Privacy Policy

This Workflow Rush Privacy Policy explains how Workflow Rush handles personal information when you visit workflowrush.com, communicate with us, or participate in an enterprise AI services engagement. It distinguishes website and business-contact data from client content, model inputs and outputs, service telemetry, and customer-directed processing. Contract terms and applicable law may provide additional rules.

What does the Workflow Rush Privacy Policy cover?

The Workflow Rush Privacy Policy covers personal information handled through the Workflow Rush website, business communications, proposals, service delivery, and managed operations. It applies to website visitors, prospects, customers, customer personnel, suppliers, and other people who interact with Workflow Rush.

In this policy, personal information means information that identifies, relates to, describes, or can reasonably be linked with an individual. The term can also include personal data or a similar term under applicable law.

Workflow Rush means the organization operating workflowrush.com and providing the relevant services. If a proposal, statement of work, data processing agreement, or service agreement identifies a specific contracting entity, that document controls for the applicable engagement.

This policy does not replace a customer contract. Service agreements, documented customer instructions, deployment specifications, and data processing terms govern client content and operational data. If those terms conflict with this policy, the contract controls to the extent permitted by law.

What data roles does Workflow Rush have?

Workflow Rush generally determines why and how website-visitor, prospect, and business-contact information is processed. Its role for client content depends on the service, deployment boundary, contract, and customer instructions.

A controller is an organization that determines the purposes and means of processing. A processor, service provider, or equivalent role handles information on behalf of another organization and under its instructions. These terms can vary by jurisdiction.

For an enterprise service engagement:

• The customer generally controls the business purpose, source systems, authorized data, users, decision boundaries, and required human review.
• Workflow Rush processes client content according to the applicable agreement, approved architecture, and documented instructions.
• Private, single-tenant, customer-managed cloud, or on-premise deployments can change which information Workflow Rush or its providers can access.
• Customer-managed systems may remain outside Workflow Rush's operational boundary. The deployment documents define the actual boundary.

What personal information does Workflow Rush collect?

Workflow Rush collects information submitted through its forms and communications, information generated when the website or a service is used, and information supplied by a customer for an authorized engagement. The exact categories depend on the interaction and agreed scope.

Information submitted directly can include a name, work email, optional phone number, company or role information, and message content. Workflow assessment forms can also request the workflow to assess, systems involved, named business owner, current baseline or bottleneck, deployment boundary, and required decision controls.

Technical information can include an IP address, browser and device data, timestamps, pages requested, referring information, form-delivery events, and security logs where generated by the website or its infrastructure.

A customer may provide information about its personnel, authorized users, suppliers, or customers when that information is required for an approved engagement. The customer is responsible for having authority to provide that information and for limiting it to the agreed scope.

General website forms are not intended for sensitive personal information. Do not submit health, financial-account, government-identifier, biometric, precise-location, or similarly sensitive data through a general inquiry unless Workflow Rush has requested it through an agreed and protected process.

How does Workflow Rush use personal information?

Workflow Rush uses personal information for defined operational purposes rather than for unrestricted reuse. The applicable purposes depend on how the information was collected and the governing agreement.

Workflow Rush can process information to:

• Respond to questions, assess fit, and scope one critical workflow.
• Prepare proposals, statements of work, and service agreements.
• Design, integrate, test, deploy, monitor, and support contracted workflows.
• Authenticate users, administer access, and maintain service records.
• Monitor availability, quality, failures, exceptions, human overrides, and agreed outcome metrics.
• Protect the website, services, customers, and connected systems from misuse or security threats.
• Maintain accounting, contractual, audit, dispute, and legal records.
• Send requested communications and manage communication preferences.
• Meet legal obligations and enforce applicable agreements.

Where a legal basis is required, it can include consent, steps requested before entering a contract, performance of a contract, compliance with law, or legitimate interests such as operating and protecting the business. The applicable basis depends on the jurisdiction and processing context.

Workflow Rush does not use website inquiry data under this policy for solely automated decisions that produce legal or similarly significant effects. If a client workflow involves consequential automated processing, the contract and workflow design must define decision authority, human review, evidence, overrides, and escalation paths.

Does Workflow Rush use personal information to train AI systems?

This policy does not authorize Workflow Rush to use website inquiry data, client content, model inputs, or model outputs to train a general-purpose AI model. Any training, fine-tuning, model improvement, evaluation, or reuse involving client data must be expressly documented in the applicable agreement and customer instructions.

Service telemetry can be processed to operate, secure, monitor, and support an agreed workflow. When telemetry contains personal information, it remains subject to this policy and the applicable contract.

When third-party model or infrastructure providers are part of an implementation, the approved architecture should identify the relevant provider, deployment region, data path, access boundary, retention configuration, and available data-use controls. A private deployment option does not by itself establish every privacy control. The implemented architecture and contract define the actual boundary.

Does Workflow Rush use cookies or similar technologies?

