Data processing terms

Last updated 1 November 2026

These terms form part of the agreement between your organisation ("customer", the controller) and Far Flow Limited ("we", the processor) for personal data processed in Farflow workspaces, as required by Article 28 GDPR.

What we process

• Subject matter and duration: hosting and processing workspace content for as long as the customer uses Farflow.
• Nature and purpose: storing, showing, searching, notifying about and, if enabled, processing with AI agents the content the customer's users put into Farflow.
• Types of data: names, email addresses and any personal data in issues, documents, comments and files.
• Data subjects: the customer's users and people mentioned in workspace content.

Our commitments

• We process personal data only on the customer's documented instructions, which are these terms and the use of Farflow's features.
• People who can access the data are bound to confidentiality.
• We take the security measures below, and keep them current.
• We use the subprocessors listed on the subprocessor page, under contracts with the same obligations, and give 30 days' notice of changes.
• We help the customer answer requests from data subjects; Farflow's export and deletion features cover most of them.
• We tell the customer without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting their data.
• At the end of the service we delete the customer's data within 30 days, after the customer has had the chance to export it.
• We make available the information needed to show compliance, and allow audits by the customer or an auditor it appoints, with reasonable notice.

Security measures

• Data stored in the EU (Frankfurt), encrypted at rest and in transit (TLS).
• Row-level access rules in the database: every query is limited to the workspaces a person belongs to, and to their role.
• Optional two-step sign-in, enforced by the database; API keys stored only as hashes; webhook deliveries signed.
• Daily backups (from the paid plan of our database provider onwards), least-privilege access for staff, and logged administrative actions.

Transfers

Where a subprocessor processes data outside the EU or EEA, the transfer relies on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

Back to farflow.io · Privacy · Terms · Subprocessors · Data processing