Data Processing Agreement
Last Updated: February 2, 2026
1. Introduction
This Data Processing Agreement ("DPA") forms part of the Terms of Service between FlowDrafts and the Customer. It reflects the parties' agreement with regard to the processing of Personal Data.
2. Local-First Distinction
Important Notice: FlowDrafts is a "Local-First" application. By design, the Customer's email recipient data, campaign lists, and message content ("Campaign Data") are processed entirely on the Customer's local hardware. FlowDrafts does not access, transmit, or store this Campaign Data on its servers. Consequently, FlowDrafts is not a Processor of Campaign Data under this DPA.
3. Scope of Processing
FlowDrafts processes "Account Data" which includes:
- Administrator name and email address
- Company name and billing information
- One-way hardware hashes for license enforcement
- Metadata about device activation status
4. Technical and Organizational Measures
FlowDrafts shall implement and maintain appropriate technical and organizational security measures to protect Personal Data, including:
- Encryption of Account Data at rest and in transit
- Regular security patching of licensing proxy servers
- Strict access controls for administrative personnel
- Secure hardware-bound license tokenization
- Digital Code Signing of all software artifacts to ensure integrity
5. Sub-processors
Customer provides general authorization for FlowDrafts to engage the following sub-processors for the purpose of providing the Service:
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database & Auth Hosting | EU (North) |
| Vercel Inc. | Edge Functions & Hosting | USA |
| Stripe Inc. | Payment Processing | USA |
| Resend Inc. | Email Delivery & Automation | USA |
| Google LLC | OAuth Authentication | USA |
| Microsoft Corp. | OAuth Authentication | USA |
6. Contact Us
For inquiries regarding this DPA or our data practices, please contact us:
- Email: support@flowdrafts.com
- Address: 1 Pan Peninsula Square, London, E14 9HD, UK
7. Succession
The obligations set forth in this DPA shall be binding upon the parties and their respective successors and permitted assigns.