docs(legal): add baseline legal documents (privacy, ToS, DPA, subprocessors, cookies)
All checks were successful
Mirror to GitHub / mirror (push) Successful in 6s
All checks were successful
Mirror to GitHub / mirror (push) Successful in 6s
Generated by the resolutionflow-legal skill from a code scan of the FastAPI
backend + React frontend on commit 0564646. Each document is a starting
point for attorney review, not legal advice.
Includes:
- privacy-policy.md, terms-of-service.md, cookie-policy.md (public-facing)
- dpa.md (contractual; signed with MSP customers)
- subprocessor-list.md (Railway, Anthropic, Voyage, Stripe, Resend, Sentry,
PostHog, Google Fonts — confirmed live as of scan)
- data-inventory.md + classification.md (Phase 1/2 working files)
- attorney-review-checklist.md (consolidated [LEGAL REVIEW] punch list)
- implementation-verification.md (claim-by-claim audit vs. actual code)
Three blocking issues filed before public publication:
- #175 deletion-on-offboarding (or rewrite retention claims)
- #176 narrow Sentry send_default_pii + Session Replay config
- #177 EU/UK consent for PostHog + Google Fonts
Public-facing documents intentionally route physical-mail requests through
support@ rather than publishing the LLC's registered address.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
154
legal/attorney-review-checklist.md
Normal file
154
legal/attorney-review-checklist.md
Normal file
@@ -0,0 +1,154 @@
|
||||
# Attorney Review Checklist
|
||||
|
||||
Generated: 2026-05-14
|
||||
Documents in scope:
|
||||
- [privacy-policy.md](privacy-policy.md)
|
||||
- [terms-of-service.md](terms-of-service.md)
|
||||
- [dpa.md](dpa.md)
|
||||
- [subprocessor-list.md](subprocessor-list.md)
|
||||
- [cookie-policy.md](cookie-policy.md)
|
||||
|
||||
This checklist consolidates every `[LEGAL REVIEW]` tag and every issue surfaced by the scan that needs attorney judgment, with enough context that an attorney can bill efficiently.
|
||||
|
||||
---
|
||||
|
||||
## A. Highest-priority items (block publication)
|
||||
|
||||
### A1. Implement deletion-on-offboarding OR rewrite retention claims
|
||||
|
||||
**Where:** Privacy Policy §6 (retention table + deletion paragraph); DPA §6.2 (return/deletion).
|
||||
**Issue:** Today, account "deletion" only soft-deletes the user row and revokes refresh tokens. The account row, audit logs, session content (`ai_sessions`, `sessions`, conversation transcripts, ticket snapshots, escalation packages), uploaded files in Railway Object Storage, AI usage records, sales leads, beta feedback, and notification history are **not** automatically purged.
|
||||
**Why this matters:** GDPR Art. 5(1)(e) "storage limitation" + DPA §6.2 require ResolutionFlow to delete or anonymize Customer Data after the export window. The current draft claims this happens. The code does not enforce it.
|
||||
**Two acceptable paths:**
|
||||
1. **Build the deletion job** (preferred): add a scheduled task that purges all account-scoped Customer Data 30 days after account deletion (or sooner on customer request), and revise the language only if the implementation differs from what's drafted.
|
||||
2. **Rewrite the language** to describe the actual behavior — "deletion on request, processed within X days" — and commit to an SLA the team can hit manually.
|
||||
|
||||
### A2. Sentry data-protection posture is broader than typical defaults
|
||||
|
||||
**Where:** Privacy Policy §3.2 ("Information we collect automatically" — error/performance monitoring paragraph); DPA Annex B; Subprocessor List Operational table.
|
||||
**Issue:**
|
||||
- Backend Sentry SDK is initialized with `send_default_pii=True` ([main.py:18](../backend/app/main.py#L18)) — user IDs and request fragments flow to Sentry by default.
|
||||
- Frontend Sentry Session Replay runs with `maskAllText: false, blockAllMedia: false` ([instrument.ts:9-12](../frontend/src/instrument.ts#L9-L12)) — replays may contain visible page text and media.
