1. Roles and scope
For organizer and team account data, Workfluz determines how the service operates. For attendee data uploaded or collected for an event, the event organizer determines the purpose and Workfluz processes the information on its instructions. Each organizer remains responsible for its notices, lawful basis and attendee requests.
2. Information we process
We may process account identity and access data, organizer and event configuration, orders and attendance records, support requests, channel connection metadata, contact identifiers, message content and delivery events, template information, security logs and technical diagnostics.
Provider access tokens are encrypted and kept on the server. They are not exposed to browsers, attendees or automation providers.
3. Purposes
We use information to provide event operations, deliver messages requested by organizers, route conversations to the correct organization, support human and authorized AI assistance, protect accounts, prevent abuse, meet legal obligations and improve reliability.
4. Providers and international processing
Workfluz may use infrastructure, payment, email, observability and messaging providers. Communications can involve Meta products, Brevo and an organizer-configured automation service such as n8n. Each provider receives only the information required for its function and is subject to its own terms and privacy commitments.
For a Meta-connected channel, Workfluz uses business account and phone metadata, message and template content, delivery events and webhook data only to provide, secure and support the functions authorized by the connected organization. Workfluz does not sell Meta Platform Data or use it to create advertising profiles.
5. Retention and security
We retain information while an account or event requires it and for limited periods needed for security, dispute resolution, accounting and legal duties. Communications retention is configurable by the service. We use tenant isolation, access control, encryption for secrets, signed webhooks, idempotency and audit records.
6. Your choices and rights
Depending on applicable law, you may ask to know, access, update, correct or delete personal data, learn how it has been used, withdraw consent where available, and submit a complaint to the competent authority. Event attendees should first contact the organizer shown for their event; Workfluz will assist the organizer when required.
7. Contact
Send privacy or data-rights requests from the address associated with your account and include enough information to identify the event or organization. Do not send passwords, access tokens or full payment card details.
josh@workfluz.app