Privacy and GDPR
This page explains how sol2flow handles personal data, for administrators of self-hosted instances and for customers of the cloud edition. It describes what the software does; it isn't legal advice.
Who is responsible
- Self-hosted: whoever runs the instance is the controller under the GDPR for all data in it. The sol2flow project receives nothing from your instance: no telemetry, no update checks, no external fonts or scripts. sol2flow only contacts services you configure yourself (see Third parties).
- Cloud edition: for the content your organization puts into its workspaces, your organization is the controller and the cloud operator processes it on your behalf (a data processing agreement, Art. 28 GDPR, is available from the operator). For accounts, billing and the security of the service, the operator is the controller; see its privacy policy.
What is stored
| Data | Notes |
|---|---|
| Account: name, username, email address, profile photo, language, theme, time zone | Editable in Settings → Profile and Settings → Preferences |
| Sign-in: password (hashed), single sign-on identity, two-factor setup, passkeys, API keys | Only hashes or encrypted values; never readable passwords or keys |
| Sessions: IP address, browser, times | Listed in Settings → Security |
| Devices and places of sign-ins: browser and operating system, country and city, first and last time, how often | For alerts about unusual sign-ins; no IP address or full browser string is kept |
| Workspace content: tasks, comments, checklists, attachments, time entries, activity | Belongs to the workspace |
| Notifications, invitations, join requests | Invitations contain the invited address |
| Audit log: security and administration events with IP address and browser | Readable by Owner, Admin and Auditor staff; workspace admins see their workspace without IPs |
| Organizations and billing: company, address, VAT ID, billing email, invoices | Card data never reaches sol2flow; payment providers handle it |
| Contact form messages: name, email, company, message, shortened IP address | Only if you use the contact form |
How long it is kept
| Data | Kept for | Setting |
|---|---|---|
| Audit log | 30–3650 days, default 365 | Admin → General → Audit log |
| Contact form messages | 30–3650 days, default 365; spam 30 days | Admin → General → Contact form |
| Deleted workspaces | Restorable for 1–365 days, default 30, then purged with their files | Admin → General → Data & legal |
| Exports | 7 days | — |
| Sessions | Until sign-out or expiry (12 hours, or 30 days with "Remember me") | — |
| Devices and places of sign-ins | 180 days after the last sign-in from them | — |
| Sign-ups never confirmed | 7 days | — |
| Invitations that ended | 90 days after they were accepted, declined, revoked or expired | — |
| Notifications | Read: 90 days; unread: 1 year | — |
| People listed in finished imports | 90 days | — |
| Background jobs (e.g. queued email) | About a week | — |
| Log files | The newest LOG_FILE_MAX_FILES files (default 10) | Configuration |
| Accounts and workspace content | Until deleted | — |
| Invoices | Not deleted automatically: tax law requires keeping them | Delete them yourself when the legal period has ended |
A daily cleanup deletes what has reached its limit. Your backups keep data until they rotate out; see Backups and upgrades.
Export, correct and delete
| Request | How |
|---|---|
| A copy of someone's data | They choose Settings → Your data → Download my data: a ZIP with their profile, memberships, comments, time entries, notifications, sessions, security log and more |
| A copy of a workspace | Its admins choose Settings → Workspace → Import & export → Export workspace |
| Correct data | People edit their profile themselves; staff can edit accounts in Admin → Users |
| Delete an account | Settings → Your data → Delete account, or staff in Admin → Users → Delete user |
| Delete a workspace | Its admins in Settings → Workspace → General, or staff in Admin → Workspaces; purged after the grace period |
| Stop task-update emails | Settings → Notifications (each person), or for the whole instance in Admin → General |
| Block an account without deleting | Staff disable it in Admin → Users |
| A contact form message | Staff find and delete it in Admin → Messages |
When an account is deleted, its content in shared workspaces stays and is shown as "Deleted user"; audit log entries keep only the account's ID until the audit log retention removes them; invoices of an organization are kept because the law requires it. Details: Data export and deletion.
Cookies and browser storage
sol2flow only uses cookies and browser storage that are needed for it to work or that remember a choice the person made: the sign-in session, short-lived cookies during sign-in and email confirmation, the language, the theme, the time zone, the last workspace and board view. None are used for tracking or advertising, so no consent banner is needed. The documentation and the sol2flow website set no cookies; they only remember the theme in the browser's local storage.
Third parties
Nothing is sent anywhere unless you configure it:
- Email delivery (your SMTP server or a provider such as Amazon SES): recipients' addresses and the email content.
- File storage if you use S3-compatible storage: attachments, photos, exports.
- Error tracking if you set
SENTRY_DSN: error messages and stack traces, without user details, IP addresses, cookies or request bodies. - Single sign-on providers you add.
- A location source for sign-in alerts, if you set one (Configuration): Cloudflare's location headers, or a GeoLite2 / DB-IP file read on your own server (nothing leaves it).
- Payment providers (Stripe, PayPal, Blockonomics) if you enable billing, and the EU's VIES service to check VAT IDs.
- Webhooks that workspace admins set up.
sol2flow uses no analytics, no external fonts or CDNs, no remote avatars (such as Gravatar) and no embeds. Your hosting provider, reverse proxy or CDN sees all traffic: include them in your contracts.
Legal links
Under Admin → General → Data & legal you can set a Privacy policy URL, a Terms of service URL and an Imprint URL. They're linked below the sign-in and sign-up forms and, for signed-in people, under Settings → Your data → Legal. When a privacy policy or terms link is set, new accounts must accept it, and the time is recorded. See Instance settings.
Your checklist as the operator
sol2flow gives you the tools; these are yours to do, with legal advice where needed:
- Publish a privacy policy and link it (above). Describe the data and retention on this page with the values you chose, your processors, your backups and how people can use their rights.
- Publish an imprint if the law requires one (in Germany, § 5 DDG).
- Sign processor agreements with the services you use (hosting, email, storage, backups, error tracking) and, if you host for others, offer them a data processing agreement.
- Keep records of processing activities (Art. 30 GDPR).
- Protect the server: HTTPS at your reverse proxy (see Reverse proxy), encrypted disks and backups, a strong
APP_ENCRYPTION_KEY, updates. - Configure email before going live: without a mail server, sol2flow writes emails, including sign-in links, to its log.
- Have a breach procedure: the audit log (sign-ins, failed sign-ins, security changes, staff actions, with IP addresses) helps to find out what happened; keep its retention long enough for that. Personal data breaches must usually be reported to the supervisory authority within 72 hours.