Privacy Policy

NxFlow Inc. (“NxFlow”, “we”, “our”, “us”) operates the NxFlow AI workflow automation platform, available at https://nxflow.ai and as a self-hosted deployment. This Privacy Policy describes how we collect, use, disclose, and safeguard personal data when you use our platform, including its third-party OAuth integrations.

By accessing or using NxFlow you acknowledge that you have read and understood this policy. If you are using NxFlow on behalf of an organisation, you represent that you have authority to bind that organisation and that the organisation agrees to this policy.

Self-hosted users: When you deploy NxFlow on your own infrastructure, all user data remains on your servers. Only telemetry data (if enabled) and AI model calls to cloud providers (if configured) leave your environment.

2.1 Account & Registration Data

• ▸Identity: Name and email address provided at registration or SSO.
• ▸Authentication: Hashed passwords (bcrypt); we never store plain-text passwords.
• ▸Profile: Optional display name and avatar.
• ▸Organisation: Organisation name and member roles if you use team features.

2.2 Workflow & Configuration Data

• ▸Workflow definitions: Node configurations, edges, and settings you create on the canvas.
• ▸Execution logs: Inputs, outputs, and error messages from workflow runs (retained for 90 days by default).
• ▸Templates: Workflow templates you publish to or fork from the marketplace.
• ▸Conversation history: AI agent conversations you explicitly save (stored per your memory consent setting).

2.3 Credentials & OAuth Tokens

• ▸API keys: Keys you add to the credential vault are encrypted with AES-256-GCM before storage. We do not log or read the decrypted value except during workflow execution.
• ▸OAuth tokens: Access and refresh tokens granted by third-party providers. Encrypted at rest; used only to perform the operations your workflows request. Revoked from our systems upon disconnection.

2.4 Usage & Diagnostic Data

• ▸Usage metrics: Feature interactions, page views, workflow execution counts (not content).
• ▸Performance data: Response times, error rates, and crash reports.
• ▸Audit logs: IP address, timestamp, action type for security-sensitive operations. Retained for 12 months.
• ▸Device/browser data: Browser type, OS version, and device type for compatibility purposes.

2.5 Data From Third-Party Integrations

When you connect a third-party service (Google, Slack, GitHub, etc.) via OAuth, NxFlow temporarily accesses data from that service solely to execute the automation step you have configured. This data is processed in real-time and is not stored beyond the execution log (see Section 8). See Section 3 for more detail on how OAuth data is handled.

NxFlow supports connections to third-party services — including Google, Microsoft, Slack, GitHub, LinkedIn, Notion, HubSpot, Salesforce, Shopify, Jira, Airtable, Dropbox, and others — via OAuth 2.0. When you connect a service, NxFlow requests only the minimum permissions necessary for the workflow steps you configure.

Data fetched from these services is used solely to execute the specific automation you have set up. It is processed in real-time and is not stored beyond the execution log (see Section 8). We do not use data from connected accounts for advertising, analytics, or AI model training.

You can disconnect any integration at any time from Settings → Connections, which immediately revokes NxFlow's access tokens. We recommend also revoking access from the provider's own security settings (e.g., Google Account → Security → Third-party apps).

We use the information we collect for the following purposes:

• ▸Service delivery: Execute workflows, route data between integrations, and return results as you configure.
• ▸Authentication & security: Verify identity, manage sessions, detect and prevent fraud or abuse, and enforce access controls.
• ▸Platform improvement: Analyse aggregated, anonymised usage patterns to improve features and fix bugs. We do not use individual workflow content for this purpose.
• ▸Customer support: Respond to inquiries, diagnose issues, and provide technical assistance.
• ▸Communications: Send transactional emails (password resets, security alerts, feature notices). Marketing emails only with your explicit consent.
• ▸Legal compliance: Comply with applicable laws, regulations, and lawful requests from public authorities.
• ▸Billing: Process payments and manage subscriptions (handled by third-party payment processor).

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we process personal data under the following legal bases as defined in the General Data Protection Regulation (GDPR):

• ▸Contractual necessity (Art. 6(1)(b)): Processing required to deliver the services you have contracted for — account management, workflow execution, credential storage.
• ▸Legitimate interests (Art. 6(1)(f)): Security monitoring, fraud prevention, platform analytics, and improving our services, where such interests are not overridden by your rights.
• ▸Legal obligation (Art. 6(1)(c)): Where we are required to retain or disclose data by applicable law.
• ▸Consent (Art. 6(1)(a)): For non-essential cookies, marketing communications, and AI memory storage. You may withdraw consent at any time without affecting the lawfulness of prior processing.

CCPA (California): California residents have the right to know, delete, and opt out of the sale of personal information. NxFlow does not sell personal information. To exercise your rights, see Section 10 or contact privacy@cogniai.com.

We do not sell personal data. We share data only in the circumstances below:

• ▸Service providers / subprocessors: Third-party vendors who process data on our behalf under data processing agreements (DPAs) with equivalent data protection obligations.
• ▸Third-party integrations: When your workflow sends data to a service you connected (e.g., Slack, Google), that data is transmitted directly to the API endpoint you configured. That service's own privacy policy governs such data.
• ▸Legal requirements: Where required by applicable law, court order, or government request. Where legally permissible, we will notify you.
• ▸Protection of rights: To detect, prevent, or address fraud, abuse, security incidents, or technical issues.
• ▸Business transfers: In connection with a merger, acquisition, or sale, where the acquiring party is bound by equivalent data protection obligations. We will notify you in advance.
• ▸With your consent: Any other sharing requires your explicit, informed consent.

