PRIVACY NOTICE
Privacy
This notice describes what docflowhq.com does with personal data.
Last updated: 15 October 2026.
Material changes to this notice are announced on this page. If you are on the waitlist, we also email you about a material change.
Controller
EvolveHQ OÜ is the controller for personal data processed through docflowhq.com. The company is registered in Estonia. Registry code 14816515. VAT number EE102198221. Registered address: Sepapaja tn 6, 15551 Tallinn, Harju maakond, Estonia.
Contact: info@docflowhq.com.
The controller is established in the EU, so this notice does not name an Article 27 representative. It does not name a data protection officer. Write to the contact address above.
What this site does
docflowhq.com is a marketing site for Docflow, governance for agent-led software. Clarity, the desktop companion, is in development. This site does not offer a download and does not create an account.
Contact form
The contact form asks for an email address, and optionally a name and a message. If the bot check passes, we keep the name, email, and message so we can read and answer you. We do not keep your IP address or your browser’s user agent with that message. We email a copy of the name, email, and message to info@docflowhq.com. Cloudflare sends that email, from forms@mail.docflowhq.com, with your address as the reply-to. Proton AG in Switzerland hosts that mailbox. Copies kept there stay for 24 months.
Name and message are optional. Email is required so we can reply. A submission that fails the bot check or the length checks is not kept.
Legal bases: legitimate interest in reading and answering the message (Article 6(1)(f) GDPR), and, when you write in order to take steps toward using Docflow, steps prior to a contract at your request (Article 6(1)(b)). We do not rely on legitimate interest for analytics.
Waitlist
The waitlist asks for an email address. We also record that the signup came from this website. If the bot check passes, we keep the email and that source. We email a copy to info@docflowhq.com. Cloudflare sends that email. Proton AG in Switzerland hosts the mailbox, and copies kept there stay for 24 months. A duplicate email is not stored twice. A failed check is not stored. We do not keep your IP address or your browser’s user agent with the signup.
We email you only when Docflow or Clarity is available, or about the waitlist itself. We do not email you about anything else unless you give new consent. Every waitlist email includes an unsubscribe link. You can withdraw at any time by emailing info@docflowhq.com. Withdrawal does not affect processing that already happened.
Legal basis: consent (Article 6(1)(a)).
Abuse limits
After a check passes, we store an HMAC of your IP address and the time. We use it only to enforce a limit of five submissions an hour. This is still personal data. We keep it for 24 hours, separate from contact and waitlist entries, and then delete it. We do not store this HMAC with your message or your waitlist signup.
Legal basis: legitimate interest in keeping the forms from being flooded (Article 6(1)(f)).
Turnstile
Both forms use Cloudflare Turnstile. Cloudflare processes the challenge data on our behalf. Cloudflare is also an independent controller when it uses challenge signals to improve its own bot detection, as described in Cloudflare’s Turnstile privacy addendum. The check can include your IP address. We do not keep the check with your submission.
Legal basis: legitimate interest in rejecting automated submissions (Article 6(1)(f)). The check is required to use the forms. It is not used to advertise to you.
Cookies and analytics
A cookie banner asks before analytics runs. Analytics is off until you opt in. Cloudflare Zaraz stores that choice. We also store the date of the choice in a cookie named df_consent_at, and we ask again after 12 months. Google Analytics 4 loads only after you accept analytics. Google acts as our processor for that analytics data under the Google Analytics data processing terms. Google Signals and ads data sharing are off. Analytics data is kept for 14 months. The _ga cookie expires after 13 months when this site’s cookie lifetime setting applies, and otherwise after 2 years, which is Google’s documented default.
Legal basis for analytics: consent (Article 6(1)(a), and the ePrivacy rule for storing or reading non-essential cookies). You can refuse analytics, and you can change the choice later. The footer link “Cookie preferences” opens this banner.
