Privacy Statement
v2
1. Who We Are
Techbox Technology LLC ("Techbox", "we"), Commercial Registration No. [ ], [address], Doha, Qatar, operates FlowDesk (flowdeskme.com), a cloud workflow, approvals and audit-trail platform for businesses. Contact for privacy matters: [privacy email].
We play two roles:
• Processor for the data your company puts into FlowDesk ("Customer Content"). Your company (the Customer) is the controller and decides why and how that data is used. We process it only on its instructions to provide the Service.
• Controller for our own account, billing, support, website and security-log data described below.
If you are an employee of a company that uses FlowDesk and you want to exercise your rights over data in your company's workflows, please contact your employer first; we will help it respond.
2. What We Collect
• Account and profile: name, work email, phone, job title, language, company name, role and permissions. Source: you or your Company Admin.
• Customer Content: forms, submissions, attachments, comments, approval decisions, delegation settings, workflow definitions, audit-trail records, AI Employee inputs and outputs. Source: your company and its users.
• Technical and security data: IP address, browser and device type, log-in and activity timestamps, error logs, audit and admin-activity logs. Source: collected automatically.
• Billing: company billing name and address, tax or commercial registration details, order and invoice records, payment status. Card details are entered on our payment provider's page and are not received or stored by us. Source: you and our payment provider.
• Communications: messages to support, onboarding or workshop material, contact-form entries. Source: you.
• Website: cookies and basic usage data described in Section 11. Source: collected automatically.
The Service is not designed for "special nature" personal data under the PDPPL (for example health, race, religion, marital status, criminal records, or data about children). Customers must not upload such data unless they hold every required approval and have told us beforehand.
3. Why We Use Data
• To provide the Service: create accounts, run workflows, route approvals, send notifications and the daily digest, keep the audit trail, apply subscription and licence rules.
• To secure and maintain the Service: prevent abuse, detect incidents, keep backups, fix errors, enforce our Terms.
• To bill and comply with law: issue invoices, keep accounting records, respond to lawful requests from authorities.
• To support you: answer questions, run onboarding or training you ordered.
• To communicate: service messages (always sent) and, where you agree or the law allows, news about the product. You can unsubscribe from marketing at any time.
Our bases are your or your company's consent, performance of the contract, our legitimate business interests in running a secure service, and legal obligations.
We do not sell personal data, do not use Customer Content for advertising, and do not use it to train AI models.
4. Who Can See Your Data
As a matter of policy, we do not view Customer Content. Access happens only when (a) your company asks for support or an onboarding service and authorises it, (b) it is necessary to maintain, secure, back up or restore the Service, (c) we must investigate abuse or a security incident, or (d) the law or a competent authority requires it.
To be transparent: FlowDesk is hosted on infrastructure that we operate, so technically authorised operators can reach the systems. We limit that access to named personnel, and platform administrators handle account-level actions such as suspending a company, managing users and resetting passwords. Within your company, who sees what is controlled by your Company Admin through roles and permissions.
5. Who We Share Data With (Sub-processors)
We share data only with providers that help us run the Service, under their own terms and data-protection commitments:
• Contabo: server hosting for the application and database. Data: all Customer Content and account data. Location: Germany.
• Cloudflare: DNS and network services. Data: domain and traffic metadata. Location: global.
• Mailgun: delivery of notification and system emails. Data: recipient email, name, email content. Location: United States.
• Anthropic: AI Employee processing, only when a Customer uses that feature. Data: the input fields the Customer defines for that step, and the output. Location: United States.
• SkipCash: online payments. Data: billing contact, order amount and status. Location: Qatar.
• Microsoft OneDrive: encrypted off-server backup copies. Data: backup files. Location: United States
Customers may connect their own third-party systems through Integrations; data sent there is governed by the Customer's choice and that system's terms.
We may also disclose data where required by Qatari law, a court or a competent authority, or to protect rights, safety and security. If our business is sold or reorganised, data may transfer to the successor under the same protections.
6. International Transfers
Some of the providers above process data outside Qatar. The PDPPL allows such transfers when appropriate safeguards are applied and the transfer does not cause serious harm to the data. We choose providers that apply security and confidentiality commitments, send them only what each purpose needs, and by using the Service the Customer agrees to these transfers. You can contact us for details of safeguards for a specific provider.
7. How Long We Keep Data
• Customer Content: kept while the subscription is active. After termination the Company Admin can export for 30 days, then we delete it from live systems.
• Backups: rolling 30 days, after which older copies are deleted. Data deleted from live systems disappears from backups within that cycle.
• Account and profile data: for the life of the account and up to 12 months after, unless you ask for earlier deletion and the law allows.
• Invoices and billing records: for the period accounting and tax laws require.
• Security and activity logs: 12 months, or longer where needed for an investigation or legal claim.
• Unpaid trial accounts: deleted after 30 days of inactivity, following notice.
• Support messages: 12 months.
Company deletion removes that company's uploaded files from our servers. Invoices that must be kept are retained with the data needed for the record.
8. Security
We apply reasonable technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), encryption of stored integration credentials, role-based access control, separate production and test environments, audit and admin-activity logging, daily database backups with off-server copies, and restricted administrative access.
No system is completely secure, and we cannot promise absolute protection. Please protect your passwords, use work email addresses, remove users who leave, and assign roles carefully.
9. If a Security Incident Happens
If we become aware of a security breach affecting Customer Content, we will notify the affected company's Company Admin without undue delay and in line with legal requirements (target: within 72 hours of becoming aware), with what we know and recommended steps. The company, as controller, decides on notifying the competent authority (the National Cyber Security Agency or its successor) and affected individuals, and we will cooperate. For data we control as controller, we will notify the authority and individuals where the PDPPL requires it.
10. Your Rights
Under the PDPPL you may, subject to its conditions: be informed about how your data is processed; access your data; ask for correction; ask for erasure or restriction; object to processing or withdraw consent at any time (without affecting past lawful processing); and ask to be told of a breach that may seriously harm you. To exercise a right, email info@techbox.website with enough detail to identify you. We will answer within 30 days. For data held on behalf of your employer we will pass the request to them or help them respond. You also have the right to complain to the competent authority in Qatar (the National Cyber Security Agency or its successor).
11. Cookies and Website
The FlowDesk site and app use essential cookies for log-in sessions, security and language preference. You can block cookies in your browser, but the Service may not work properly.
12. Children
FlowDesk is a business service for adults aged 18 or over. We do not knowingly collect children's data. If you think a child's data was provided, contact us and we will delete it.
13. Changes to this Statement
We may update this Statement. We will notify the Company Admin by email and in the platform when changes are material; the version and date are shown at the top. Continued use after the effective date means acceptance, as the Terms describe.
14. Contact
Techbox Technology LLC, Office No. 115-116Register04, Floor No. 1, Regus Business Centre, No. 67, Doha, Qatar, Legal: info@techbox.website · Support: info@techbox.website · Phone: +974 30 993 554