Privacy Policy

1. Who we are and what this covers

Durable Workflow, a sole proprietorship based in Huntsville, Alabama, USA (“we”, “us”), operates Durable Workflow Cloud (“Cloud”). Support and operations are provided by the Durable Workflow team. This policy explains how we collect and use personal data when you visit the Cloud website, create or use a Cloud account, request early access or contact us, and receive our service emails. We are responsible for this personal data.

This policy does not cover the data inside your runtimes. See Customer content in your runtimes.

2. What we collect

• Account data: your name, email address and password, and the names of the organizations, projects and environments you create. We store your password only as a hash, never in readable form.
• Billing identifiers: your Stripe customer and subscription IDs. Stripe collects and holds your card details; we do not.
• Security and request data: IP addresses and request metadata, which we use for security, rate limiting and abuse prevention.
• Audit logs: records of actions taken in your account, including the user or API key that acted, the time and the IP address.
• Early-access and contact requests: the details you submit, such as your name, email address and organization, and what you tell us about your use case.
• Service emails: the email address and message content needed to send account verification, service notices and billing emails.
• Website analytics: information about visits to our public web pages, collected through Cloudflare Web Analytics.
• Cookies: the cookies needed to keep you signed in and to protect our forms against forged requests.

3. Why we use it, and our legal bases

We use personal data only for the purposes below. Where data protection law requires a legal basis, we rely on the one shown.

4. Customer content in your runtimes

Workflow inputs, outputs and history, and other data your applications send to Cloud, are customer content. It belongs to you, and we process it only to provide the service to you, as described in our Terms of Service. If your customer content includes personal data, you decide what is processed and why.

5. How long we keep it

• Account data is kept while your account is open. When your account is closed, we delete it, except records we must keep for tax, accounting or other legal reasons.
• Billing records are kept for as long as tax and accounting law requires.
• Audit logs, security records and early-access or contact requests are kept while they serve the purposes above, such as investigating security issues or abuse, or following up on your request. They are not deleted on a fixed schedule. You can ask us to delete yours, and we will, unless we need them to protect the service or to meet a legal obligation.
• Runtime data: workflow history follows each namespace’s configured retention setting. Encrypted backups run every six hours, keeping up to 28 recovery sets. Deprovisioning removes the runtime’s active data and credentials. Recovery copies are then kept for seven days for disaster recovery that we manage, and then deleted.

6. Subprocessors

We use these service providers to run Cloud. They process personal data on our behalf, for the purposes shown.

We may also disclose personal data when the law requires it.

7. International transfers

Cloud is hosted in the United States. If you use Cloud from outside the United States, your personal data will be transferred to and processed in the United States, where data protection law may differ from the law where you live. Our subprocessors may also process it in other countries where they operate.

8. Security

We protect personal data with measures that include HTTPS connections to the website and API, passwords stored only as hashes, an isolated runtime for each customer with separate client and worker credentials, encrypted backups, and audit logs of account actions. No system is perfectly secure. If a breach affects your personal data, we will notify you as the law requires.

9. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• correct it if it is wrong;
• have it deleted;
• receive an export of it;
• object to processing based on our legitimate interests; and
• withdraw consent at any time, where we rely on consent.

To make a request, email [email protected], preferably from the address on your account. We may need to confirm your identity before we act on it. You can also complain to your local data protection authority.

10. Children

Cloud is not intended for anyone under 16, and we do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this policy

When we update this policy, we will publish the new version on this page with a new version label and effective date. We will notify account holders by email before a material change takes effect.

12. Contact

For privacy questions or requests: