Privacy Policy

WorkflowSpin is operated by:
Workflow
Gammel Køge Landevej 55, 2500 Valby, Denmark
CVR: DK20188847
Contact for privacy matters: [email protected]

This policy explains what personal data we collect when you use WorkflowSpin — as a customer managing an account, or as a visitor viewing a published 360° product spin embedded on someone else's website — and what we do with it.

When you create a WorkflowSpin account and use the product, we collect:

• Account data: your email address and password (or, if you sign in with Google, the account details Google shares with us for authentication).
• Organization data: your company/organization name, and the roles and email addresses of any team members you invite.
• Content you upload: the product photos you upload to create spins. These are stored privately and are never made public except through the specific published spin URLs you choose to publish and share.
• Billing data: if you subscribe to a paid plan, our payment processor Stripe collects and processes your payment card details and billing address directly — we never see or store your card number ourselves.
• Support and communication data: anything you send us directly, e.g. by email.

When someone views a 360° spin embedded on a customer's website, our viewer records anonymous usage events — views, zoom interactions, and fullscreen opens — together with a short-lived, randomly generated session identifier and a coarse device category (desktop, mobile, or tablet).

This session identifier is generated fresh each time the viewer loads, is not stored in a cookie or any persistent browser storage, and cannot be used to track a visitor across different websites or visits. We use this data only to show our customers aggregate statistics (e.g. “this spin was viewed 500 times last month”) — never to identify or profile individual visitors.

• To provide and operate the WorkflowSpin service (creating, processing, and publishing your product spins).
• To authenticate you and secure your account.
• To process payments and manage your subscription.
• To send you transactional emails — subscription confirmations, payment receipts and failures, and similar account notices. We do not send marketing emails without your separate consent.
• To provide aggregate, anonymous analytics about your published spins.
• To comply with legal obligations (e.g. accounting records for invoices).

We use a small number of subprocessors to run WorkflowSpin. We do not sell your data to anyone.

• Supabase — hosts our database, authentication, and file storage (EU region).
• Vercel — hosts the WorkflowSpin web application.
• Fly.io — runs our background image-processing and email-sending infrastructure (EU region).
• Stripe — processes payments and stores billing/payment details on our behalf.
• Resend — delivers our transactional emails.
• Cloudflare — provides DNS, content delivery, and security filtering for our public-facing services.

Some of these providers are based outside the EU/EEA. Where that is the case, we rely on their Standard Contractual Clauses or an equivalent legal transfer mechanism.

• Account and organization data is kept for as long as your account is active.
• If you delete a spin or your organization, we keep the data for 30 days (in case of accidental deletion) before permanently erasing it, including uploaded images.
• Raw, anonymous analytics events are kept for 90 days, after which only aggregated daily statistics are retained.
• Billing records are kept as required by applicable accounting and tax law.

If you are in the EU/EEA, you have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing, under the GDPR. To exercise any of these rights, contact us at [email protected]. You also have the right to lodge a complaint with your local data protection authority — in Denmark, the Datatilsynet.

Our web application uses a strictly necessary session cookie to keep you logged in. We do not use advertising or cross-site tracking cookies. Our public embed viewer does not use cookies at all.

We may update this policy from time to time. If we make material changes, we will notify account administrators by email.

Questions about this policy or how we handle your data? Email [email protected].