Privacy Policy

Tailflow is operated by DS Labs LLC, registered at 50 N Gould St, Sheridan, WY 82801, United States (“Tailflow”, “we”, “us”). We are the controller of the personal data described in this policy.

For any question about this policy or about your data, write to contact@tailflow.xyz. We answer privacy requests within 30 days.

We collect as little as the product can work with. There is no advertising, no profile building and no sale of data — none of the categories below exist for those purposes.

• Your account. Email address, display name, and a hash of your password. The hash is one-way; we never hold the password itself. Needed to have an account at all.
• Your sessions. A hashed session token, the IP address and browser user-agent the session was created from, and when it was last used. Shown back to you in Settings so you can recognise and end a session you do not recognise, which is the only reason we keep it.
• Your flows. The triggers, filters, actions and paths you build, including any text you write into them. This is the product; it is stored so it can run.
• Your connections. Credentials for the services you connect — a Slack bot token, an OAuth token for X, Linear or Google. These are encrypted at rest with a key Tailflow holds separately, and are decrypted only at the moment an action of yours runs. They are never returned by our API, never shown in the interface, and never logged.
• Run history. For each run: the flow, the onchain event that triggered it, whether each step succeeded, how long it took, and the credits it cost. For a limited window we also keep what was sent to each service and what came back — the payloads — so you can debug a flow that did not do what you expected.
• Early access requests. If you submit the form on our marketing site: your email address, which form it came from, the page you came from, and the originating IP address. The IP is kept only to recognise automated abuse of an unauthenticated form.
• Product analytics. If enabled on this deployment, aggregate events about how the product is used. See §6.

We do not collect special category data, we do not use cookies for advertising, and we do not track you across other websites.

Tailflow reads public blockchain data: transfers, swaps, liquidations, prices, contract transactions and events. This data is published by the networks themselves and is available to anyone. We do not obtain it from you.

The caveat is honest and worth stating: a wallet address is pseudonymous, not anonymous. If an address can be linked to a person by other means, information about that address may amount to personal data about them under some laws. We treat addresses you enter into a flow — your own or anyone else’s — as part of your flow configuration and apply the same protections we apply to the rest of it. We cannot delete data from a public blockchain, because nobody can.

Where the GDPR or a comparable law applies, our legal bases are:

• Performance of a contract. Your account, your flows, your connections and your run history exist because you asked us to run workflows for you. Without them there is no service.
• Legitimate interests. Session metadata and abuse signals, to keep accounts secure; aggregate product analytics, to know which parts of the product are used. We have balanced these against your interests and kept the data minimal and short-lived.
• Consent. The early-access mailing list. You gave us an address to write to you once; you can withdraw that at any time and we will delete the record.
• Legal obligation. Records we are required to retain, such as those underlying invoices.

Each category has its own clock, and they are deliberately short.

• Run payloads — what was sent to a service and what came back — are deleted after 30 days. They are debugging evidence, and debugging evidence stops being useful long before it stops being sensitive.
• Run records — which flow ran, when, and what it cost — are kept for 13 months, so a year of invoices can still be explained by pointing at them.
• Sessions expire on their own and are removed once expired. Signing out ends one immediately.
• In-flight authorisations — the short-lived state we hold while you connect an account — expire after ten minutes and are deleted the moment they are used.
• Your account, flows and connections are kept until you delete them or close your account.
• Early access records are kept until we launch and write to you, or until you ask us to remove yours.

When you close your account we delete your flows, connections and personal data. We may retain records we are legally required to keep, and encrypted backups roll off on their own schedule within 30 days.

We do not sell data and we do not share it for anyone else’s marketing. Data reaches other companies in exactly three ways.

Services your flows deliver to. This is the product working. When a flow of yours posts to Slack, X or Linear, appends to a Google Sheet, asks a model to reason about an event, sends an email, or calls a webhook URL you chose, the content of that action goes to that service under their privacy policy. You choose these, one action at a time, and you can see every one of them in your flow. A webhook goes wherever you point it, so point it somewhere you trust.

Infrastructure we run on. Providers that process data on our instructions, under contract, and only to deliver the service:

• Amazon Web Services — hosting and database, in the US East (Ohio) region. All of the data described above is stored there.
• Envio — blockchain data indexing and queries. Receives contract and wallet addresses your triggers watch. Receives no information about you.
• Alchemy — NFT collection and token metadata. Receives contract addresses and token IDs.
• CoinGecko — token prices. Receives no customer data.
• Sourcify, Blockscout and QuickNode — public contract ABIs. Receive contract addresses.
• Resend — delivery of emails your flows send, and our own transactional email.
• PostHog — product analytics, where enabled. Events are sent from our servers, not from your browser, and cover how the product is used rather than who you are.

Law. If we are legally compelled to disclose data, we will — and, where we are permitted to tell you, we will.

Tailflow is a United States company and your data is stored in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, using Tailflow means your personal data is transferred out of your country to ours.

For those transfers we rely on the European Commission’s Standard Contractual Clauses, together with the technical measures described in §8 — encryption in transit, encryption of credentials at rest, and access limited to the people who operate the service. You can ask us for the specifics of any particular transfer, and we will tell you.

Passwords are hashed with Argon2id. The credentials you connect are encrypted with a per-record key, itself wrapped by a master key held outside the database, so a copy of the database alone does not yield them. They are never returned by our API and never written to logs. Traffic is encrypted in transit. Access to production data is limited to people who need it to operate the service.

No system is perfectly secure. If a breach affects your personal data and is likely to present a risk to you, we will notify you and the relevant supervisory authority as the law requires.

Depending on where you live, you have some or all of the following rights: to know what we hold about you and get a copy of it; to correct it; to delete it; to restrict or object to how we use it; to receive it in a portable format; and to withdraw consent you have given. You can do much of this yourself in Settings — a connection can be disconnected, a flow deleted, a session ended.

For anything else, write to contact@tailflow.xyz. We will not charge you for this and we will not make it difficult. If you believe we have handled your data badly, you are also entitled to complain to the data protection authority for the country you live in, and you do not have to raise it with us first.

Tailflow is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has given us data, tell us and we will delete it.

When this policy changes we update the date at the top. If a change materially affects your rights, we will tell account holders by email before it takes effect rather than relying on you to re-read the page.