Cookies and similar technologies may support core website delivery, security, preference storage, form operation, and, if configured, website measurement. The technologies in use can change as the website configuration changes.

Where applicable law requires consent, non-essential technologies should be activated only after the required choice is provided. Visitors can also use browser settings to block or delete cookies, although doing so can affect site or form functionality.

Workflow Rush does not link to a separate cookie notice or preference tool from this policy unless that resource is published and maintained.

Does Workflow Rush share personal information with service providers?

Workflow Rush can disclose personal information to service providers and subprocessors when they are needed for a defined website, business, or service-delivery purpose. A service provider performs a function for Workflow Rush, while a subprocessor processes customer-directed data as part of a contracted service.

Recipient categories can include:

• Website hosting, form processing, communications, cloud infrastructure, observability, security, and support providers.
• Model, data, or integration providers approved for a specific customer architecture.
• Professional advisers such as legal, accounting, insurance, and audit providers when their work requires access.
• Government authorities or other parties when disclosure is required by law or necessary to protect rights, safety, systems, or users.
• A buyer, investor, lender, or adviser involved in a proposed business transaction, subject to appropriate confidentiality and legal requirements.
• Customer-designated users, systems, or recipients required to execute the contracted workflow.

Workflow Rush limits disclosure to the information reasonably needed for the stated purpose. This policy does not grant permission to sell personal information or allow recipients to use it for unrelated advertising. Some recipients can have independent legal obligations that apply to their processing.

Is personal information processed internationally?

Personal information can be processed outside the country where it was collected when a customer, provider, or approved deployment operates in another jurisdiction. Where transfer rules apply, Workflow Rush uses the safeguards required for the relevant context, which can include contractual protections or another legally recognized transfer mechanism.

The service agreement and deployment documentation should identify material processing locations and customer-specific transfer requirements.

How long does Workflow Rush retain personal information?

Workflow Rush retains personal information only for as long as reasonably needed for the collection purpose, the customer relationship, the applicable contract, security and audit requirements, dispute management, or legal obligations. No single period applies to every category or engagement.

Retention decisions consider:

• Whether an inquiry, contract, or service engagement remains active.
• The amount, nature, and sensitivity of the information.
• The purpose for which the information was collected.
• Customer return, deletion, preservation, or export instructions.
• Security, incident, audit, accounting, and recordkeeping requirements.
• Applicable limitation periods and legal duties.

Where a contract specifies return or deletion of client content, that term controls. Backups, security logs, and records required to establish or defend legal claims can follow separate schedules. Workflow Rush should not publish a fixed deletion schedule unless it is implemented and supportable.

How does Workflow Rush protect personal information?

Workflow Rush applies administrative, technical, and organizational safeguards appropriate to the processing context and agreed architecture. No safeguard can eliminate every risk, and this policy does not promise absolute security.

Depending on the service and deployment, safeguards can include identity and access controls, least-privilege permissions, environment separation, encryption in transit and at rest where supported, logging, audit trails, monitoring, backup and recovery processes, controlled releases, incident procedures, and provider review.

The exact control set, deployment responsibility, and any independent assurance are described in applicable security documents or customer agreements. This policy does not claim a certification, audit result, or compliance status that is not specifically documented. Additional information is available through the Security and Trust Center.

What privacy rights and choices are available?

Depending on applicable law and the processing context, an individual may have rights to request access, correction, deletion, portability, restriction, or objection. An individual may also be able to withdraw consent or appeal a denied request.

These rights are not absolute. Workflow Rush can retain or continue processing information where permitted or required by law, including for security, contracts, legal claims, or another valid basis.

If Workflow Rush handles information for a customer, the customer may be responsible for the request. Workflow Rush can direct the requester to that customer and assist as required by the applicable agreement.

Additional choices include:

• Use the unsubscribe method in a marketing message, if one is provided.
• Contact Workflow Rush to change communication preferences.
• Use available consent controls or browser settings for cookies and similar technologies.
• Avoid submitting optional information that is not needed for the request.
• Complain to an applicable data protection authority where that right is available.

How can I submit a privacy request to Workflow Rush?

Submit a privacy question or rights request through the Workflow Rush contact page. Use the following process so the request can be routed and reviewed efficiently.

• State that the message is a privacy request.
• Describe your relationship with Workflow Rush, such as website visitor, business contact, customer user, or former contact.
• Identify the right or action requested and the information involved.
• Provide a reliable contact method, but do not include passwords or unnecessary sensitive data.
• Respond to proportionate identity or authority verification if requested.

Workflow Rush responds within the period required by applicable law or contract. Where permitted, an authorized agent can submit a request, but Workflow Rush can require proof of authorization and verification of the individual. If an appeal process is required by law, the response will explain how to use it.

Does this policy apply to children or third-party websites?

The Workflow Rush website and enterprise services are not directed to children. Workflow Rush does not intentionally solicit personal information from children through general website forms. The age at which a person is legally considered a child depends on the applicable jurisdiction.

If you believe a child has provided personal information without appropriate