Privacy Policy

VisualAutomate is operated by VisualAutomate, registered under KvK 42126716. For anything in this policy, write to privacy@visualautomate.com.

For your account data we are the controller. For the personal data your workflows carry we act on your instructions as a processor: you decide what your workflows do and what they touch, and we carry it out. Which role we are in decides what you can ask of us, so the rest of this policy says which one it is talking about.

We do not run advertising or analytics trackers on this site, and there is no third-party tracking script on any page. The cookies we set are the ones that sign you in and keep a run you are watching attached to the browser watching it.

When a workflow runs, each step runs either on our managed infrastructure or in a container created for that run and taken down afterwards — which of the two depends on what the step is, and a step that only calls an API needs no container at all. Both are Cloudflare’s, in the sense that the machines are theirs and the code running on them is ours. Either way, whatever a step reads or produces passes through us, is written to the run’s record so you can inspect it in the terminal, and is passed on to the next step. If your workflow reads personal data — someone’s email, an order, a support ticket — then that data is in the run record too, because it is what you asked to see.

We do not read it, mine it, sell it, or use it to train models. It is yours; we hold it to do the job. Deleting a run removes it. If your workflows handle other people’s personal data, you are the one responsible for having a reason to, and for telling them.

For account data, what you build and what you run: because we cannot provide the service without it — performance of our agreement with you. For billing records: because the law requires us to keep them. For keeping the service secure and available: our legitimate interest in it not falling over or being abused. Where we ever ask for consent, you can withdraw it and we stop.

These are every supplier that handles any part of your data, where it does it, and where it publishes its own security and compliance information. Between them they host the application, run the containers your workflow steps execute in, store your account, your workflows and your files, hold live run state while a run is going on, take payments, and deliver account email. None of them is permitted to use your data for their own purposes.

Your workflows run on Cloudflare. Every step executes either on a Worker or in a container Cloudflare starts for that run and we take down afterwards. Vercel hosts the application you build them in; it does not run them.

The credential vault is ours, not a supplier’s. The software that holds the authorisations your steps sign in with is Nango, and we run it ourselves on the Hetzner machine above rather than using their hosted service. Nango the company therefore receives nothing: not your tokens, not your account data, not the traffic your workflows generate. We list them here because the software is worth naming, not because they are a recipient of your data.

Beyond this list, the services your own workflows call receive whatever your steps are configured to send them. That list is yours, not ours, and those services are not our sub-processors — see section 3.

We will give you at least 30 days’ notice before a new supplier starts handling your data, and you may object on reasonable data protection grounds. We will also hand over data where the law obliges us to, and we will tell you when we are allowed to tell you.

Your account data, your workflows and your run history are stored in the EU, and the machine holding your connection credentials is in Germany.

Some of the suppliers above operate outside the EEA, or route traffic through infrastructure that does. Where personal data leaves the EEA it goes under the European Commission’s standard contractual clauses or an adequacy decision, and we keep the paperwork for it. Ask us and we will show you which mechanism covers which supplier.

Traffic is encrypted in transit and data is encrypted at rest. Stored credentials are encrypted with a separate key and are never displayed back to you once saved. A run executes in isolation from other customers’ runs, and a sandbox is destroyed after the run that created it. Access to production systems and data is restricted to the people who need it to operate the service, and is logged. Changes to the platform go through review and automated testing before release.

No system is perfect. If a breach affects your data we will tell you without undue delay and in any case within 72 hours of becoming aware of it, and we will tell the supervisory authority within the time the law allows.

We do not currently hold a third-party audit certification and do not claim one. We will answer a reasonable security questionnaire once a year and share the documentation we hold — write to privacy@visualautomate.com.

You can ask for a copy of your data, for it to be corrected, for it to be deleted, for us to stop or limit what we do with it, and for it in a portable form. You can object to processing we base on our legitimate interest.

Write to privacy@visualautomate.com and we will answer within a month. You can also complain to your national data protection authority — in the Netherlands, the Autoriteit Persoonsgegevens.

Where we act as your processor and the request comes from one of your users rather than from you, we will pass it to you rather than answer it ourselves, because it is your decision to make.

Deleting your account removes your projects, workflows, stored credentials and run history. For 30 days beforehand you can ask us to export it for you. Billing records survive deletion, because tax law says they must, and routine backups age out on their own schedule.

Where you need a data processing agreement, ours is available from privacy@visualautomate.com and, once signed, takes precedence over this policy for the personal data your workflows carry. It carries the sub-processor list in section 5, the security measures in section 7, and the transfer mechanism in section 6 — this policy is not a substitute for it, and a signed one beats it.

VisualAutomate is a tool for building software and is not intended for anyone under 16. We do not knowingly collect their data; if we learn we have, we delete it.

When we change this policy we update the date at the top. If a change materially affects what happens to your data, we will tell you by email or in the app before it takes effect, rather than leaving you to notice. Adding a supplier to section 5 is such a change, and carries the 30 days’ notice that section promises.

How the service itself may be used is a separate document, the Terms of Service.