Subprocessors
DRAFT v1.0 — prepared for review by qualified counsel before publication. Replace bracketed placeholders.
Version: 1.0 · Last updated: [EFFECTIVE DATE] · Published at: flowagenci.com/legal/subprocessors
[FLOWAGENCI LLC LEGAL NAME] ("FlowAgenci") uses the third-party subprocessors listed below to provide Flow (the "Service"). Each subprocessor is bound by a written agreement that requires confidentiality, appropriate security measures and data protection obligations at least as protective as our Data Processing Addendum ("DPA").
This page forms Annex III of the DPA.
Current subprocessors
| Subprocessor | Location of processing | Purpose | Data processed | Applies to |
|---|---|---|---|---|
| Cloudflare, Inc. | United States, and Cloudflare's global network (primary database region: North America) | Hosting and edge compute (Workers); relational database (D1); object storage for files (R2); key-value storage (KV); job queues; transactional email delivery (Email Service); PDF rendering (Browser Run); bot protection on sign-in and public forms (Turnstile); cookieless website analytics (Web Analytics); custom domain certificates (Cloudflare for SaaS) | All Customer Data and Account Data stored in or transmitted through the Service | Customer Data and Account Data |
| Stripe, Inc. | United States | Subscription billing, payment processing, tax calculation, invoices and customer billing portal | Account owner and billing contact details, tax IDs and billing address, payment method details (held by Stripe), subscription and invoice records | Account Data only |
| Functional Software, Inc. d/b/a Sentry | United States | Application error monitoring and performance diagnostics | Technical error data (stack traces, request metadata, pseudonymous user and organization identifiers). Configured to scrub Personal Data such as emails, tokens and form contents before transmission | Customer Data and Account Data (minimized) |
| Google LLC | United States | Optional "Sign in with Google" authentication for team users | Name, email address and profile picture of users who choose Google sign-in | Account Data only (optional) |
FlowAgenci does not use subprocessors for advertising, and no subprocessor is permitted to use Customer Data to train artificial intelligence models.
Customer-directed services
When a Customer chooses to connect or use third-party services (for example, pointing its own domain at the Client Portal or sending documents to external email addresses), those providers act on the Customer's behalf and are not FlowAgenci subprocessors.
Changes to this list
- We give at least 30 days' notice before adding or replacing a subprocessor, by updating this page with the new entry and its effective date.
- Account owners can subscribe to updates from this page (or by emailing privacy@flowagenci.com) to receive an email for each change.
- A Customer may object to a new subprocessor on reasonable data protection grounds within the notice period by writing to privacy@flowagenci.com. If we cannot reasonably accommodate the objection, the Customer may terminate the affected Service before the change takes effect and receive a pro-rata refund of prepaid fees, as described in Section 6 of the DPA.
Change log
| Date | Change |
|---|---|
| [EFFECTIVE DATE] | Initial list published. |
Contact
Questions about our subprocessors: privacy@flowagenci.com.
Related documents: Privacy Policy · Data Processing Addendum · Terms of Service