outside Brazil. When the agent is enabled, code and task context are sent to Anthropic. We also use transactional email and error monitoring providers without personal data. These transfers follow contractual clauses; customers can disable the agent or use their own key.

5. Retention

Defaults, configurable per customer: closed tickets for 24 months, agent run logs for 90 days and webhook payloads for 30 days. When a workspace is deleted, its data is erased after 30 days and the activity history is anonymized.

6. Data subject rights

You may request confirmation, access, correction, anonymization, portability, deletion and information about sharing, and revoke consent (LGPD, art. 18). Account export and deletion are available in your preferences; for data held by a customer, contact that customer, and 4flow will assist them.

7. Security

Isolation per customer and per department, encryption in transit, encrypted integration credentials, MFA for administrators and an immutable activity log.

8. Cookies

The application uses only the session cookie, which is necessary for it to work. This website does not use analytics cookies.

9. Data protection officer (DPO)

Contact of the data protection officer: [to be defined].

10. Changes

The version and date of this policy appear at the top. Material changes are communicated before they take effect.