|
||||
**Why this matters:** Customer Data (ticket bodies, conversation content) can land in Sentry replays and error reports. Disclosing this is one option; the better path is narrowing the config first.
|
||||
**Recommended:** mask text on routes that render Customer Data; set `send_default_pii=False`; add Sentry data-scrubbing rules for `intake_content`, `conversation_messages`, `ticket_data`, `escalation_package`. Then the existing disclosure narrows naturally.
|
||||
|
||||
### A3. EU/UK consent banner is required before PostHog / Google Fonts can fire
|
||||
|
||||
**Where:** Privacy Policy §4 (legal-basis table), §10 (cookies); Cookie Policy §2.3, §3.1.
|
||||
**Issue:** PostHog is initialized unconditionally in [main.tsx:17-23](../frontend/src/main.tsx#L17-L23) with `persistence: 'localStorage+cookie'`. Google Fonts loads on every public page. For EU/UK visitors, both require prior consent under ePrivacy Directive Art. 5(3) / UK PECR.
|
||||
**Action:** implement a consent management mechanism (or geo-gate) before launching public-landing EU traffic, OR confirm the product is geo-blocked from EU/UK. The Cookie Policy already references a consent mechanism — wire it up or remove the reference.
|
||||
|
||||
### A4. Article 27 representative designation
|
||||
|
||||
**Where:** Privacy Policy §2 ("Who we are"), §13 ("Contact us — EU/UK").
|
||||
**Issue:** ResolutionFlow LLC has no EU or UK establishment. If EU/UK Data Subjects are reachable, GDPR Art. 27 / UK GDPR Art. 27 require designation of a written representative in the EU and (separately) in the UK.
|
||||
**Action:** either appoint representatives (commercial services exist for ~$500–$2,000/year per region) and update the contact section, or document a decision not to offer the Services to EU/UK Data Subjects and add a geo-gate.
|
||||
|
||||
### A5. Liability cap, indemnification, dispute resolution
|
||||
|
||||
**Where:** Terms of Service §10 (disclaimers), §11 (limitation of liability), §12 (indemnification), §13 (dispute resolution).
|
||||
**Issue:** All four sections contain industry-standard defaults but are commercial-risk decisions that depend on revenue, insurance, and counterparty appetite.
|
||||
**Specifically to calibrate:**
|
||||
- §11(b): "fees paid in the preceding 12 months" cap is a SaaS default; confirm.
|
||||
- §11(c) carve-outs: confirm the list (confidentiality, indemnity, DPA breach, gross negligence, willful misconduct, statutory non-limitable) matches insurer expectations.
|
||||
- §12.2: IP indemnity scope is US patents/copyrights/trademarks; confirm geographic and IP-type scope.
|
||||
- §13.1: governing law set to Georgia (LLC's state). Counsel may prefer Delaware.
|
||||
- §13.2: chose Cobb County, Georgia for venue (matches LLC location). Counsel may prefer arbitration (JAMS/AAA) for enterprise neutrality and cost predictability.
|
||||
|
||||
### A6. Address withholding on public docs
|
||||
|
||||
**Where:** Privacy Policy §2; ToS §14.7; DPA §9.4.
|
||||
**Issue:** User asked that the LLC's registered address (716 Hearthstone Xing, Woodstock, GA 30189 — home address) **not** appear on the website. The Privacy Policy and ToS therefore route physical-mail requests through `support@resolutionflow.com`. This is acceptable for routine inquiries but:
|
||||
- **CAN-SPAM** requires a physical postal address in every marketing email — flag if marketing emails are sent.
|
||||
- **Service of legal process** may require disclosure on demand; some states (e.g., DE) require a registered agent address publicly.
|
||||
**Recommendation:** retain a registered agent (Northwest, ZenBusiness, Harbor Compliance — ~$100-$250/year) and update all three documents to use the registered-agent address. This solves the privacy concern without compromising legal-process service.
