Privacy policy
Save or print this copy for your records.
Updated 21 October 2026: this notice includes visitor analytics on the public marketing website. Customer terms and data processing terms remain version 2026-10-21.1.
Who we are and how to contact us
MJP Tech LTD operates TriggerFlow. Our company number is 17018987 and our registered office is 22 Will Meadows, Freystrop, Haverfordwest, Pembrokeshire, Wales, SA62 4AZ. Contact james@triggerflow.co about privacy, access, correction or deletion. Our ICO registration reference is ZC182351.
We are the controller for website enquiries, account administration, billing, security and support administration. For personal information an organisation places in its workflows and hosted service, we generally act as its processor under the customer data processing terms. That organisation determines why and how its content is used. If your information appears in its automation, contact the organisation; we can help route your request.
Information we use
- Accounts: name, email, company or account name, role, device allowance, password hashes, verification challenges, authenticator and session records, licence identifiers, and the version and time of customer agreement acceptance.
- Billing: plan, device quantity, billing interval, purchase and subscription identifiers, payment status and relevant payment events. Stripe receives the payment details entered at checkout. Trial signup does not collect card details.
- Devices and workflows: device names and identifiers, software versions, status and timestamps, profiles, counters, variables, run records, OCR text, screenshots, prompts and configured integration results. Diagnostic features can include process names, window titles, file paths and program inventories. What is received depends on the features and permissions selected.
- Communications: enquiries, partner applications, support messages and material you choose to provide. Partner applications include business contact details, country, partner type, approximate client/device counts and automation needs.
- Website analytics: page views, referral/campaign sources, approximate location, browser/device type and visit engagement. We use these statistics to understand and improve the public website. Enquiry text, account details and payment information are not sent to Plausible.
- Service operation: request and network details, IP addresses, browser/device information, security events, errors and operational telemetry.
We receive this information from you, authorised account administrators and connected devices/integrations, payment providers and service operation. Required account and security information is necessary to provide access. Do not send passwords, licence keys or unrelated personal records through enquiry forms.
Why we use it
For individuals contracting with us, we use necessary account, trial, service and support information to perform the contract or take requested steps before it. For an organisation's contacts, we rely on our legitimate interests in providing and administering that organisation's service. We also rely on legitimate interests in securing accounts, investigating faults, answering business enquiries and resolving disputes, with limited access, minimisation and retention. We use legal obligation for required accounting and regulatory records. We rely on our legitimate interest in understanding and improving our public website for limited, cookieless visitor analytics; we do not use it for advertising profiles or cross-site tracking.
Enquiry and partner forms request a reply; they do not book an appointment or enrol you in marketing. We use consent for optional uses where it is required. Agreement to the customer terms is not consent to marketing or blanket consent to personal-data processing. Where we rely on consent, you may withdraw it without affecting earlier lawful use.
AI, screenshots and remote control
AI Helper sends instructions, and images for vision requests, to OpenAI using the configured API key. Our company-managed API account has optional model-training sharing disabled and uses Global residency and standard retention. Requests set store:false; this does not eliminate provider abuse-monitoring retention, normally up to thirty days with legal and safety exceptions. Customer-supplied keys use that customer's provider settings. See OpenAI's API data controls.
Connecting ChatGPT or another assistant can send that assistant requested screenshots, device details, task content and tool results. Its own account settings and terms apply; API rules are not a promise about consumer ChatGPT. Disconnecting TriggerFlow does not erase assistant history. Review your assistant's sharing and retention controls before using private content.
The website product-guide chat matches questions against our local knowledge base; it does not call an external language model. Its displayed conversation stays in page memory, while technical request/error logging may apply.
Background screenshot and variable-content sharing are off by default in this release. Deliberate feature selection or customer overrides can enable sharing. Live capture and remote control require their own permissions; workflow names can still be shared for management. Older desktop versions can retain previous behaviour until updated. An AI-support message is sent only after an editable preview and an explicit Send to support action. Known secret patterns are redacted, but you must review the content for other private information.
