Privacy Policy

Last updated:

This policy explains how OkFlow handles personal information when you visit our website or use our application, browser extension, WordPress plugin, API, and related services. The information processed depends on the features you use and your workspace's settings.

OkFlow is operated by 5e Creative Labs LLC, a Wyoming, United States limited liability company operating from Costa Rica. Contact us at info@okflow.io. For account administration, billing, website operation, security, and our own communications, we determine the purposes and means of processing and act as controller where that term applies.

For personal information in tasks, comments, pages, attachments, annotations, and other workspace content, the customer organization generally acts as controller and we process information on its instructions to provide the service. Your organization controls membership, sharing, integrations, and the purposes for which workspace content is used. Contact its administrator about that content; you may also contact us for assistance or to discuss a data processing agreement.

Account and contact information: name, email, profile details, authentication information, organization membership, roles, preferences, and communications you send us. Sources include you, your administrators, people who invite you, and an identity provider if you choose social sign-in.

Workspace content: project information, tasks, comments, pages, files, feedback, screenshots, recordings, and associated authorship and activity records. Sources include you, other authorized users, and connected integrations. Only submit information about others that you are entitled to share.

Billing information: plan, billing contact, invoice details, payment status, and payment-provider customer and transaction identifiers. Paddle is the primary billing provider and acts as merchant of record for purchases through its checkout. ONVO (OnvoPay) is an alternative payment processor when offered at checkout; 5e Creative Labs LLC remains the seller for those purchases. Payment credentials submitted in the provider's checkout are handled by that provider; we receive information needed to administer billing.

Technical and usage information: IP address, device and browser information, requested URLs, timestamps, service interactions, identifiers, and error or security logs. Sources include your browser, hosting infrastructure, and analytics tools when enabled. Authentication credentials and some content may constitute sensitive personal information under applicable law.

We use account, authentication, membership, and workspace information to provide access, collaboration, storage, support, and requested features. Billing records support plans, payments, invoices, and disputes. Where GDPR applies, processing necessary for a contract with you relies on that contract; workspace processing for an organization follows its instructions and applicable processing terms.

Technical information and activity records help secure the service, prevent abuse, troubleshoot, and maintain reliability. Under GDPR, the relevant legitimate interests are protecting users and operating a reliable service, subject to balancing against your rights. Legal obligations may require accounting records and responses to lawful requests.

Optional analytics and marketing require consent where applicable law requires it; otherwise an applicable lawful basis is needed. You may unsubscribe from marketing or object by contacting us. Necessary service and billing messages are separate from optional marketing. GDPR legal bases do not replace Costa Rica's informed-consent requirements where Ley 8968 applies; express consent and valid authorization for transfers are required unless a relevant legal exception applies. This notice alone is not a consent form.

Account and billing details needed for a requested service must be supplied to use that service. Optional profile details, integrations, and marketing participation are not required. Consent can be withdrawn without retroactively affecting prior lawful processing.

The application uses cookies or similar storage for authentication and service functionality. The marketing website stores your cookie choice in local storage. If configured, Google Analytics loads on the marketing site only after acceptance of the cookie banner, and does not load when a recognized Global Privacy Control signal is enabled. Analytics may involve online identifiers, page activity, and device information; it is not anonymous data.

Use Cookie preferences in the website footer and choose Reject to withdraw marketing analytics consent. The page reloads with analytics disabled and attempts to remove this site's Google Analytics cookies. These choices stop future loading; they do not undo processing already performed.

Application preferences are separate from the marketing website. The app uses PostHog and, if configured, Google Analytics for product usage and error counts. Optional app analytics default off in the EU, UK and other EEA countries, and when country information is unavailable. In other recognized countries they default on, subject to applicable law and your choice. We use a hosting-provided country code for this setting; the app does not need precise location permission. An explicit rejection or a recognized Global Privacy Control signal overrides the default.

Open Privacy preferences in the app to allow or turn off optional analytics. The app remembers an explicit choice for up to 180 days in browser storage and a host-only cookie. Choices apply to that browser; check each browser or device you use. If storage is blocked, an explicit choice can apply only to the current page. A change stops future collection but cannot recall data already sent. Essential authentication, billing and security records continue separately.

App analytics use technical device details, generalized page paths and selected product events, and PostHog may associate activity with your user ID. The app does not send names, emails, workspace text, full page URLs or free-form error messages to these analytics services. Session replay and automatic text capture are disabled. Background jobs without a known analytics preference do not export optional product analytics.

We also keep a server-dated record of your explicit Terms of Service acceptance, including the document versions and language shown. This is separate from optional analytics consent. Contact info@okflow.io for privacy requests or assistance.

