1. Who is who
When you subscribe to PerfectFlow, Code Flakes LLC acts as processor and your company as controller. To deliver the service we rely on the providers on this page, which act as subprocessors.
With each of them we maintain data protection obligations no less demanding than the ones we owe you, and we remain liable to you for their performance.
Not every provider on this page is the same. Some we contract ourselves to run the service; others are your own accounts that PerfectFlow connects to. Only the first group are our subprocessors. We list the second group anyway, so the map of where your data travels is complete.
2. Permanent subprocessors
These are only the ones that make the service exist. We provide the CRM and the connection to your accounts; we do not provide the accounts of the services you operate with. That is why this list is short and does not grow when you turn on a new module. The first two hold up your instance; the third only comes in if you request a demo from this site, before you are a client.
| Provider | What for | What data | Where |
|---|---|---|---|
| DigitalOcean | Servers, database and file storage | All the data in your instance | Your instance's region (EU or US) |
| Cloudflare | DNS and network security | Connection metadata; stores no content | Global network |
| Calendly | Booking the demo meetings requested from this site | Name, email and the slot you pick | United States |
Your landing page measures into your own analytics property: you create it and grant us read access so we can show the metrics in your dashboard. The data is yours and stays in your account. PerfectFlow itself carries no analytics: no measurement script is loaded inside the CRM.
3. Accounts you connect
These services run on your own account, which you contract and control. PerfectFlow connects to them when you authorise it; until you connect the account, they process no data at all. You can revoke access at any time.
We integrate with the services your operation needs, subject to both parties agreeing it is feasible. In every case the contractual relationship with that provider is yours: we are the ERP/CRM that stores and organises the data those accounts generate.
| Provider | What for | Activated when | Where |
|---|---|---|---|
| Meta (WhatsApp Business) | Sending and receiving messages with your contacts | You activate the WhatsApp channel | Ireland and United States |
| Meta (Instagram) | Account connection, analytics, publishing content and the professional account's conversations | You connect an Instagram professional account | Ireland and United States |
| TikTok | Publishing the videos you schedule | You connect a TikTok account | Ireland and United States |
| Stripe | Charging your own customers | You connect your Stripe account — it is always yours | Ireland and United States |
| Your analytics Google Analytics or another | Measuring your landing page's traffic, in a property of your own | You create the property and grant us read access so we can show the metrics in your dashboard | Depends on the provider you choose |
| Your email provider Google Workspace, Microsoft 365 or another | Delivering all mail that leaves the system: notices to your users — password resets, invitations — and the emails you send to your contacts: campaigns, sequences and notices | You connect your outbound email account. Until you do, the system sends no mail | Depends on the provider you choose |
Billing for your PerfectFlow subscription is handled outside the system: the payment gateway PerfectFlow integrates is always yours, so that you can charge your own customers.
All email goes out through your account. We hold no email account to send on your behalf — not for the system's own notices (a password reset, a user invitation) and not for the emails you send to your contacts. Everything leaves through the account you connect, with your domain and your sending reputation, and we help you set it up at no charge. The connection is outbound only: it lets us send in your name, not read your inbox. If you would rather not connect it, that is fine — we then access no data from your mail.
4. The automation engine is not a subprocessor
Each client's automations run on software we self-host on your own instance's server, with its own database. There is no central engine shared between clients, and the software's vendor has no access to any data.
In other words: your automations are processed in the same region as the rest of your instance. The messages they send do go out through the channels in the table above.
5. How we announce changes
Before adding or replacing a subprocessor we contract:
- We tell you at least thirty (30) days in advance and publish it on this page.
- During that period you may object on reasonable data protection grounds.
- If we cannot reach a solution, you may terminate the contract without penalty.
Connecting or disconnecting one of your own accounts is your decision and requires no notice from us. To be notified of changes to this list, write to info@perfectflow.cloud.
6. Region and international transfers
Your instance's region is set when you subscribe and is not changed without written agreement. Data is not replicated to another region. If your company is established in the European Economic Area, or you process data of people located there, your instance is deployed in Frankfurt, Germany.
Code Flakes LLC is based in the United States. Your instance is hosted in Frankfurt, but the processor is a US company — that is the flow the data processing agreement has to cover.
The people who operate and support your instance access it from Venezuela. They are partners and staff of Code Flakes LLC, not a contracted firm: being part of the same entity, that access is not in itself a transfer to a third party. We tell you anyway, because you are entitled to know where your system is touched from.
What we do about it: support runs on the server itself — no copies of the database, the files or the backups are downloaded or replicated to local machines — access is limited to staff under a documented confidentiality duty, and anyone added in another country is documented before being granted access. Were that support ever provided by an outside firm, it would be a subprocessor and we would tell you, under section 5.
The applicable Chapter V mechanism is determined in the data processing agreement we sign with you, on the terms and deadline that agreement sets. This page does not claim that an adequacy framework or a certification is in force.
More detail on what the system stores: privacy policy.