Privacy policy

1. Who we are

PlugFlow is operated by Sedulous Web, a business registered in India. For personal data of Customers and their team members we act as the data controller (a "Data Fiduciary" under the DPDP Act). For testimonial content that Customers collect through PlugFlow we act as a data processor on the Customer's instructions; the Customer is the controller of that data and is responsible for having a lawful basis to collect and publish it.

Contact for privacy matters, including data subject requests: [email protected].

2. Data we collect

Customers and team members

• Account details: name, email address, password hash, avatar (optional), Google account identifier if you sign in with Google.
• Workspace details: workspace name, website, logo, brand colour, billing plan and invoices.
• Billing information processed by Razorpay: we receive payment status, the last four digits of a card or the UPI handle, and invoice data; we never store full card numbers.
• Usage and security data: IP address, browser user-agent, sign-in timestamps, audit log entries for actions taken in a workspace.
• Support correspondence.

Authors (people who submit a testimonial)

• Name, email address (if the Customer's form requests it), job title, company, profile URL, avatar or image URLs and any video link you provide.
• The testimonial content, star rating and answers to any custom questions.
• Consent record: the exact consent text shown to you, the timestamp of your consent and the IP address from which the form was submitted.
• Technical metadata: browser user-agent, referring page, and an order reference if you arrived from a review-request link.

Visitors to websites that embed a wall

The embed script records aggregate view and click counts for the wall, the page hostname and path. It does not set cookies, does not fingerprint devices and does not store IP addresses.

3. Why we use it and our legal bases

• Providing the service (contract): creating accounts, storing and displaying testimonials, sending review requests on the Customer's behalf, processing payments.
• Consent: publishing an Author's testimonial publicly; sending marketing email to Customers who opted in (you can withdraw at any time from the email footer or by writing to us).
• Legitimate interests: securing the platform, preventing abuse and spam, producing anonymised usage statistics, improving the product.
• Legal obligations: tax and accounting records, responding to lawful requests.

4. Sub-processors

We use the following service providers to run PlugFlow. Each is bound by a data processing agreement and appropriate transfer safeguards (Standard Contractual Clauses where data leaves India or the EEA).

5. Retention

• Account and workspace data: for the life of the account and 30 days after deletion, after which it is permanently erased from live systems; encrypted backups roll off within 35 days.
• Testimonials: until the Customer deletes them. Deleted testimonials sit in a recoverable trash for 30 days, then are erased.
• Consent records: retained alongside the testimonial so that permission can be evidenced, and erased with it.
• Audit logs: 12 months.
• Billing records and invoices: 8 years, as required by Indian tax law.
• Widget analytics: aggregated daily counts, retained for 24 months; no personal data.

6. Your rights

Depending on where you live you may have the right to access, correct, delete or export your personal data, to restrict or object to processing, to withdraw consent, and to lodge a complaint with a supervisory authority (in India, the Data Protection Board; in the EU, your national authority).

Customers can export all workspace data and delete their workspace or account from Settings → Danger zone. Authors who want a testimonial removed or anonymised should contact the website owner who collected it, or write to us at [email protected] and we will forward the request and assist. We respond to data subject requests within 30 days.

7. Security

Data is encrypted in transit (TLS 1.2+) and at rest. Passwords are hashed with Argon2. Access tokens are short-lived and refresh tokens can be revoked from the dashboard. Plugin licence keys and Shopify access tokens are stored encrypted. Access to production systems is limited to named staff with multi-factor authentication. We will notify affected Customers and, where required, the relevant authority without undue delay if we become aware of a personal data breach.

8. Cookies

The dashboard uses strictly necessary storage for sign-in sessions and a short-lived state cookie during Google and Shopify OAuth. Hosted forms, hosted walls and the embed script set no cookies. We do not use advertising trackers.

9. Children

PlugFlow is not directed at children under 18 and we do not knowingly collect their data. If you believe a child has submitted data to us, contact us and we will delete it.

10. Changes

We will post any changes to this policy on this page and, for material changes, notify Customers by email at least 14 days before they take effect.