|
||||
|
||||
---
|
||||
|
||||
## B. Important items (calibrate before contracting with enterprise)
|
||||
|
||||
### B1. Sub-processor notice period
|
||||
|
||||
**Where:** DPA §3.4.2.
|
||||
**Default chosen:** 30 days.
|
||||
**Note:** Enterprise MSP buyers often demand 60-90 days. Decide what you will accept.
|
||||
|
||||
### B2. Breach notification SLA
|
||||
|
||||
**Where:** DPA §3.7.
|
||||
**Default chosen:** 72 hours (GDPR baseline).
|
||||
**Note:** Some enterprise buyers demand 24-48 hours. Verify ResolutionFlow can detect and report within the chosen window.
|
||||
|
||||
### B3. SCC governing law / forum / supervisory authority
|
||||
|
||||
**Where:** DPA Annex D.
|
||||
**Default chosen:** Ireland (DPC) — most common.
|
||||
**Note:** Counsel may prefer another EU member state depending on Customer base.
|
||||
|
||||
### B4. Audit rights cost allocation
|
||||
|
||||
**Where:** DPA §3.8.2.
|
||||
**Default chosen:** Customer bears its own audit costs.
|
||||
**Note:** Some enterprise buyers will request a free audit or one funded by ResolutionFlow if findings are material.
|
||||
|
||||
### B5. Export window
|
||||
|
||||
**Where:** ToS §9.4; DPA §6.2.
|
||||
**Default chosen:** 30 days.
|
||||
**Note:** Confirm the export tooling actually supports a 30-day window. If not, reduce.
|
||||
|
||||
### B6. Refund / proration policy
|
||||
|
||||
**Where:** ToS §5.2.
|
||||
**Default chosen:** Non-refundable except where required by law.
|
||||
**Note:** Common alternatives: 14-day satisfaction window; prorated refund on annual plans; no refund on monthly plans. Decide and update.
|
||||
|
||||
### B7. Anthropic and Voyage no-training claims
|
||||
|
||||
**Where:** Privacy Policy §4 (no model training note); Subprocessor List AI section.
|
||||
**Status as of 2026-05-14:** Anthropic's commercial API tier does not train on customer data by default. Voyage AI's embedding API is similarly transactional.
|
||||
**Action:** before publication, re-verify each subprocessor's current public terms. Re-verify each time this list is republished.
|
||||
|
||||
---
|
||||
|
||||
## C. Documentation gaps to fix in the product before claiming
|
||||
|
||||
These are claims in the documents that aren't fully backed by code today. See [implementation-verification.md](implementation-verification.md) for the line-by-line picture. Pick "fix the code" or "rewrite the claim" for each:
|
||||
|
||||
| Claim in documents | Reality today | Recommended path |
|
||||
|---|---|---|
|
||||
| Account deletion deletes personal information within a defined window | Soft-delete of user only; account-scoped content retained indefinitely | **Fix the code** (A1) |
|
||||
| Audit logs retained for a defined period | Retained indefinitely; IP addresses included | **Fix the code** (add 12-month purge) or rewrite to "retained indefinitely for security purposes" |
|
||||
| Refresh / verification / password-reset tokens are purged after expiry | Rows persist; no cleanup job | Fix the code (add nightly purge of `WHERE expires_at < now() OR revoked_at IS NOT NULL`) |
|
||||
| File uploads are deleted on account deletion | No lifecycle policy on Railway Object Storage | Fix the code or document the actual retention |
|
||||
| Sales leads / beta feedback / survey responses purged on schedule | No purge job | Fix the code or document |
|
||||
| Encryption at rest (broad claim) | Railway encrypts at infra layer; only PSA credentials encrypted at app layer | Already disclosed accurately — verify Railway's attestation and keep the language as drafted |
|
||||
| Multi-factor authentication | Not implemented for direct logins; SSO available via Google/MS | Acceptable as drafted; consider requiring MFA for admins |
|
||||
| Microsoft Learn MCP no Customer Data egress | Verified: integration retrieves docs only | Disclosed accurately |
|
||||
|
||||
---
|
||||
|
||||
## D. Items left out by design (confirm)
|
||||
|
||||
- **Gemini (Google AI):** code path exists, no key in prod — omitted from Subprocessor List. Add when activated, with 30-day notice.