The marketing website also uses Meta Pixel, provided by Meta, to measure advertising performance and support advertising audiences. It loads only after an explicit advertising choice in the cookie banner, and remains off when Global Privacy Control is enabled. A previous analytics-only acceptance does not enable the pixel. Meta may receive page URLs, referrer information, IP address, browser/device details, cookie identifiers and the fact that a contact or newsletter submission succeeded. We do not include form contents, names or email addresses in our pixel event parameters, and automatic advanced matching and automatic event configuration are disabled. The pixel is not installed in customer workspaces. Separately, when enabled in the application, Meta Conversions API measures verified registrations and completed Paddle purchases after you explicitly allow advertising measurement in Privacy preferences. Analytics permission alone does not allow this. The server may send browser identifiers, user agent, IP address, a hashed account identifier, event time, and purchase amount and currency. It sends fixed registration or billing URLs rather than private workspace URLs, and does not send names, emails or project content. Consent records last up to 180 days, checkout attribution up to 30 days, pending delivery data up to seven days, and delivery receipts up to 400 days to prevent duplicates. Rejecting advertising or a recognized Global Privacy Control signal stops future delivery once the choice reaches the server; data already sent cannot be recalled. Meta cookies may include _fbp and _fbc; their lifetime depends on browser restrictions and Meta’s configuration. Rejecting in Cookie preferences stops future events and attempts to delete these first-party cookies, but cannot undo information already sent to Meta. Meta processes received information under its applicable terms and privacy policy: https://www.facebook.com/privacy/policy/. Advertising preferences are saved separately in this browser under okflow-marketing-consent. You can change them at any time.

When you invoke an AI feature, the relevant input and context are sent through OpenRouter to the selected model provider to generate a response. This may include task or comment text, project context, excerpts from files or pages, and images submitted for analysis. Avoid unnecessary sensitive information and review outputs before use.

When semantic indexing is enabled, creating or updating workspace content and uploading files may also trigger background extraction and indexing for search. That processing can involve Upstash and AI services, including analysis of images or scanned documents. It is separate from explicitly requesting an AI response.

Provider handling and retention depend on the service, model, settings, and applicable terms. We do not promise that every model provider excludes inputs from training or retains no data. Contact us before using AI with information requiring particular contractual protections. AI outputs support users' work; they are not intended to make legally significant decisions about individuals without human review.

Google sign-in is used for authentication and basic profile information, such as name, email, and profile image. This sign-in flow does not itself request Gmail, Google Drive, or Google Calendar access. An optional integration is a separate action governed by the permissions shown for that integration.

Connected integrations exchange authorization tokens and records needed for the selected function, such as project, task, comment, file, and user identifiers. Data sent to another service is also subject to its policies. Disconnecting stops future authorized exchanges but does not necessarily remove records already copied there.

The extension requests browser permissions to work on websites and support feedback capture. Its permissions include access across websites, not just one domain. Capture features can submit page URLs, element context, annotations, and screenshots or tab recordings to the chosen project. Media may include visible personal or confidential information. Restrict access with browser site-access controls and capture only material you are authorized to share. Feedback submitted through a WordPress installation is also workspace content.

Workspace members, administrators, guests, and share-link recipients can access content according to workspace permissions and sharing choices. You and your organization select the intended audience.

Providers used according to feature and configuration include Vercel (hosting and delivery), Supabase (database, authentication, and storage), Paddle or OnvoPay (checkout and billing), SendGrid (email), Upstash (caching, rate limiting, and search), OpenRouter and selected model providers (AI), PostHog (application analytics and diagnostics), and Google Analytics (consented marketing-site analytics).

Hosting receives request and technical data; database and storage services handle account and workspace data; billing services receive billing data; email services receive addresses and message content; search and AI services receive relevant content; analytics services receive the information described above. Some providers, such as a merchant of record or identity provider, may be independent controllers for their own activities rather than our processors.

We may disclose information when required by law, to protect rights and safety, or in a business transfer subject to applicable privacy protections. Contact us about the providers and processing arrangements relevant to your use.

When the website contact form is available, we process your name, email, subject, and message to respond to your request. SendGrid receives the addresses and submitted content to send the request to info@okflow.io and an acknowledgment copy to your email. Cloudflare Turnstile processes browser and device signals for abuse prevention; server verification sends Cloudflare the challenge token and IP address and checks the hostname and action. Turnstile is necessary to use the form, separate from optional analytics. Redis rate limits via Upstash store counters keyed by hashes of the normalized IP and lowercased recipient email, plus a global counter, expiring after one hour or one day. Hashes remain pseudonymous personal information, not anonymous data. We do not send the name, subject, or message to Redis or intentionally log submitted fields or verification tokens in the contact handler. Email provider, mailbox, and hosting retention may differ from these short-lived counters. You can contact us directly by email without using the form.

