Privacy Policy

Nord Flow provides a workspace for project-driven companies to manage projects, pipeline, funding, partners and reporting. For data you enter into your workspace, your organisation is the data controller and Nord Flow acts as data processor. For account, billing and website data, Nord Flow is the controller.

Questions about this policy or your data can be sent to privacy@nordflow.tech.

• Account data — name, email address, password hash, workspace membership and role.
• Workspace content — the projects, opportunities, funding applications, organisations, tasks, documents, budgets and comments you and your colleagues create.
• Partner access data — email addresses of external partners you invite and the records you share with them.
• Billing data — plan, subscription status and billing period. Card details are handled by our payment provider and never reach our servers.
• Technical data — IP address, browser type and log entries generated when you use the service, used for security and troubleshooting.

We process personal data to provide and secure the service (performance of a contract), to handle billing and meet accounting obligations (legal obligation), and to improve reliability and prevent abuse (legitimate interest). We do not sell personal data and we do not use your workspace content for advertising.

• Cloud hosting and database, including authentication and file storage for your workspace.
• Paddle, which acts as merchant of record for subscriptions and handles payment and invoicing data.
• Email delivery for transactional messages such as invitations and password resets.

Processors act on our documented instructions under data processing agreements. A current subprocessor list is available on request.

Workspace content is retained for as long as the workspace is active. When a workspace or account is deleted, the associated content is removed from our production systems, except where we must keep records to meet legal obligations such as accounting rules for invoices.

Access to workspace data is restricted per workspace and per role, and is enforced in the database as well as in the application. Data is transmitted over TLS and stored by our hosting provider on encrypted storage. Internal access is limited to what is needed to operate and support the service.

Under the GDPR you may request access to your personal data, correction, deletion, restriction of processing, objection, and data portability. You can export your workspace data from the app at any time, and delete your account from Settings. To exercise any other right, contact privacy@nordflow.tech. You also have the right to lodge a complaint with your local data protection authority.

We use only the cookies and local storage entries required to keep you signed in and to remember basic interface preferences. We do not use advertising or cross-site tracking cookies.

We may update this policy as the service evolves. Material changes will be announced in the app or by email to workspace owners before they take effect.