|
||||
- **Autotask, HaloPSA:** code stubs in `services/psa/` only — not active and not disclosed. Add when activated.
|
||||
- **OpenAI:** no key/code path detected — omitted.
|
||||
- **Microsoft Learn MCP:** disclosed as a non-subprocessor (read-only doc lookup, no Customer Data egress).
|
||||
- **ConnectWise:** correctly classified as customer-authorized data source, not a sub-processor.
|
||||
|
||||
---
|
||||
|
||||
## E. Sign-off checklist
|
||||
|
||||
Before publishing:
|
||||
|
||||
- [ ] A1 — deletion on offboarding implemented or language adjusted
|
||||
- [ ] A2 — Sentry config narrowed (or disclosure expanded)
|
||||
- [ ] A3 — EU/UK consent banner implemented (or geo-gate confirmed)
|
||||
- [ ] A4 — Art. 27 representatives appointed (or geo-gate confirmed)
|
||||
- [ ] A5 — liability / indemnity / dispute resolution calibrated with counsel
|
||||
- [ ] A6 — registered-agent address obtained; addresses updated
|
||||
- [ ] B1–B6 — commercial decisions confirmed
|
||||
- [ ] B7 — Anthropic + Voyage AI no-training stance re-verified within 30 days of publication
|
||||
- [ ] Implementation gaps in §C resolved (build or revise)
|
||||
- [ ] Effective Date and Version bumped on every material change going forward
|
||||
87
legal/classification.md
Normal file
87
legal/classification.md
Normal file
@@ -0,0 +1,87 @@
|
||||
# Phase 2 — Classification
|
||||
|
||||
Generated: 2026-05-14
|
||||
Based on: `data-inventory.md` (Phase 1) and user-confirmed answers to Section 7 questions.
|
||||
|
||||
## Confirmed parameters
|
||||
|
||||
| Parameter | Value |
|
||||
|---|---|
|
||||
| Legal entity | **ResolutionFlow LLC** |
|
||||
| Registered address (DPA only — not public) | 716 Hearthstone Xing, Woodstock, GA 30189 — **`[LEGAL REVIEW: replace with registered-agent address before publishing any contracts that include this]`** |
|
||||
| Privacy / legal contact | `support@resolutionflow.com` |
|
||||
| Jurisdictions in scope | US federal + state baseline, CCPA/CPRA, EU GDPR, UK GDPR, all in-force US state comprehensive privacy laws (VA, CO, CT, UT, TX, OR, MT, IN, IA, TN, DE, NH, NJ, MD, MN, RI, KY). Reachable from anywhere the US permits traffic. |
|
||||
| Live LLM provider | **Anthropic only** (current). Future plans: BYOK + multi-LLM — disclose only Anthropic now; revise on rollout. |
|
||||
| Live embedding provider | **Voyage AI** (key set) |
|
||||
| Gemini | Code path present but not currently live — **exclude from public Subprocessor List** until activated. |
|
||||
| Active PSA provider | **ConnectWise only** (Autotask + HaloPSA stubs not live). |
|
||||
| Sentry region | US |
|
||||
| Railway region | US |
|
||||
| Microsoft Learn MCP | Enabled. Pulls Microsoft docs; no Customer Data egress — disclose as informational only, not a Customer-Data subprocessor. |
|
||||
| Children's data | None — disclaim under 16 / COPPA. |
|
||||
| Public surfaces | Marketing pages, sales-lead form, signup, and public flow shares only. |
|
||||
| Backup retention | 90 days. |
|
||||
| Third-party tools outside the codebase (Zapier, CRM, etc.) | None at this time. |
|
||||
|
||||
## Controller vs Processor mapping
|
||||
|
||||
| Data category | RF role | Controller | Notes |
|
||||
|---|---|---|---|
|
||||
| User accounts (name, email, password_hash, profile) | **Controller** | ResolutionFlow LLC | Covered by Privacy Policy |
|
||||
| Audit logs (incl. IP addresses) | **Controller** | ResolutionFlow LLC | Privacy Policy; legal basis = legitimate interests (security) |
|
||||
| Telemetry (PostHog, Sentry, AI usage tracking) | **Controller** | ResolutionFlow LLC | Privacy Policy; legitimate interests + consent for analytics in EU/UK |