Customers must tell affected people where required and restrict capture and control to authorised tasks. High-risk monitoring, special-category or criminal-offence data require an agreed scope and safeguards. We do not use the website chat to make decisions about credit, employment or similar eligibility.
Suppliers and international processing
Information is available to authorised users and personnel, relevant professional advisers, providers needed for the service, and authorities where legally required or justified. Customer-selected destinations receive the information configured for them.
- Microsoft Azure: application, database and monitoring in Canada Central; credentials vault in East US. Transactional-email resources use Europe, with send/delivery metadata logged in Canada Central for thirty days. Engagement tracking is disabled. Provider support and subprocessors can operate elsewhere.
- Netlify: website hosting and Netlify Forms for enquiries and partner applications, including documented spam filtering. Notifications go to our support mailbox. Netlify Analytics and real-user monitoring are disabled; the separate Plausible service is described below.
- Plausible Analytics: public-website visitor statistics, processed in the EU. Plausible reports aggregate statistics and stores underlying event/session records. It derives a site-specific daily identifier and approximate location from request information, without storing raw IP addresses or User-Agent strings. The daily salt is deleted every 24 hours. See Plausible's data policy.
- GoDaddy / Microsoft 365: support mailbox. We use no separate email archive or backup service. Provider-managed recovery and applicable holds can outlast deletion from the mailbox; we do not promise a fixed provider erasure period.
- Stripe: subscription payments and associated billing processing, with its own controller responsibilities for activities such as fraud prevention and legal compliance. See Stripe's privacy notice.
- OpenAI and connected assistants: content needed for the AI features you use, as described above.
- Cloudflare: DNS and security/proxy processing for dashboard and licensing traffic through its global network. The marketing apex and www records use DNS only; this is not a claim of no service logging.
- Customer-selected Discord, Slack and push services: configured alerts and included content, under your chosen destination's controls.
- YouTube / Google: tutorial playback after you press play, using youtube-nocookie. This still transmits data to Google.
We no longer use Paddle for new subscriptions. It may retain historical purchase records for its own accounting and legal duties under its privacy notice.
We do not promise UK-only processing. For restricted transfers we use applicable adequacy coverage, or contractual safeguards such as the UK International Data Transfer Addendum to standard contractual clauses, with the required assessment. UK-US Data Privacy Framework coverage applies only to eligible recipients and data. A hosting region or certification does not cover every onward transfer. Contact us for information or copies of relevant safeguards, with confidential details redacted where necessary.
How long we keep information
The following are our default operating periods. Some deletion is supervised rather than automatic. Shorter count limits can remove data earlier. A specific legal duty or documented dispute hold may require a relevant subset for longer; we review such exceptions. Customer overrides and older installed software can affect device-held data.
