Privacy Policy
In short: this Policy covers information AmazFlow handles as a business — website visitors, sales enquiries, support conversations, and product analytics on our public site. It does not govern the data your organisation runs through the Service; that is Customer Content, and the Data Processing Agreement governs it.
We do not sell personal information, and we do not use your data to train AI models.
Scope, and what this does not cover
This Privacy Policy explains how AmazFlow, LLC, a Georgia limited liability company (“AmazFlow,” “we,” “us”), collects, uses, discloses, and protects information when you visit our website, communicate with us, or when your organisation uses the AmazFlow Service under a customer agreement.
Information we collect
Information you provide directly: contact information (name, work email, company, role) submitted through our website forms, including the workflow-assessment form; communications you send us (sales, support, security inquiries); and account and billing information if you become a customer.
Information collected automatically: standard web log data (IP address, browser type, pages visited, referring URL); the product-analytics and session-replay data described in section 3; and cookies and similar technologies as described in our Cookie Policy.
Information we do not intentionally collect: we do not knowingly collect personal information from children under 16. AmazFlow is a business-to-business service not directed to children.
Analytics and session replay
On our public website we use Amplitude for product analytics and session replay, to understand how the marketing pages are used and where they are confusing. This captures page views, interactions, and a masked replay of on-page sessions, along with technical information such as IP address, browser, and device type.
This runs on the public and sign-in pages only. It is switched off inside the customer console and the operator console, so it never records the data you or your team work with inside AmazFlow. Amplitude is listed on our Subprocessors page, and the mechanics and your choices are in the Cookie Policy. We use this analytics as a first party to improve our own site; we do not sell it or use it for cross-context behavioural advertising.
How we use information
We use information to respond to inquiries and provide requested information about the Service; administer customer accounts, billing, and support; operate, secure, and improve our website and Service; send administrative communications about the Service (not marketing, unless you have opted in); and comply with legal obligations and enforce our agreements.
We do not use your information to train, fine-tune, or improve AI models, and we do not permit our providers to do so. We do not sell personal information, and we do not share personal information for cross-context behavioural advertising, as those terms are defined under the CCPA/CPRA.
Disclosure of information
We may disclose information to service providers who support our infrastructure, communications, analytics, security, and business operations, listed on our Subprocessors page; to professional advisors as necessary; to law enforcement or regulators where required by law or valid legal process; and to a successor entity in a merger, acquisition, or asset sale, subject to this Policy or a materially equivalent one.
Your privacy rights
Depending on your location, you may have rights to know what personal information we hold and how it is used; to access or receive a copy of it; to correct it; to delete it, subject to legal exceptions; to opt out of the sale or sharing of personal information (which, as stated, we do not do); and not to be discriminated against for exercising these rights.
California residents may exercise CCPA/CPRA rights by emailing privacy@amazflow.com; we verify a request using information reasonably available before acting, and you may use an authorised agent. Other US state residents (for example Virginia, Colorado, Connecticut, Utah, or a similarly enacted state law) may have comparable rights, which we honour consistent with the applicable law. EU, UK, and Swiss residents: if applicable data-protection law grants you rights of access, rectification, erasure, restriction, portability, or objection, contact privacy@amazflow.com. Our website and marketing are not currently directed at those regions; if that changes, this Policy will be updated to a complete Article 13/14 notice reviewed by qualified counsel.
We respond within the time required by applicable law — generally 45 days for California requests, extendable once with notice.
Retention schedule
We keep personal information only as long as needed for the purpose it was collected, then delete it or de-identify it. The periods below are our current schedule. Where a legal obligation (such as tax law) requires longer, that governs.
| Category | Retention |
|---|---|
| Website enquiry and contact-form data | Duration of an active sales or business relationship, plus up to 24 months, then deleted. |
| Customer account data | For the term of the customer agreement, plus 90 days after termination, then deleted. |
| Customer Content (workflow and execution data) | For the term. On termination, deleted or returned within 30 days of request, per the DPA. See the note below on backups. |
| Support conversations | Duration of the relationship, plus up to 24 months. |
| Website analytics and session replay | Retained in Amplitude for up to 24 months from collection, then aged out. |
| Security and audit logs | Up to 12 months, retained separately from the application data store. |
| Billing and tax records | A minimum of 7 years, as required by tax law. |
Evidence Records. Workflow execution records, verification results, approval history, and related Service audit history for a customer’s workflows (“Evidence Records”) are Customer Content. How long AmazFlow retains them for that customer is set by the customer agreement (MSA and Order Form) and the Data Processing Agreement. This table’s “Security and audit logs” row describes AmazFlow’s platform security logging retained separately from the application data store; it is not a substitute for the Evidence Retention terms in a signed Order Form / MSA.
Backups. Backups follow their own cycle and are purged within 35 days. Deleting a record from the live Service does not immediately remove it from an existing backup; it ages out with that backup within this window.
Security
We apply administrative, technical, and organisational safeguards designed to protect personal information, consistent with our Security page. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
International data transfers
AmazFlow is based in the United States, and information we collect is generally processed in the United States. Where we engage a service provider located outside the United States (see our Subprocessors page), we take reasonable steps to ensure an adequate level of protection consistent with applicable law.
Changes to this policy
We may update this Policy as our practices, the Service, and legal requirements evolve. We post the updated Policy with a new “Last updated” date and, for material changes, provide additional notice where required by law.
Contact
Questions or requests regarding this Policy or your personal information: privacy@amazflow.com.