Privacy Policy

Definitions

1. General

1.1 This Privacy Statement describes how Artomation B.V. ("we", "us", "our", or "Data Controller") collects, processes, and protects personal data when you use the FlowRunner Outlook Add-in and associated services.

1.2 We are committed to protecting your privacy. FlowRunner is hosted on Microsoft Azure (West Europe region) and operates as a secure integration layer between Microsoft Outlook and Salesforce. By using the Add-in, you agree to the collection and processing of information in accordance with this policy.

1.3 The personal data processed by the Data Controller includes: name, email address, Microsoft authentication identifiers, Salesforce authentication tokens, and organizational metadata as detailed in Section 2 below.

2. Collection and Processing of Personal Data

2.1 The Data Controller collects personal data from a User when the User has transmitted such data to the Data Controller through:

• Installing and authenticating the FlowRunner Add-in within Microsoft Outlook.
• Connecting one or more Salesforce organizations to their FlowRunner account.
• Visiting the FlowRunner website and submitting contact or inquiry forms.

2.2 The Data Controller processes the following categories of personal data:

2.2.1 Account and Authentication Data

When you create a FlowRunner account, we collect and store:

• Full Name: Retrieved from your Microsoft 365 profile to personalize the Add-in interface.
• Email Address: Retrieved from your Microsoft 365 profile for account identification and support communications.
• Microsoft Entra ID Object ID (OID): A unique identifier for your Microsoft account, used for authentication and tenant-level access control.
• Microsoft Tenant ID: Your organization's unique Microsoft 365 identifier, used for multi-tenant data isolation.

2.2.2 Outlook Email Context Data

When you open the FlowRunner Add-in within Outlook, we process the following data from the currently active email message:

• Sender Email Address: Used to search your connected Salesforce organizations for matching Contact or Lead records.
• Recipient Email Addresses: Used to identify relevant Salesforce records and pre-populate Flow input variables.
• Email Subject Line: May be accessed to pre-fill Flow fields if configured by your Salesforce administrator.

2.2.3 Salesforce Integration Data

To enable Salesforce functionality, we store:

• Salesforce OAuth Tokens: Access and refresh tokens obtained through the Salesforce OAuth 2.0 authorization flow. These tokens are encrypted at rest and are never logged or exposed in plain text.
• Salesforce Organization ID: The unique 15-character identifier for each Salesforce org you connect, used to route API requests.
• Salesforce Instance URL: The base URL for your Salesforce organization (e.g., https://example.my.salesforce.com).
• Flow Metadata: Names, API names, descriptions, and configuration settings for Salesforce Flows that administrators have enabled for use in FlowRunner.
• User Preferences: Settings such as pinned Flows, default Salesforce organization, and UI preferences.

2.2.4 Usage and Diagnostic Data

We collect limited technical data to ensure service reliability and diagnose issues:

• Authentication Events: Login timestamps and authentication method used (SSO or fallback dialog).
• Error Logs: Application errors and stack traces (excluding any personal data or authentication tokens).
• API Request Metadata: Timestamps, HTTP status codes, and request durations for performance monitoring (URLs are sanitized to remove any query parameters containing tokens or sensitive data).

2.3 The Data Controller uses these personal data exclusively for the purposes for which the User provided them:

• To authenticate Users and maintain secure access to the Add-in.
• To facilitate the execution of Salesforce Flows within the Outlook interface.
• To store User preferences and configuration settings.
• To provide technical support and respond to User inquiries.
• To improve the functionality, performance, and reliability of the Service.

2.4 We do not use your personal data for marketing purposes. We do not send promotional emails, newsletters, or advertising communications.

3. Transfer to Third Parties

3.1 The Data Controller will not disclose personal data to third parties except as described in this section.

3.2 We engage the following sub-processors to provide the Service:

3.3 The Data Controller has entered into Data Processing Agreements with Microsoft Azure that ensure compliance with the General Data Protection Regulation (GDPR) and provide adequate safeguards for data transfers.

3.4 Salesforce processes data solely on your explicit instruction when you choose to execute a Flow. We act as a technical intermediary and do not control what data Salesforce processes or stores.

3.5 The Data Controller may disclose personal data if required by law or legal process, such as in response to a valid court order or government request.

4. International Data Transfers

4.1 All personal data is stored in Microsoft Azure's West Europe data center region, located within the European Union.

4.2 When you connect a Salesforce organization, data may be transferred to Salesforce's data centers based on your Salesforce instance location. The Data Controller does not control the geographic location of your Salesforce data.

4.3 For Users located outside the European Economic Area (EEA), the Data Controller relies on Microsoft Azure's compliance with the EU-U.S. Data Privacy Framework and Standard Contractual Clauses approved by the European Commission to ensure adequate protection of personal data.

5. Cookies and Tracking Technologies

5.1 The FlowRunner Add-in uses cookies for essential authentication purposes only:

• Session Cookies: Temporary cookies to maintain your authenticated session during the Salesforce OAuth authorization flow. These cookies are deleted when you close your browser.