| Information | Retention |
|---|---|
| Enquiries and unsuccessful partner applications | Six months after the last meaningful enquiry contact or rejection/withdrawal. Active partner contacts: relationship plus twelve months. |
| Support | Messages: twelve months after closure. Screenshots, recordings and diagnostic attachments: thirty days after closure, including retained mailbox copies. |
| Unverified signup | Seven days after creation. Verification codes expire after fifteen minutes. |
| Expired trials and closed accounts | Ordinary account content, including minimal agreement acceptance evidence, removed within thirty days after unconverted trial expiry or confirmed closure. Necessary accounting or specifically justified legal records are retained separately. |
| Routine screenshots and run history | Screenshots: seven days from server receipt and at most ten files per device. Run history and start/end evidence: thirty days from the run's recorded end and at most fifty entries per device. |
| Status timeline | Historical transitions: seven days subject to the stream cap. Minimal current/boundary status remains until replaced, device removal or thirty days without observation. |
| Incident information | Media: thirty days after an ended incident if resolved, ninety if unresolved. Resolved summaries: 180 days after resolution. Open cases and historical cases without a reliable resolution date require review. |
| Audit and operations evidence | Audit images: thirty days from capture; necessary result records: 365 days from the event. Selected completed operations and resolved cases: 180 days after completion/resolution. |
| Runtime diagnostics and logs | Diagnostic events, operations and their images: twenty-four hours; current diagnostic snapshots: thirty days without receipt. Routine monitoring: thirty days; security/audit events: ninety; raw web access logs: three days. |
| Recovery copies | Database backups: fourteen days; application snapshots: thirty days. Vault secrets are disabled/queued for deletion on removal; protected recovery versions remain ninety days after actual soft deletion. Temporary restore environments are removed within seven days after validation unless a documented exception applies. |
| Accounting and tax records | Six years from the end of the last company financial year they relate to, subject to applicable statutory exceptions. |
| Website analytics | Retained for traffic-trend comparison while needed, within the active Plausible trial/subscription retention window (three to five years for standard paid plans). We review the need annually and delete site analytics when no longer needed. This does not extend enquiry or account retention. |
| Privacy requests | Minimal request, decision and fulfilment records: three years after closure. Temporary identity evidence: thirty days after verification unless a specific dispute requires retention. |
Deletion covers linked files, mailbox copies, exports and recovery environments we control. Recovery data is restricted from ordinary use and deletion decisions are reapplied after restoration. If active deletion takes thirty days, normal database/app recovery copies can remain up to forty-four/sixty days from closure. Vault protection runs from the actual secret-deletion date. Separately retained recovery environments, legal holds and provider recovery rules can extend these periods; stopping an environment is not deletion.
Information saved on your own devices, exported or sent to chosen integrations remains subject to your controls. The desktop sweeps generated alert images after seven days and generated captures after fourteen days; this does not cover every saved asset or export.
Cookies and browser storage
Portal cookies support authentication, sessions, request protection and routing. The protected session cookie lasts up to twelve hours. Server sessions expire after thirty minutes of inactivity and have a twelve-hour absolute limit. Optional Remember me uses a protected token for up to thirty days and can establish a new session; sensitive changes still require fresh authentication. Feature-specific access tokens and provider routing cookies have separate limits. Browser restoration can preserve browser-held data.
Local storage holds requested editor/dashboard settings such as layout, theme, filters, search text and selected devices until replaced or cleared. Some values identify an account/device. Authoring launch state uses session storage, normally for the tab session, which browser restoration may preserve. Test-run initial variables and trace labels stay in page memory; the updated editor removes legacy persisted copies when loaded.
Cross-window focus results expire after one hour and log entries after twenty-four hours, with a 500-entry log cap. Consumed results and manually cleared logs are removed earlier. Cleanup runs on relevant page loads, reads and periodic sweeps. A closed or suspended browser cannot clean up, so expired bytes may remain until the next visit or manual clearing. Saved server workflows have separate retention.
Plausible measures visits on the public marketing site without analytics cookies or persistent browser identifiers. Custom conversion events and conversion session storage remain disabled. The tracker is not installed in the customer portal. You can block the Plausible script with your browser controls without preventing trial signup or checkout. Tutorial embeds load only after you press play; Google's privacy notice then applies. Essential hosting/security logs are separate. Clearing site data removes remembered settings and can sign you out; blocking essential storage may prevent features working.
Your rights, security and changes
Depending on the circumstances, you can request access, correction, erasure, restriction or portability and object to processing, including direct marketing. Where consent applies you can withdraw it. We may need proportionate identity checks; we explain any lawful limits or refusal. Contact james@triggerflow.co. You can complain to the Information Commissioner's Office.
We use authentication, access controls, protected credentials and encrypted transport, with scoped support access and retention procedures. No system is risk-free. Keep passwords and authenticators secure and minimise unnecessary content. We communicate material changes where appropriate. This notice explains processing; it does not ask you to waive rights or consent to every use.