|
||||
| Marketing leads (`sales_leads`, beta signup) | **Controller** | ResolutionFlow LLC | Privacy Policy; legitimate interests / consent |
|
||||
| Billing / subscription / Stripe IDs | **Controller** | ResolutionFlow LLC | Privacy Policy; contract performance |
|
||||
| **PSA-derived ticket data, intake_content, conversation_messages, file uploads, escalation packages, resolution notes, embeddings derived from this content** | **Processor** | The MSP customer | DPA-governed. RF acts on documented instructions. |
|
||||
| Knowledge Flywheel / flow content authored within a tenant | **Processor** | The MSP customer | Tenant-isolated; no cross-tenant sharing detected. |
|
||||
| Resolution-note writeback to ConnectWise | **Processor** | The MSP customer | RF writes to the customer's own ConnectWise tenant under instruction. |
|
||||
|
||||
## Under CCPA/CPRA
|
||||
|
||||
- ResolutionFlow is a **Business** for: user account data, marketing data, billing, telemetry.
|
||||
- ResolutionFlow is a **Service Provider** for: all Customer Data routed through the Services (covered by DPA, which serves as the written contract required by CCPA §1798.140(ag)).
|
||||
- ResolutionFlow **does not sell or share** personal information for cross-context behavioral advertising.
|
||||
|
||||
## Legal-basis assignments (GDPR Art. 6)
|
||||
|
||||
| Purpose | Legal basis |
|
||||
|---|---|
|
||||
| Provide the Services to the user / MSP | Contract performance (Art. 6(1)(b)) |
|
||||
| Authenticate, secure, prevent fraud | Legitimate interests (Art. 6(1)(f)) — balancing test documented |
|
||||
| Transactional email (invites, password resets, billing) | Contract performance |
|
||||
| Marketing email | Consent (Art. 6(1)(a)) **`[LEGAL REVIEW: confirm whether RF is sending marketing emails today and obtain consent at the appropriate touchpoint]`** |
|
||||
| Product analytics (PostHog) and error tracking with PII (Sentry `send_default_pii=True`) | Legitimate interests + consent where required for non-essential cookies (EU/UK) **`[LEGAL REVIEW: a consent banner is required before PostHog/cookie-persisted analytics fire for EU/UK visitors]`** |
|
||||
| AI / LLM features | Contract performance (it's part of the Services) |
|
||||
| Aggregated product improvement | Legitimate interests |
|
||||
| Comply with legal requests | Legal obligation (Art. 6(1)(c)) |
|
||||
|
||||
## International transfer mechanism
|
||||
|
||||
- **EU/UK → US transfers** rely on **Standard Contractual Clauses (Module 2 / Module 3 as applicable) + UK Addendum**. **`[LEGAL REVIEW: consider EU-US Data Privacy Framework certification when ResolutionFlow LLC qualifies — it materially improves the transfer story]`**
|
||||
- All current subprocessors host in the US. SCCs are the baseline transfer mechanism for each.
|
||||
|
||||
## Sensitive-category posture
|
||||
|
||||
- ResolutionFlow does **not** intentionally collect GDPR Art. 9 special categories or CPRA "sensitive PI."
|
||||
- **Incidental collection risk:** free-text fields (`intake_content`, `conversation_messages`, `session_feedback`, `outcome_notes`) can incidentally contain anything an MSP technician types — including healthcare details if the MSP serves healthcare clients. This is the basis for the ToS prohibition on PHI / regulated-data submission without a BAA in place.
|
||||
|
||||
## HIPAA / PCI posture
|
||||
|
||||
- **HIPAA:** ResolutionFlow is **not currently HIPAA-compliant**. ToS will prohibit PHI submission absent a BAA.
|
||||
- **PCI:** SAQ A scope — Stripe Elements handles card data; ResolutionFlow stores only Stripe IDs.
|
||||
|
||||
## