Draft. Under legal review. Operator: FOXIT SOL SRL (Romania). Last updated: 2026-08-07.
Legal Notice
In compliance with the e-commerce information duty (Directive 2000/31/EC and applicable law), here are the details of the operator of this website and of the DuctFlow application (https://ductflow.app):
- Operator: FOXIT SOL SRL (company incorporated in Romania)
- Registration (CUI): 55024880 (EUID ROONRC.J2026041641000)
- VAT No. (VIES): RO55348046
- Trade Register No.: J2026041641000
- Registered address: Voiteg, no. 141/A, 307470, Timiș county, Romania
- Contact email: support@ductflow.app
- Representative: Ingrid Murariu (managing director)
Hosting. The website and database are hosted in the European Union via Cloudflare, Inc. (pages and CDN) and Supabase (database, EU region — Stockholm, Sweden).
Intellectual property. The code, design, the «DuctFlow» brand, texts and images belong to FOXIT SOL SRL or its licensors. Reproduction without authorisation is prohibited.
Governing law. This Legal Notice is governed by Romanian law and by EU law, without prejudice to the consumer rights granted by the law of the user's country of residence.
Privacy Policy
FOXIT SOL SRL («DuctFlow», «we») respects your privacy and processes personal data under Regulation (EU) 2016/679 (GDPR) and applicable law.
1. Dual role: controller and processor
DuctFlow is a B2B tool. We act in two distinct capacities:
- As CONTROLLER — for the account data of our professional customers (workshops/companies): name, email, company, login credentials and technical usage data.
- As PROCESSOR — for the content data that the professional customer enters about their own end clients (name, tax ID, address, phone, email), projects, pieces, sketches and quotes. For this data the professional customer is the controller; we process it on their behalf and under their instructions, per the Data Processing Agreement (DPA).
2. Data we process and purposes
| Category | Data | Purpose | Legal basis (Art. 6) |
|---|---|---|---|
| Account (as controller) | Name, email, company, tax ID, password (hashed) | Create and manage the account, provide the service | Contract performance (6.1.b) |
| Usage and security | IP address, access logs, technical identifiers | Security, fraud prevention, maintenance | Legitimate interest (6.1.f) |
| Billing | Tax data (where applicable) | Invoicing, accounting obligations | Legal obligation (6.1.c) |
| Content (as processor) | Projects, end clients, pieces, sketches/drawings, quotes; time entries and geolocation (when clocking in and out) if the customer enables employee time tracking | Host and process data on behalf of the customer | Processing on behalf of the controller (Art. 28) |
We do not carry out automated decisions with legal effects or profiling. We do not sell personal data.
3. Retention
We keep data while the account is active. After closure, it is deleted within 90 days, except where the law requires retention (e.g. invoices). Backups rotate and are overwritten within a maximum of 35 days.
4. Recipients and processors (sub-processors)
To provide the service we use providers acting as processors/sub-processors, under a processing agreement with adequate safeguards:
- Supabase, Inc. — database, authentication and storage (EU region: Stockholm, Sweden).
- Cloudflare, Inc. — page hosting and content delivery.
- Zoho Corporation — domain email.
You may request the up-to-date list at support@ductflow.app.
5. International transfers
Data is hosted in the European Union (Stockholm region, eu-north-1). Some providers are US companies; where necessary, the transfer is covered by the European Commission's Standard Contractual Clauses (SCC) and supplementary measures, plus the DPA signed with each provider.
6. Your rights
Free of charge, you may exercise your rights of access, rectification, erasure, restriction, portability and objection, and withdraw consent, by writing to support@ductflow.app (mark it «Data protection»). We respond within one month.
If you are an end client of a workshop and wish to exercise your rights, contact the workshop (controller) that entered your data; we will support them as processor.
Time tracking and geolocation. If the professional customer enables employee time tracking, the employee's approximate location is recorded only at the moments of clocking in and out (no continuous tracking). DuctFlow processes this data as processor, on the employer's behalf; the employer is the controller and must inform its staff in advance and have a legal basis. The employee may deny the location permission, in which case the entry is recorded without location.
You have the right to lodge a complaint with the competent supervisory authority: the Romanian ANSPDCP (dataprotection.ro), the Spanish AEPD (aepd.es), or the authority of your country of residence.
7. Security
We apply appropriate technical and organisational measures: encryption in transit (TLS/HTTPS) and at rest, logical per-company data isolation (every query is scoped by company at the application layer, with server-side ownership checks), role-based access control, backups and access logging. The public client tracking link shows only progress and the final price, never costs or margins.
8. Minors
The service targets professionals; it is not intended for children under 16 and we do not knowingly collect their data.
9. Changes
We may update this policy. We publish the current version with its date; for material changes we notify you by an appropriate means.
Cookie and Local Storage Policy
DuctFlow uses only technical, necessary storage to work; we do not use analytics, advertising or tracking cookies.
| Type | Example | Purpose | Consent? |
|---|---|---|---|
| Local storage (localStorage) | App data, language | Make the app work and remember your work | No (technical) |
| Session token | Login session (authentication) | Keep you signed in | No (technical) |
Because this storage is strictly necessary, the law (GDPR/ePrivacy) does not require a consent banner. If we later add analytics or other non-essential cookies, we will ask for your prior consent.