Data Processing Agreement

1. Who this is between

SerFlows LLC (“SerFlows”, “we”) and the business that holds the SerFlows account (“you”). It applies for as long as your account exists and, for anything still held afterwards, until that is deleted.

In the language privacy laws use, you are the controller of your customers’ information and we are your processor. Plainly: it is your data about your customers, and we are the filing cabinet you keep it in.

2. What it covers

Everything your customers give you through SerFlows: their name, phone number, email address, the service address where relevant, the times they asked for, their answers to your booking questions, any photos they upload, the free-text notes they write, whether they ticked the text-message consent box, the messages we send them on your behalf, and the record of an appointment, quote or payment.

It does not cover your own account: your login, your business details, your services and hours, your subscription. That information is ours to account for, and the Privacy Policy describes it.

3. What we do with it — and what we never do

We use your customers’ information for one purpose: running SerFlows for you. Storing the booking, showing it on your dashboard, generating the times you can offer, sending the texts and emails you have set up, producing pay links and calendar entries, and keeping the service working and secure.

Specifically, we do not:

• sell, rent or share it, in the ordinary meaning or the CCPA meaning;
• use it for advertising, or let anyone else do so;
• use it to train AI models, ours or anyone else’s;
• combine it with another business’s customer data, or use it to build any profile that spans accounts;
• market to your customers, ever. Every message we send on your behalf is triggered by something you or they did.

The optional AI writing help works on your page text — your business description and service descriptions. It is never given a customer’s booking.

4. Your instructions are the settings you choose

We act on your documented instructions. In practice those instructions are the product: the questions your booking form asks and the ones you switch off, whether it collects a service address, which alerts go where, when you confirm a time, what you send and to whom, and what you delete.

We will not do something else with your customers’ data because we think it would be useful. If the law obliges us to hand something over, we will tell you first unless we are legally prohibited from telling you.

5. What you are responsible for

You decide what to collect and why, and whether you are allowed to. That includes:

• having the right to contact the people whose details you enter. Almost every message SerFlows sends is triggered by a customer who filled in your own booking form and ticked the consent box, and we keep that record against the booking. The exception is a booking you type in by hand: that person ticked nothing, so only add someone who asked you to;
• not using SerFlows for marketing or bulk messages;
• answering your customers when they ask what you hold about them, or ask you to delete it;
• keeping your own account secure — your password, and who in your business can sign in.

6. What SerFlows is not built to hold

SerFlows is built for booking local services. It is not built for, and you should not put into it:

• Card numbers. Never type one into a notes field. Card details go through Stripe, which we never see or store.
• Government identifiers — Social Security numbers, driver licence numbers, passport numbers.
• Medical records, or anything covered by HIPAA. We are not a business associate and will not sign a business associate agreement.

Two of our own categories sit near a line, and it is fairer to name them than to leave you to find out. Personal Training offers “Rehab” as a goal, which in some states is health information — if that matters to how you work, switch that question off under My Page → Booking questions. Tutoring asks for a student’s grade or level, which can be information about a child; SerFlows is not built for children’s data and the account should belong to the parent or the business, never the student.

7. Who else touches it

We use these companies to run SerFlows. Each may handle your customers’ information only to provide their part of the service, under their own terms:

How you find out about a change: this list and the matching one in the Privacy Policy are the notice. We keep them current, and we do not run a separate mailing list for it — saying we would send thirty days’ advance notice would be a promise with nothing behind it. If you want to be told, email support@serflows.com and we will tell you directly.

8. How it is kept

These are the protections that exist today, not a wish list:

• Every booking is tied to the account that owns it, and the database enforces that separately from the application — so a bug in a page cannot hand one business another business’s bookings.
• Photos your customers upload, and completion photos taken at their property, are held in private storage that is not publicly readable. They are shown to you through links that expire after an hour.
• Everything travels over encrypted connections, and passwords are stored hashed, never in readable form.
• Signing in can require a second step — a code sent to the email address you log in with.
• The addresses that outside services call back into (payment and message status) verify a signature, so a stranger cannot post to them.

What we do not claim: SerFlows has no SOC 2 report, no ISO certification and no third-party penetration test. It is a small company. If any of those is a condition of you using it, it is better that you know now.

9. If something goes wrong

If we find that your customers’ information has been exposed or taken, we will tell you without undue delay once we have confirmed it, tell you what we know including what we do not yet know, and help you work out what you have to tell your customers.

We deliberately do not promise a fixed number of hours. A deadline we cannot meet is worth less to you than a straight answer as soon as there is one, and the duty to notify your customers is yours — you hold the relationship with them.

10. When a customer asks you something

If one of your customers asks what you hold about them, asks for it to be corrected, or asks you to delete it, you can answer it yourself: everything about that booking is on your dashboard, and deleting the booking removes it and its photos.

If something is beyond what the dashboard can do, email us and we will help. If a customer contacts us directly about a booking, we will point them at you — it is your relationship, and we should not be changing your records because a stranger asked us to.

11. Deleting it

You can delete an individual booking at any time from your dashboard, which removes it and its photos.

You can close the whole account from Settings, which deletes every booking, every customer’s details, every photo, your booking page and your login, and cancels your subscription at the same time. There is no undo and we cannot recover any of it for you.

Two things survive and you should know which: our payment provider keeps its own billing records of what you were charged, because it has to; and routine backups and server logs age out on their own schedule rather than being reached into. We do not restore a deleted account from a backup.

We do not delete anything automatically after a set period. Bookings stay while the account is open so you have your own history, and deletion happens when you ask.

12. Checking up on us

You may ask, in writing, how we handle your customers’ data, and we will answer — including completing a security questionnaire.

We cannot host an on-site audit or give access to production systems, and saying otherwise would be a term nobody could perform. What we can do is answer honestly and in detail, and point you at the same public documents everyone else gets.

13. Where the data is

SerFlows is intended for use in the United States. Our systems and the companies in section 7 operate in the US, and the service is not offered to people in the European Economic Area or the UK.

So there are no European data transfers here and no Standard Contractual Clauses to attach. If that ever changes, this section changes first.

14. Which laws this is written against

Worth being straight about: for most SerFlows businesses, no law currently requires this agreement. The European rules do not reach a US-only service, and the California and other state rules attach above thresholds a local service business will not meet.

It exists anyway, because the obligations in it are ones we think a company holding other people’s customer records ought to accept, and because you should not have to take that on trust. Where a privacy law does apply to you, this agreement is intended to be the contract that law asks you to have with us.

15. Changes, and which document wins

This agreement is part of the Terms of Service and changes with them. The version at the top of this page is the Terms version, so the two can never disagree about which document you accepted. If we change it materially we will say so, the same way we would for the Terms.

If this agreement and the Terms of Service ever contradict each other about handling your customers’ information, this one wins. On everything else, the Terms govern.

16. Contact

Questions about this agreement, a security questionnaire, or anything about how your customers’ data is handled: support@serflows.com.