Skip to content

Data Processing Addendum

Last updated: October 16, 2026

When your workflows handle personal data, such as the people who fill in your forms or the contacts a webhook sends you, Foliot processes that data on your behalf. This addendum explains how, as the GDPR (Article 28) requires, alongside our Terms of service. To make it part of your agreement with us, or to get a signed copy, email hello@usefoliot.com.

1. Who’s who

  • You, the Foliot account holder, are the controller of the personal data your workflows handle (“your data” below).
  • Foliot, run by Vlad Poncea, an individual based in Romania, is your processor.

Your own account details (your email, name and billing) are a different matter: for those Foliot is the controller, as the Privacy policy explains.

2. What we process, and why

  • Subject matter and purpose: running the workflows you build: receiving trigger data (webhooks, form submissions, schedules, new rows in Google Sheets), passing it through your steps, sending it where you tell us, and keeping run history so you can see what happened.
  • Types of data: whatever you put through your workflows. Typically names, email addresses, other contact details, form answers and message contents.
  • People concerned: whoever that data is about, such as your customers, leads, form respondents or colleagues.
  • Sensitive data: Foliot isn’t built for special categories of data (such as health data). Don’t send it through your workflows unless you’ve decided that’s appropriate.

3. How long

For as long as you have a Foliot account. Run history is deleted automatically 30 days after a run finishes. When you delete a workflow, a connection or your whole account, its data is deleted right away; copies in the database’s restore history expire on their own within 7 days.

4. What we promise

  • Your instructions only. We process your data only to run Foliot for you, as you set up your workflows and as these terms describe, unless the law requires otherwise (we’d tell you, where we’re allowed to). If we think an instruction breaks data protection law, we’ll tell you.
  • Confidentiality. At Foliot, only Vlad Poncea has access to your data, and only to run, support or secure Foliot. He is bound by confidentiality.
  • Security. We keep appropriate technical and organisational measures in place, including: HTTPS everywhere; connection secrets encrypted at rest with AES-256-GCM and kept out of run history; sign-in by single-use email links, with no passwords; hosting and the database in the EU; automatic deletion of run history after 30 days; and every admin “view as user” session logged. The Security page has the details.
  • Subprocessors. You allow us to use the providers listed in our subprocessors list. Each processes data under its own data processing terms. Before adding or replacing one, we’ll email you, so you can object; if we can’t resolve it, you can delete your account. We remain responsible for our subprocessors.
  • Helping you. We’ll help you answer requests from the people your data is about, and with security, breach notifications and data protection impact assessments, as far as we reasonably can given what Foliot does. Much of this you can do yourself: edit or delete workflows, connections and your account, and download your data from Settings.
  • Breaches. If a personal data breach affects your data, we’ll email you without undue delay after we become aware of it, with what we know and what we’re doing about it.
  • Deletion at the end. When you delete your account, we delete your data, except where the law requires us to keep it. Download your data first if you want a copy.
  • Audits. On request, we’ll give you the information you reasonably need to check that we keep these promises, such as written answers to your questions. Any other audit is by agreement, with reasonable notice, and at your cost.

5. Data outside the EU

Your data is hosted and stored in the EU: Vercel in Frankfurt, Neon in Frankfurt and Resend in Ireland. A few providers may process data in the United States, and only when you use what they do:

  • Google, when a workflow reads or writes your Google Sheets;
  • Anthropic, when an “Ask AI” step runs or you test it;
  • Forward Email and Gmail, if you email us your data, for example in a support request.

These transfers rely on the European Commission’s Standard Contractual Clauses, or on the EU-U.S. Data Privacy Framework where the provider is certified under it, as set out in each provider’s own data processing terms. Foliot itself holds no security certifications.

6. Your part

You’re responsible for having a lawful basis for the data you send through Foliot, for telling people how you use it (for example on your forms), and for the services you send it on to with your workflows.

7. The rest

Liability, governing law and changes work as in the Terms of service. If this addendum and the Terms disagree about personal data you’re the controller of, this addendum wins. Questions: hello@usefoliot.com.