5.2 The FlowRunner marketing website (flow-runner.com) uses Google Analytics to understand website traffic and improve user experience. Google Analytics uses cookies to track:

• Page views and navigation patterns
• Geographic location (country/city level)
• Device and browser type
• Traffic sources (e.g., search engines, referral sites)

5.3 You can disable cookies through your browser settings. Disabling cookies may prevent the Add-in from functioning properly, as authentication requires session cookies.

5.4 We do not use cookies for advertising, cross-site tracking, or behavioral profiling.

6. Security Measures

6.1 The Data Controller has implemented appropriate technical and organizational measures to protect personal data against loss, unauthorized access, and unlawful processing:

6.1.1 Encryption

• Encryption in Transit: All data transmitted between your device, our servers, Microsoft services, and Salesforce is encrypted using TLS 1.2 or higher (HTTPS).
• Encryption at Rest: Salesforce OAuth tokens are encrypted at rest with AES-256 encryption. The encryption keys are managed securely and rotated periodically.

6.1.2 Access Control and Authentication

• Microsoft Single Sign-On (SSO): User authentication is handled exclusively through Microsoft Entra ID, leveraging your organization's existing identity and access management policies.
• Role-Based Access Control (RBAC): Internal administrative access to production systems is restricted to authorized personnel only.
• Database Row-Level Security (RLS): PostgreSQL Row-Level Security policies enforce strict tenant isolation, ensuring that queries automatically filter data to the authenticated user's organization.

6.1.3 Data Isolation

• Multi-Tenant Architecture: Each organization's data is logically isolated using tenant-scoped database queries. Users can only access data belonging to their own Microsoft 365 tenant.
• Session Variables: Database session variables enforce tenant context for every database transaction, preventing cross-tenant data leakage.

6.1.4 Logging and Monitoring

• Sensitive Data Redaction: Application logs automatically redact access tokens, refresh tokens, and authentication codes before writing to log files.
• Security Monitoring: We monitor for unusual authentication patterns, failed login attempts, and potential security incidents.

6.2 While we implement industry-standard security measures, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security but commit to promptly addressing any identified vulnerabilities.

7. Data Retention and Deletion

7.1 The Data Controller retains personal data only for as long as necessary to provide the Service and comply with legal obligations.

7.2 Upon account deletion, all personal data is immediately and permanently deleted from our systems, including:

• User account information (name, email, Microsoft identifiers)
• Salesforce connection data (OAuth tokens, organization IDs)
• User preferences and configuration settings
• Flow metadata and usage history

7.3 Users can delete their account at any time through the FlowRunner Admin page at /admin. Deletion is processed immediately and cannot be undone.

7.4 Anonymized usage statistics (stripped of all personally identifiable information) may be retained for analytical purposes to improve the Service.

7.5 We do not retain backups of deleted user data beyond standard database replication lag (typically less than 24 hours).

8. Your Rights Under GDPR

8.1 If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights regarding your personal data:

8.1.1 Right of Access

You have the right to request confirmation of whether we process your personal data and obtain a copy of such data.

8.1.2 Right to Rectification

You have the right to request correction of inaccurate or incomplete personal data.

8.1.3 Right to Erasure ("Right to be Forgotten")

You have the right to request deletion of your personal data. You can exercise this right immediately through the FlowRunner Admin page (/admin) or by contacting our Data Protection Officer.

8.1.4 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format (JSON).

8.1.5 Right to Object

You have the right to object to processing of your personal data for specific purposes. Note that objecting may prevent us from providing the Service.

8.1.6 Right to Restriction of Processing

You have the right to request restriction of processing under certain circumstances.

8.2 To exercise any of these rights, please contact our Data Protection Officer:

8.3 You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data violates applicable data protection law. In the Netherlands, the supervisory authority is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

9. Children's Privacy

9.1 The FlowRunner Add-in is intended for use by business professionals within enterprise organizations. We do not knowingly collect personal data from individuals under the age of 16.

9.2 If we become aware that we have collected personal data from a child under 16 without verified parental consent, we will take steps to delete that information immediately. If you believe we have collected data from a child, please contact us at info@artomation.nl.

10. Legal Basis for Processing (GDPR)

10.1 We process personal data on the following legal bases:

• Performance of a Contract (GDPR Article 6(1)(b)): Processing is necessary to provide the FlowRunner Service as outlined in our Terms of Service.
• Legitimate Interest (GDPR Article 6(1)(f)): We have a legitimate interest in improving the Service, preventing fraud, and ensuring security.
• Consent (GDPR Article 6(1)(a)): For optional features such as website analytics via Google Analytics, we rely on your consent, which you may withdraw at any time.

11. Changes to this Privacy Statement

11.1 The Data Controller reserves the right to modify this Privacy Statement at any time to reflect changes in our practices, legal requirements, or Service functionality.

11.2 Any modifications will be announced on this page. We will update the "Last Updated" date at the top of this document.

11.3 For material changes that significantly affect your rights, we will provide prominent notice within the Add-in or via email to your registered email address.

12. Contact Information

12.1 If you have any questions about this Privacy Statement, wish to exercise your data protection rights, or have concerns about how we handle your personal data, please contact:

This Privacy Statement was last updated on November 20, 2025 and is effective immediately for all users of the FlowRunner Add-in and website.