Privacy policy

1. Who we are

PlugFlow is a software service operated by Sedulous Web, a sole proprietorship of Madhab Chandra Sahoo based in Hyderabad, Telangana, India, registered as a Micro Enterprise under Udyam. Business information for the operator of this service is available from Sedulous Web.

For personal data of Customers and their team members we act as the data controller (a "Data Fiduciary" under the DPDP Act). For testimonial content that Customers collect through PlugFlow, and for the data that flows through a Customer's automations (orders, leads, payments, webhook deliveries), we act as a data processor on the Customer's instructions; the Customer is the controller of that data and is responsible for having a lawful basis to collect, process and publish it.

Contact for privacy matters, including data subject requests: privacy@sedulousweb.com.

2. Data we collect

Customers and team members

• Account details: name, email address, password hash, avatar (optional), Google account identifier if you sign in with Google.
• Workspace details: workspace name, website, logo, brand colour, billing plan and invoices.
• Billing information processed by Razorpay: we receive payment status, the last four digits of a card or the UPI handle, and invoice data; we never store full card numbers.
• Usage and security data: IP address, browser user-agent, sign-in timestamps, audit log entries for actions taken in a workspace.
• Support correspondence.

Authors (people who submit a testimonial)

• Name, email address (if the Customer's form requests it), job title, company, profile URL, avatar or image URLs and any video link you provide.
• The testimonial content, star rating and answers to any custom questions.
• Consent record: the exact consent text shown to you, the timestamp of your consent and the IP address from which the form was submitted.
• Technical metadata: browser user-agent, referring page, and an order reference if you arrived from a review-request link.

Automation data (End Customers)

• Events a Customer's website, store, plugin or other systems send to PlugFlow: for example order details, lead form fields, payment confirmations from the Customer's own Razorpay account, and the body of webhooks delivered to a Customer's inbound webhook URL. What these contain is decided by the Customer; we store them as received, apart from redacting values that look like secrets.
• Workflow run logs: the input and output of each step, kept so the Customer can see what happened.
• Credentials the Customer saves for connected services (API keys, tokens, webhook URLs, service account keys). These are encrypted before storage and masked in run logs.

Shopify merchants and their customers

• When a store installs the PlugFlow Shopify app we receive the store's myshopify domain and name, a Shopify access token (encrypted at rest) and, from the fulfilled-order webhook, the order id, total and currency together with the customer's name and email address. We use the name and email only to send the review-request email the merchant has switched on, and we do not read customer records, addresses, phone numbers or other order details.
• Pending review requests are deleted when the app is uninstalled; store data is erased when Shopify sends its shop-redaction request 48 hours after uninstall; a customer's data is exported or erased within 30 days of Shopify's customer data request or redaction request.

Visitors to websites that embed a wall

The embed script records aggregate daily view and click counts for the wall together with the hostname of the page it is shown on. It does not set cookies, does not fingerprint devices and does not store IP addresses.

3. Why we use it and our legal bases

• Providing the service (contract): creating accounts, storing and displaying testimonials, sending review requests on the Customer's behalf, running the Customer's automations, processing payments.
• Consent: publishing an Author's testimonial publicly; sending marketing email to Customers who opted in (you can withdraw at any time from the email footer or by writing to us).
• Legitimate interests: securing the platform, preventing abuse and spam, producing anonymised usage statistics, improving the product.
• Legal obligations: tax and accounting records, responding to lawful requests.

4. Sub-processors

We use the following service providers to run PlugFlow. Each is bound by its data processing terms and appropriate transfer safeguards (Standard Contractual Clauses where data leaves India or the EEA). Providers marked "not enabled yet" are listed so you know what is planned; they receive no data until they are switched on.

Third-party services you connect under Automations (for example Slack, WhatsApp Business, HubSpot, Zoho CRM, Google Sheets, your own Razorpay account, Shopify, WooCommerce or any HTTP API) receive data only when your workflows send it. They act under your own agreement with them and are not our sub-processors.

5. Retention

• Account and workspace data: for the life of the account. A deleted workspace or account stays restorable for 7 days, after which it is permanently erased from live systems; nightly database backups roll off after a further 14 days.
• Testimonials: until the Customer deletes them. Deleted testimonials sit in the workspace's trash, where an admin can restore them, until the workspace itself is deleted.
• Consent records: retained alongside the testimonial so that permission can be evidenced, and erased with it.
• Automation events: 30 days. Workflow run logs: 30 days on the Free plan and 90 to 365 days on paid plans, then deleted; runs still in progress are always kept. Saved credentials: until the Customer removes them.
• Audit logs: for the life of the workspace.
• Billing records and invoices: 8 years, as required by Indian tax law.
• Widget analytics: aggregated daily counts with no personal data, for the life of the workspace.

6. Your rights

Depending on where you live you may have the right to access, correct, delete or export your personal data, to restrict or object to processing, to withdraw consent, and to lodge a complaint with a supervisory authority (in India, the Data Protection Board; in the EU, your national authority).

Customers can export all workspace data and delete their workspace or account from Settings → Danger zone. Authors who want a testimonial removed or anonymised should contact the website owner who collected it, or write to us at privacy@sedulousweb.com and we will forward the request and assist. We respond to data subject requests within 30 days.

7. Security

Data is encrypted in transit (TLS 1.2+). Passwords are hashed with Argon2; API keys are stored only as hashes. Sign-in sessions use short-lived access tokens with refresh tokens that end when you sign out. Shopify access tokens, inbound webhook secrets and the credentials you save for connected services are encrypted (AES-256-GCM) before they are written to the database and are masked in logs. Production systems run on a server operated for us by OVHcloud; access is limited to the operator over key-based SSH. The database is backed up nightly and each backup is checked to be restorable. We will notify affected Customers and, where required, the relevant authority without undue delay if we become aware of a personal data breach. Report security issues to security@sedulousweb.com.

8. Cookies

The dashboard uses strictly necessary cookies for sign-in sessions and a short-lived state cookie during Google OAuth. The PlugFlow app inside the Shopify admin sets no cookies and uses no browser storage: each request carries a short-lived token issued by Shopify. Hosted forms, hosted walls and the embed script set no cookies. Our public pages use Cloudflare Web Analytics, which is cookieless and does not identify visitors. We do not use advertising trackers.

9. Children

PlugFlow is not directed at children under 18 and we do not knowingly collect their data. If you believe a child has submitted data to us, contact us and we will delete it.

10. Changes

We will post any changes to this policy on this page and, for material changes, notify Customers by email at least 14 days before they take effect.