Data Processing Agreement

David Investment Group Inc., which operates Fluxo Flow (the "Processor"), processes Personal Data on behalf of the Customer (the "Controller") for the sole purpose of providing the Services as described in the Terms. This DPA applies to all Personal Data processed by us under your account, including data uploaded into workflows, credential metadata, run logs, and any payloads passing through trigger ingest endpoints. It binds both parties when the Customer accepts the Terms of Service.

Subject matter: automated workflow execution, AI inference, integration relay, and operational support for the Customer.

Duration: for as long as the Customer maintains an account, plus up to 30 days after termination to complete deletion as described in Section 11 and the Privacy Policy. Customer may request earlier deletion at any time via the workspace export + deletion flow or by emailing privacy@fluxosuite.com.

Categories of data: account identifiers (email, name, Clerk id), workspace metadata, credential metadata (provider names + previews — not plaintext secrets), trigger payloads, AI prompts + responses, run traces, billing identifiers.

Categories of data subjects: Customer's employees, contractors, end users, customers, prospects, or any third party whose data is intentionally introduced into a workflow by the Customer.

The Customer (Controller) represents and warrants that:

• It has obtained all necessary consents and provided all required notices for any Personal Data it submits to the Services.
• It will not introduce special-category data, protected health information (HIPAA) or payment card data into the Services. We do not sign Business Associate Agreements and the Services are not certified for these data types.
• Its instructions to us — through the Services and these Terms — comply with applicable data protection law.

As the Processor, we will:

• Process Personal Data only on documented instructions from the Customer (these Terms + the Customer's use of the Services constitute documented instructions).
• Ensure personnel authorized to process Personal Data are bound by confidentiality obligations.
• Implement and maintain the security measures described in Section 6 below.
• Engage Sub-processors only under the terms in Section 5.
• Assist the Customer in fulfilling its obligations under Articles 32-36 of the GDPR (security, breach notification, DPIAs, prior consultation).
• At the Customer's choice, delete or return all Personal Data after the end of the Services, unless storage is required by law.
• Make available all information necessary to demonstrate compliance with this DPA and allow for audits where required, scheduled in advance with reasonable notice.

The Customer grants general authorization for us to engage Sub-processors to perform parts of the Services. The current list of Sub-processors and what each one does is published at https://flow.fluxosuite.com/docs/security. We will notify the Customer of new Sub-processors at least 30 days before they begin processing Personal Data so the Customer has a chance to object on legitimate grounds. If the Customer objects on legitimate grounds and the parties cannot reach a resolution, the Customer may terminate the affected Services without penalty.

We remain fully liable for the acts and omissions of any Sub-processor we engage to the same extent as if we performed the processing ourselves.

AI providers. AI inference by OpenAI or Anthropic runs on API credentials the Customer connects in Settings → AI Providers. Prompts and responses sent to those providers are processed under the Customer's own provider account and governed by the Customer's agreement with that provider (including its data-retention settings). We transmit that data only on the Customer's instruction, when a workflow, agent, or feature the Customer uses calls a model.

Where a Partner provides the Services to its own Clients under our White-Label Partner Agreement, the Partner is the "Customer" under this DPA for its Client Workspaces. For that data the Client is normally the controller and the Partner its processor (or a controller where it determines the purposes of processing), and we act as the Partner's processor, and so as a sub-processor to the Client's controller.

• The Partner must have a written agreement with each Client that imposes data protection obligations equivalent to those in this DPA, and must obtain any authorizations its Clients need to give for our processing and for our Sub-processors.
• The Partner's instructions to us, through the Services and the Partner Agreement, are the documented instructions for that data. The Partner is responsible for ensuring they are consistent with its Clients' instructions.
• Partner access to Client Workspace content is limited to read-only, time-limited support sessions that the Client Workspace owner allows and can turn off. Every support session is logged in the Client Workspace's activity log.
• We may notify or assist a Client directly where needed for a Personal Data Breach, a legal requirement, or service continuity after a Partner Agreement ends.

We maintain commercially reasonable technical and organizational measures to protect Personal Data, including:

• Encryption at rest: credential payloads are encrypted with pgcrypto symmetric encryption using a key managed outside the database (VAULT_ENCRYPTION_KEY).
• Encryption in transit: all traffic over TLS 1.2+ from clients and between internal services.
• Access control: role-based access at the workspace level, row-level security on every table containing customer data, audit logging for every privileged action.
• Tenant isolation: all customer data is scoped by workspace_id and enforced by both application code and database RLS policies.
• Backups: kept by our database provider for a limited period; encrypted at rest.
• Monitoring: automated health checks on every critical subsystem, with alerting on degradation.
• Personnel: all staff with production access are subject to background checks, confidentiality agreements, and least-privilege access reviews.

We will notify the Customer without undue delay — and in any event within 72 hours of becoming aware — of a Personal Data Breach affecting the Customer's data. Notice will include a description of the breach, categories and approximate numbers of data subjects affected, likely consequences, and measures taken to address it. Notification is not an acknowledgement of fault.

We will assist the Customer in responding to requests from data subjects exercising their rights under applicable privacy law (access, rectification, deletion, portability, restriction, objection). Self-service tooling for these rights is available in workspace settings; for requests we cannot fulfill via self-service, contact privacy@fluxosuite.com and we will respond within 30 days.

If a data subject contacts us directly about Customer-owned data, we will refer the request to the Customer and will not respond to the data subject ourselves (other than to acknowledge and redirect).

When we transfer Personal Data from the European Economic Area, United Kingdom, or Switzerland to a country that has not received an adequacy decision, we rely on the Standard Contractual Clauses (SCCs) as adopted by the European Commission, with the UK Addendum or Swiss equivalents where applicable. The Customer is the "data exporter" and we are the "data importer" under the SCCs. By accepting this DPA, the Customer enters into the SCCs with us as a Processor, Module Two (Controller to Processor).

For Personal Information of California residents subject to the CCPA/CPRA, we act as a "Service Provider" (or "Contractor" where applicable). We will not sell, share, or otherwise disclose Personal Information for our own commercial purposes outside of providing the Services. We will retain, use, and disclose Personal Information only as necessary to perform the Services, comply with law, or as otherwise permitted by the CCPA/CPRA.

At the Customer's instruction, we will delete or return all Personal Data after the Services are terminated. The Customer may export workspace data at any time from Settings → Danger Zone → Export workspace. Deleting a workflow or workspace removes its Personal Data from active systems immediately; on written request we delete all remaining account data within 30 days. Copies in backups age out on our database provider's backup schedule.

This DPA takes effect on the Effective Date and continues for the duration of the Terms of Service. Sections relating to confidentiality, security, and deletion survive termination for as long as we retain any Customer Personal Data.

For any DPA-related inquiry — including signed counterparts, sub-processor objections, audit requests, or DSR escalations — contact privacy@fluxosuite.com.