Legal · updated 16 October 2026
GraphFlow is self-hosted: the data you create lives on servers you control. We only receive the information you send us for licensing, billing and support.
The operator of the deployment is the data controller for user content. We act as controller only for the business data you send us (licensing, billing, support correspondence) and as processor for anything you share with us while troubleshooting. Contact: support@intranetos.com.
Accounts (name, email, hashed password, role, plan), messages (encrypted bodies, previews, blind-index tokens), thread and graph structure, files and folders you upload (with size, MIME type and storage path), device and sync cursors, presence and audit entries. You choose retention; the default is no automatic deletion.
Passwords use scrypt with per-user salts. Message bodies and previews are sealed with AES-256-GCM using a key you generate; searchable tokens are HMAC blind indexes, so plaintext keywords are never stored.
Only what you configure: OpenAI requests for branch summaries (containing the branch transcript), optional outbound calls to your payment provider, and licence validation if enabled. Nothing else is transmitted to us automatically.
Licence records (key, plan, seats, expiry, account email), invoices and payment references, and support tickets including any attachments you send. We do not receive your messages, files or user lists.
We process business data to perform our contract with you (licensing, support, billing), to comply with tax and accounting law, and for our legitimate interest in preventing licence abuse and fraud.
Licence and accounting records are kept for seven years where tax law requires it. Support correspondence is kept for three years. Aggregated diagnostics, if you opt in, are kept for twelve months. Uploaded files in your deployment follow your own retention policy.
We share data only with processors necessary to run our business (payment provider, email provider, cloud hosting for our website) under written agreements, and with authorities where legally compelled. We never sell personal data.
Subject to applicable law you may request access, correction, export, restriction or deletion of the business data we hold, and object to processing based on legitimate interest. Write to support@intranetos.com and we will answer within 30 days.
The graphflow.intranetos.com marketing pages set no advertising cookies and use no third-party analytics. The application uses browser storage (localStorage, IndexedDB) strictly to keep you signed in and to queue offline messages. See the cookie policy.
If we become aware of a breach affecting data we hold, we notify affected licensees without undue delay and describe the scope, the cause and the remediation steps.
We publish the effective date at the top of this page and notify licensees by email for material changes. Continued use after the effective date constitutes acceptance.
Questions about this document: support@intranetos.com · +2 01001945390 · graphflow.intranetos.com
graphflow.intranetos.com