Current Subprocessors

We will provide 30 days' advance notice before adding new subprocessors that process personal data. Notification will be made via platform notice or email to workspace administrators. A vendor-hosted integration appears in the table above with a "30-day notice period" status for the duration of that notice, and cannot receive any of your data until you install it and explicitly acknowledge its data-transfer disclosure.

We implement the following safeguards to protect your data:

• ▸Encryption at rest: All credential values are encrypted with AES-256-GCM. Database fields containing sensitive data are encrypted before storage.
• ▸Encryption in transit: All connections between clients and servers use TLS 1.2 or higher. TLS 1.3 is preferred.
• ▸Credential isolation: API keys and OAuth tokens are stored in an isolated credential vault and decrypted only in-memory during workflow execution.
• ▸Access controls: Role-based access control (RBAC) with JWT authentication. Session tokens are short-lived (15 minutes) with refresh rotation.
• ▸SSRF protection: HTTP nodes and external API calls are validated against an allowlist to prevent server-side request forgery.
• ▸Code sandboxing: User-provided code in workflow nodes runs in an isolated sandbox (Node.js VM with restricted globals).
• ▸Audit logging: All credential access, administrative actions, and authentication events are logged with timestamp, IP address, and user ID.
• ▸Rate limiting: API endpoints and authentication routes are rate-limited to prevent brute force attacks.
• ▸Dependency scanning: We regularly scan dependencies for known vulnerabilities.
• ▸Incident response: In the event of a data breach, we will notify affected users and, where required, supervisory authorities within 72 hours of discovering the breach.

While we implement industry-standard measures, no internet transmission is 100% secure. We encourage you to use strong, unique passwords and enable two-factor authentication.

Depending on your jurisdiction, you may have the following rights. To exercise any of them, email privacy@cogniai.com or use the in-app data tools in Settings → Profile. We respond within 30 days (or 45 days where legally permitted with notice).

• ▸Access (GDPR Art. 15 / CCPA): Request a copy of the personal data we hold about you.
• ▸Correction (GDPR Art. 16): Request that we correct inaccurate or incomplete data.
• ▸Deletion (GDPR Art. 17 / CCPA): Request erasure of your personal data. Available via Settings → Profile → Delete Account.
• ▸Data portability (GDPR Art. 20): Export your workflows, agent conversation history, and account data in JSON format. Available in Settings → Profile → Export Data.
• ▸Objection (GDPR Art. 21): Object to processing based on legitimate interests or for direct marketing.
• ▸Restriction (GDPR Art. 18): Request that we restrict processing while a dispute is resolved.
• ▸Withdraw consent: Where processing is based on consent, withdraw it at any time (e.g., disable AI memory in Settings).
• ▸Lodge a complaint: You have the right to lodge a complaint with your local data protection authority (e.g., ICO in the UK, CNIL in France, BfDI in Germany).
• ▸Opt out of marketing: Unsubscribe from marketing emails at any time via the link in any email or by contacting us.

Revoke OAuth Access

You can disconnect any OAuth integration at any time from Settings → Connections. This immediately revokes NxFlow's access tokens and removes the integration from your account. You should also revoke access from the third-party provider's own security settings to be thorough (e.g., Google Account → Security → Third-party apps).

We use the following types of cookies and local storage:

• ▸Essential cookies: Session management (NEXT_LOCALE, CSRF tokens). Cannot be disabled.
• ▸Authentication tokens: JWT access and refresh tokens stored in localStorage for session continuity. Auto-expire after inactivity.
• ▸Preference cookies: Theme (dark/light) and language preference.
• ▸Analytics: Aggregated, anonymised usage data for product improvement. No cross-site tracking. No third-party advertising cookies.

You can control cookies through your browser settings. Disabling essential cookies will prevent authentication. We do not use cookies for targeted advertising or cross-site tracking.

NxFlow is not directed to individuals under the age of 16 (or 13 in the United States). We do not knowingly collect personal information from minors. If we learn that we have collected personal data from a minor without appropriate parental consent, we will delete that data promptly. If you believe a minor has provided us with personal data, please contact us at privacy@cogniai.com.

NxFlow is operated in the United States. If you are located in the EEA, UK, or Switzerland, your data may be transferred to and processed in the US or other countries that may not provide the same level of data protection as your jurisdiction.

Where we transfer personal data from the EEA/UK to countries without an adequacy decision, we rely on EU Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement (IDTA) as the legal transfer mechanism.

Self-hosted users maintain complete control over data residency. All data stays within the infrastructure you control, except for calls to external AI or API providers you explicitly configure.

We may update this Privacy Policy periodically to reflect changes in our practices, services, or applicable law. For material changes (e.g., new data uses, new categories of personal data), we will:

• ▸Post a prominent notice on the platform at least 30 days before the change takes effect.
• ▸Send an email notification to your registered email address.
• ▸Update the “Effective date” at the top of this policy.

Your continued use of NxFlow after the effective date constitutes acceptance of the updated policy. If you do not agree, you may delete your account before the changes take effect.

For privacy-related requests, questions, or complaints, contact our privacy team:

We will acknowledge all privacy requests within 48 hours and fulfil them within 30 days (or the statutory period required by law).