ServflowThis policy lays out what data we collect and why, how we handle it, and your rights over it. We never sell your data.
It applies to servflow.io, the hosted dashboard at dash.servflow.io, and the agents you run through it, all operated by Servflow, Inc., 1111b South Governors Ave Ste 29848, Dover, DE 19904, United States. "You" means site visitors, prospective customers, and customers.
It does not cover people who talk to your agents. When your agent handles a message from someone on Discord, Telegram, GitHub, or any other channel you connect, you decide what the agent does with it, and we process it on your instructions. If you are one of those people and have a question about your data, contact the team that runs the agent.
What we collect and why
Our guiding principle is to collect only what we need.
Identity and access
When you sign in, Auth0 gives us your email address, your name, and a profile picture URL if your identity provider has one. We store the email and name so we can tell you apart from other customers and show you your own team. We give your account a random analytics identifier that is not derived from any of these.
We do not log the IP address you sign up or sign in from.
Billing information
If you subscribe to a paid plan, you enter your card on a page hosted by Stripe. Card details never reach our servers. We store your Stripe customer identifier and your current plan so we can tell what you have paid for.
Product content
We store the content you create in the dashboard so your agents can run: agent and workflow configurations, the credentials you give us for LLM providers and integrations, secrets, workspace files, and the settings of each team. We keep this content as long as your team exists.
Each agent run produces a trace. A trace records the run's inbound payload, the tools the agent called with their arguments and results, the model used, token counts, and timings. It does not record the prompt text sent to the model. Secret values are masked before anything is written. Traces are kept for 30 days.
Conversation history lets an agent continue a thread. It is held in memory by the service and is not written to durable storage, so it does not survive a restart of the service.
Website interactions
On servflow.io we use PostHog to count page views and MailerLite to hold the email addresses of people who subscribe to our mailing lists. In the dashboard we use Google Analytics, identified by the random analytics identifier above and never by your name or email. Both record your browser, the pages you visit, and your IP address as part of the request.
Embedded videos on servflow.io load from YouTube only after you click them.
Voluntary correspondence
When you write to us, we keep the correspondence so we have a history if you write again.
When we access or disclose your information
We access your content only to provide the Services, to fix a problem you have reported, to investigate abuse, or when the law requires it. Our access is by staff with production access and is not self-recorded today.
We use third parties to run the Services. Each receives only what it needs:
- Auth0 signs you in and holds your email, name, and sign-in history.
- Stripe handles payment and holds your card, billing details, and invoices.
- Hostinger hosts our servers in the United States, where all your content lives.
- Cloudflare terminates TLS and proxies traffic to our servers.
- Amazon Web Services stores our container images. It does not hold customer data.
- Google Analytics receives dashboard usage, keyed by the random identifier.
- PostHog and MailerLite receive website analytics and mailing-list addresses, as described above.
Your agents send data to the LLM providers, MCP servers, and integrations you configure. Those are your providers, under your agreements, and are not our subprocessors.
We will not disclose your content to law enforcement or anyone else unless legally compelled, and we will tell you unless we are prohibited from doing so.
Artificial intelligence
The purpose of ServFlow is to run agents that send content to a large language model. The provider, the model, and the API key are yours: you configure them in the dashboard, and each run goes directly from our servers to that provider with your key. We hold no provider agreement on your behalf, and the provider's own terms govern whether it trains on what it receives. The built-in provider types are Claude, OpenAI, Qwen, OpenRouter, and LiteLLM; you can also connect any MCP server.
We do not use your content to train AI models.
Your rights with respect to your information
You have the right to access, correct, export, and delete the information we hold about you, to object to or restrict its processing, and to withdraw consent where processing is based on consent. You may also complain to your local data protection authority.
To exercise any of these, write to us at the address above from the email address on your account. You can copy each agent's configuration as YAML from the dashboard and download workspace files yourself at any time.
How we secure your data
See our Security Overview.
What happens when you delete content
Deleting an agent, workspace, secret, integration, or provider in the dashboard removes it from your team at once. Traces are not deletable individually and expire after 30 days.
To delete your whole team, write to us as described in our Cancellation Policy. We delete your content from our systems within 30 days of the request. Stripe keeps the records it is legally required to keep.
Data retention
We keep your account and content for as long as your team exists. Traces are kept for 30 days. Website analytics are kept according to the retention settings of PostHog and Google Analytics. Correspondence is kept until you ask us to remove it.
Location of site and data
Our servers are in the United States. If you are outside the United States, your data is transferred to and processed there.
Changes and questions
We may update this policy as needed to comply with regulations and reflect new practices. If we make significant changes, we will refresh the date at the top and notify users who have subscribed to our policy updates. Questions go to the address above.