Privacy policy

Last updated 1 November 2026

This policy explains what personal data Farflow collects, why, and what you can do about it. Farflow is operated by Far Flow Limited, [registered address to be added] ("we"). Questions go to hello@farflow.io.

The website and early access

When you join early access on farflow.io we store your email address, the team name and team size you enter, your browser's language, the time, and a salted hash of your IP address (used only to stop repeated sign-ups and never stored as the address itself). We send one email asking you to confirm, and once you confirm, emails about your early access. The legal basis is your consent (GDPR Art. 6(1)(a)); you can withdraw it at any time by writing to us, and we then delete the entry.

The website sets no cookies and uses no analytics or advertising trackers.

Using Farflow

When your organisation uses Farflow, it decides what goes into its workspace: issues, documents, files and comments. For that content we act as a processor on your organisation's behalf, under the data processing terms. For your account we are the controller and process:

• your name, email address, profile picture and language, to give you an account (contract, Art. 6(1)(b));
• sign-in records and security events, to keep accounts safe (legitimate interest, Art. 6(1)(f));
• notification settings and the notifications themselves, to tell you about work you follow (contract);
• error reports without the content of your work, to fix problems (legitimate interest).

AI agents

If your workspace turns on AI agents, the issue an agent is given and the documents it searches are sent to Anthropic to produce the agent's answer. Anthropic does not use this data to train its models. Agents are off unless your workspace enables them.

Where data is stored

Workspace data, files and accounts are stored by Supabase in Frankfurt, Germany. The subprocessor list names every company involved and where it processes data. Where a subprocessor is outside the EU, transfers rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

How long we keep it

• Early-access entries: until you withdraw or 12 months after early access ends.
• Accounts: while the account exists; deleting your account in Settings removes it.
• Workspace content: until the workspace is deleted, then removed from backups within 30 days.
• Webhook delivery logs: 14 days. Rate-limit counters: one hour.

Your rights

You can ask for access to your data, correction, deletion, restriction, portability (Farflow exports a workspace as JSON), and object to processing based on legitimate interest. Write to hello@farflow.io; we answer within one month. You can also complain to your data protection authority.

Back to farflow.io · Privacy · Terms · Subprocessors · Data processing