Essential cookies remember the choice and the date you made it. Cloudflare may also set __cf_bm, a security cookie that lasts 30 minutes, whether or not you accept analytics. Turnstile may set cookies on Cloudflare’s domain when you use a form. Those are not analytics, and they do not wait for analytics consent.
| Cookie | Who | Purpose | Lifetime |
|---|---|---|---|
| zaraz-consent | Cloudflare Zaraz | Stores the consent choice. The value maps a purpose, such as VeFE, to true or false. We ask for consent again once the date in df_consent_at is 12 months old. | Set by Cloudflare Zaraz; see Cloudflare’s documentation. |
| cf_zaraz_client | Cloudflare Zaraz | Zaraz client identifier. | Set by Cloudflare Zaraz; see Cloudflare’s documentation. |
| cfz_google-analytics | Cloudflare Zaraz | Used with Google Analytics. Set only after Accept all. | Set by Cloudflare Zaraz; see Cloudflare’s documentation. |
| df_consent_at | This site | Stores the UTC date of your cookie choice. We ask for consent again once this date is 12 months old, even though this cookie lasts 400 days. Written when you accept analytics, reject analytics, or save a choice. The value is a date, not an identifier. | 400 days. We ask again after 12 months. |
| _ga | Google Analytics 4 | Distinguishes browsers. Set only after Accept all. | 13 months when this site’s cookie lifetime setting applies. Otherwise 2 years, Google’s documented default. |
| __cf_bm | Cloudflare | Bot management. Not analytics. Set whether or not you accept analytics. | 30 minutes |
How long we keep it
Contact form entries and waitlist entries are kept for 24 months. The abuse-limit HMAC is kept for 24 hours. Google Analytics data is kept for 14 months.
- Contact entry (name, email, message): 24 months from the day of the submission, then delete, unless a legal claim requires a specific message to be kept longer.
- The contact or waitlist copy in the info@docflowhq.com mailbox, hosted by Proton AG: 24 months, then delete.
- Waitlist entry (email, and that the signup came from this website): 24 months. You can withdraw consent sooner by emailing info@docflowhq.com. Withdrawal does not affect processing that already happened.
- Abuse-limit HMAC of the IP address: 24 hours, then delete. Used only to enforce five submissions an hour. This is still personal data.
- Google Analytics 4 data: 14 months. Nothing is sent to Google Analytics before analytics consent.
- Cloudflare request logs stay with Cloudflare for its own operation of the network. We do not copy raw IP addresses from those logs into our form entries.
Recipients and transfers
Cloudflare, Inc. hosts the site, stores the form entries, runs Turnstile and Zaraz, and sends the form email. Proton AG (Switzerland) hosts the info@docflowhq.com mailbox, where copies of contact and waitlist messages are kept for 24 months. Google LLC receives Google Analytics 4 data only after you accept analytics. Google acts as our processor for that data under the Google Analytics data processing terms. Google Signals and ads data sharing are off. Google is not a processor for the contact form or the waitlist.
Cloudflare and Google are in the United States and are certified under the EU-US Data Privacy Framework. For those transfers we rely on the European Commission’s adequacy decision under Article 45 GDPR. Standard Contractual Clauses are the fallback if a transfer is not covered by that decision. Proton AG is covered by the European Commission’s adequacy decision for Switzerland.
Public materials: the Cloudflare customer DPA, the Data Privacy Framework list, and Google’s business privacy site.
Your rights
If the GDPR applies, you can ask for access, correction, deletion, restriction, or a portable copy of personal data we hold about you. You can withdraw consent for the waitlist and for analytics at any time. We do not make decisions that produce legal effects about you by automated means. The bot check only decides whether a submission is accepted.
We reply within one month, which is the period in Article 12 GDPR. That period can be extended by two further months for a complex request. We will say so if that happens.
You can complain to the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon (AKI), at aki.ee. You can also complain to the authority where you live or work.
Right to object
You have the right to object, on grounds relating to your particular situation, to processing based on legitimate interest, under Article 21 GDPR. That covers answering a contact message when we rely on legitimate interest, and the abuse limit. Where we process personal data for direct marketing, you can object at any time and we will stop that marketing. Waitlist email is only about Docflow or Clarity becoming available, or about the waitlist itself. Write to info@docflowhq.com.
Contact
Write to info@docflowhq.com.