Paddle acts as an independent controller for its checkout, payments, tax administration, fraud prevention and legal obligations, as described in its privacy notice. When ONVO is used instead, billing information is shared with ONVO for processing that payment and its applicable obligations. Our shared billing site at apps.5e.cr has a separate privacy policy for its website and billing-support activities.

Providers may process information outside your country, including in the United States. Locations depend on provider and configuration, and local laws may differ.

Applicable transfer restrictions require a lawful mechanism and, where required, valid authorization. GDPR mechanisms may include an adequacy decision or contractual safeguards depending on the recipient. We do not represent that every vendor has signed Standard Contractual Clauses or that one mechanism covers all processing. Contact info@okflow.io about relevant locations, safeguards, and how to obtain details. Using the service is not a waiver of transfer protections.

Retention depends on processing purposes, the account or workspace relationship, organization instructions, security needs, disputes, backup cycles, and legal obligations. Information is retained only as long as needed for those purposes and subject to applicable legal limits, rather than a single promised deletion period for every record.

Subscription cancellation, leaving a workspace, account deletion, and organization deletion are different actions. Deleting a personal account does not necessarily delete shared organizational content that others remain entitled to access. Authorship references may need removal or de-identification where appropriate. Contact your administrator or us about a deletion request's scope.

Invoices and transaction records may remain for accounting requirements; limited audit, security, and dispute records may remain where justified. Backups may persist until their applicable cycle expires. Contact us for deletion or export assistance before closing a workspace; access and formats depend on your permissions and the information concerned.

We use access controls, authentication, and infrastructure protections to reduce unauthorized access or loss. Security depends on configuration, permissions, and the systems involved; no transmission, storage method, or service guarantees absolute security.

Keep credentials private, review workspace access and share links, and report suspected incidents to info@okflow.io. We assess incidents and provide notifications to affected people, customers, or authorities as required by applicable law.

Where Costa Rica's Ley 8968 applies, you may request access, rectification or suppression, and exercise rights concerning authorization of data transfers. Applicable requests must be resolved free of charge within five business days of receipt. You may seek protection of your rights from PRODHAB, the Agencia de Protección de Datos de los Habitantes.

Where GDPR applies, rights include access, correction, erasure, restriction, portability, objection, and consent withdrawal, subject to legal conditions. You may complain to a supervisory authority. Requests normally receive a response within one month; permitted extensions of up to two additional months require notice and reasons within the first month. A shorter applicable legal deadline still applies.

Send requests to info@okflow.io. We may seek proportionate identity or authority verification where necessary. Where your organization controls the information, we assist it with your request. If we decline, we explain the reason and available review or complaint options. Request reconsideration at the same address or appeal where applicable law provides that right, without losing regulatory or judicial remedies.

Where the CCPA applies, California residents may request knowledge of and access to information, deletion, correction, an opt-out of sale or sharing for cross-context behavioral advertising, and limits on certain uses of sensitive information. We do not discriminate for exercising these rights.

This policy describes categories, sources, purposes, recipients, and retention criteria. Disclosures include account and workspace data for service delivery, billing data for payments, and technical and usage data for hosting, security, and analytics. Sale or cross-context advertising sharing is not a purpose of the service described here; analytics disclosures may nevertheless require assessment based on settings and contracts. Contact us for opt-out requests or clarification.

Send requests or authorized-agent requests to info@okflow.io; no new account is required. Verification or proof of authority may be necessary for access, correction, or deletion, but not identity verification for a sale/sharing opt-out. Those first three requests generally have a 45-calendar-day response period, extendable by another 45 days with notice where permitted. Opt-outs have a shorter deadline, generally no later than 15 business days. A shorter applicable legal deadline takes precedence.

OkFlow is a work collaboration service, not directed to children. Account holders must be at least 18 and have legal capacity under the Terms of Service. If a child has provided personal information without appropriate authorization, contact info@okflow.io so we can investigate and take appropriate deletion or protective action.

We update this policy when practices or legal requirements change and show the last-updated date above. For material changes, we provide appropriate notice through the website, application, or account email as required by law. If a new use requires consent, a policy update or continued use alone does not provide it.

For privacy questions, rights requests, security reports, or data processing inquiries, contact 5e Creative Labs LLC (OkFlow), at info@okflow.io. A Wyoming, United States limited liability company operating from Costa Rica. Identify the relevant account or workspace without sending passwords or full payment credentials.