Who we are
Cadrix Flow (“Cadrix”, “we”, “us”) operates the Cadrix service at app.cadrixflow.com (the “service”) and the website at cadrixflow.com (the “website”). Our registered address is 115 FF, Divine Mega 2, Ghazi Road, Lahore, Pakistan.
For your account, billing and website data, and for the technical data we generate to run and secure the service, we are the controller. For the content a customer puts into its workspace (workflows, documents, chat messages and the data those handle), the customer decides what is processed and why, and we process it on the customer’s behalf as a processor. If you need a data processing agreement, write to hello@cadrixflow.com.
This policy applies to the service and the website. It does not cover the AI model providers or other third-party tools that customers connect to their own workflows; see AI model providers and automated processing.
What data we collect
Account data
Your name, email address and password, your organisation and workspace names, and your role. Passwords are stored only as salted one-way hashes. If your organisation signs in through single sign-on, we receive the profile details that provider shares.
Workspace content
What you create or upload: workflows, stored credentials for third-party services (kept encrypted), knowledge documents, variables, chat messages and the run history and traces that record what your workflows did. This content can include personal data about your own staff or customers.
Usage and log data
IP address, browser and device details, request and error logs, sign-in activity and usage counts against your plan limits. We use these to run, protect and size the service.
Billing data
Your plan, subscription status and a customer reference. Payments for paid plans are handled by Polar, which collects your payment details, billing address and tax information. We do not see or store card numbers.
Support and enquiries
Messages you send to hello@cadrixflow.com or through the contact page, including your email address and whatever you tell us.
Cookies and similar technologies
The service sets a small number of essential cookies and stores some preferences in your browser. The website sets none. Details are in the Cookie Policy.
Why we use it and our legal bases
Where the GDPR or a similar law applies, we rely on the following legal bases.
| Purpose | Data | Legal basis |
|---|---|---|
| Create and run your account and workspace, deliver the features you use | Account data, workspace content, usage data | Performance of our contract with you |
| Send service emails: address verification, password reset, invitations, account notices | Account data | Performance of our contract |
| Manage plans, subscriptions and usage limits | Account, billing and usage data | Performance of our contract |
| Secure the service, prevent abuse and fraud, rate-limit, investigate incidents | Technical and log data, account data | Our legitimate interests in a secure service |
| Maintain and improve the service, plan capacity, fix errors | Usage and log data | Our legitimate interests |
| Answer enquiries and support requests | Support messages, account data | Legitimate interests, or steps before a contract |
| Meet tax, accounting and other legal duties; respond to lawful requests | Billing and account data | Legal obligation |
| Understand how the website is used (Google Analytics, only if you accept analytics in the cookie banner) | Pages visited, clicks on our buttons, approximate location from an anonymised IP address, browser and device type, cookie identifiers | Your consent, which you can withdraw at any time from “Cookie settings” in the footer |
| Any optional processing we may add in future | As described at the time | Your consent, which you can withdraw at any time |
Where we act as a processor for a customer’s workspace content, we process it only on that customer’s documented instructions, which are the use of the service itself.
We do not sell personal data and we do not use workspace content to advertise to you.
AI model providers and automated processing
Cadrix does not supply an AI model. Each customer chooses its own model providers and supplies its own API keys. When a workflow runs a step that calls a model or another third-party tool, the content of that step is sent to the provider the customer configured, under the customer’s own account and terms with that provider. We do not train AI models on customer content, and those providers have their own privacy practices that you should review.
Output generated by AI models can be inaccurate or incomplete. Cadrix does not use AI output to make decisions about you that have legal or similarly significant effects. If a customer builds workflows that do, the customer is responsible for meeting the legal requirements that apply, including any right to human review.
International transfers
Our primary hosting is in Germany. Some of our providers, including Polar and Microsoft, may process data in other countries, including outside the European Economic Area and the United Arab Emirates. AI model providers chosen by customers may do the same. Where personal data is transferred to a country that does not have an equivalent level of protection, we rely on appropriate safeguards such as standard contractual clauses or an adequacy decision, as applicable, and we ask for further information about them from the relevant provider on request. You can contact us for details at hello@cadrixflow.com.
How long we keep data
- Account and workspace data is kept while your account is active. Run history and logs are kept according to the limits of your plan.
- After you close your account, we delete or anonymise your account and workspace data within a reasonable period, except for data we must keep for legal, tax, security or dispute purposes.
- Backups. Nightly database backups are kept for 14 days, so deleted data can remain in a backup until that backup expires.
- Billing records are kept as long as tax and accounting law requires, by us and by Polar.
- Support emails are kept for as long as needed to deal with your request and any follow-up.
To ask for deletion earlier, or to export your data, write to hello@cadrixflow.com.
Security
We use technical and organisational measures appropriate to the risk, including encrypted connections, hashed passwords, encrypted storage of the credentials you save, access controls between organisations and regular backups. We describe our current practices, and their limits, on the Security page. No online service is perfectly secure and we cannot guarantee absolute security. If we become aware of a personal data breach we will notify the people and authorities we are required to notify, as the law requires.
Your rights
Depending on where you live, including under the GDPR, the UK GDPR, the UAE Personal Data Protection Law and similar laws, you may have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data deleted;
- receive your data in a portable format;
- object to processing based on our legitimate interests;
- ask us to restrict processing;
- withdraw consent at any time, where we rely on it;
- complain to a data protection supervisory authority, for example in your country of residence or place of work.
To exercise a right, write to hello@cadrixflow.com. We may need to verify your identity first. If you are an end user of one of our customers’ workspaces, please contact that customer first, because it controls that data and we will pass on or support its response as appropriate.
Children
Cadrix is a business service and is not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact hello@cadrixflow.com and we will delete it.
Changes to this policy
We may update this policy as the service or the law changes. We will publish the new version here and update the “Last updated” date. For material changes we will give notice, for example by email or in the service, before they take effect where the law requires it.
Contact
Questions or requests about privacy: hello@cadrixflow.com, or write to Cadrix Flow, 115 FF, Divine Mega 2, Ghazi Road, Lahore, Pakistan.