Data processing addendum

This addendum is between your organisation (“you”) and ARCED International LLC (“we”), which makes DataFlow. It's part of the Terms for any organisation that uses DataFlow under a plan, so it applies without being signed. If your procurement needs a signed copy, write to hello@letdataflow.com and we'll send one countersigned.

Survey data: we never receive it

DataFlow processes survey data only on your own computers. It comes straight from your survey server (SurveyLoopr, SurveyCTO or ODK Central) or from files you import, and stays on the computer, encrypted. The local AI runs there too. We don't receive, host or have access to it, and nothing the app sends us contains any of it. Security and privacy lists everything the app sends anywhere.

So we aren't a processor of your survey data. You are its controller, and you decide who collects it, why and on what basis (consent, ethics approvals, contracts with your clients). A Field Report or a download leaves the computer only when someone on your team shares it.

Please don't send us survey data in support emails: we don't need it to help.

Account data: we're the controller

To give you a plan, we hold a small amount of account data:

• names, email addresses and organisation, and how each person signs in (with Google, also the profile picture);
• the plan, its seats and the team members you invite;
• if you start setting up a study on the website, what you tell us about it (its name, country and interview languages, your side and role, your team's size and where its data comes from), until the app collects it;
• billing records: invoices, the plan paid for, and a tax ID if you give one (Stripe takes the payment; we never see card numbers);
• the licence check: the account, an install ID for the computer, the app's version and the operating system;
• daily usage counts: a fixed list of event names and numbers, never survey data, which one switch in the app's Settings turns off.

We decide what's collected and why: to run accounts and licences, bill you and send account emails, as the privacy policy says. That makes us the controller of this data, not your processor. It includes the team members you invite: we hold their name and email address to give them a seat, and they can write to us directly about it. We don't sell it or use it for advertising.

Sub-processors

Only to run DataFlow, and only what each needs. None of them receives survey data.

If you sign in with SurveyLoopr instead, SurveyLoopr tells the app your plan, and its own privacy policy covers that account. If this list changes, the privacy policy changes with it, and account holders hear about it by email before the change applies.

Security

For survey data, on your computers (details on Security and privacy):

• each project is one file encrypted with AES-256-GCM, its key kept in the system's keychain, not beside the file;
• raw data is never changed: every correction is kept on top of it with who, when and why, and the activity log is hash-chained, so a changed entry shows;
• variables that identify people move to a separate, separately encrypted store, and unlocking them for a download is logged;
• raw interviews with personal information can be kept in an encrypted vault (AES-256-XTS) that also opens in VeraCrypt;
• the app's window can't reach the internet, and the app has no third-party trackers or analytics;
• Windows installers and every update are signed, and the app installs only an update whose signature matches the key built into it.

For account data: we keep only the list above, card numbers stay with Stripe, and survey data is never part of it.

If something goes wrong

If we learn of a breach that affects account data, we tell the affected account holders without undue delay: what happened, what data, and what we're doing about it. We tell the authorities too where the law requires it.

If we find a flaw in DataFlow that could put survey data at risk, we tell account holders without undue delay, with what to do, and fix it in a signed update. To report one, write to hello@letdataflow.com.

When the plan ends

Survey data is on your computers, so you decide when to delete it; we have none to delete. When a plan ends, DataFlow turns read-only and you can still download everything.

Ending a plan doesn't close the account, so you can come back to it. Ask us to close it and we delete the account data, except billing records that tax and accounting law makes us keep. Usage counts are kept only as patterns across all users, not to follow one person.

International transfers

Survey data isn't transferred by us: it moves only between your survey server and your computers. Account data goes to us in the United States and to the sub-processors above. Where data protection law requires it for a transfer (for example from the EEA, the UK or Switzerland), the standard contractual clauses apply, with the UK's addendum where it applies.

Requests from people

Anyone can ask to see, correct, export or delete the account data we hold about them by writing to hello@letdataflow.com. Requests about survey data go to you, because only you hold it.

Contact

ARCED International LLC · 30 N Gould St, STE R, Sheridan, WY 82801, USA · hello@letdataflow.com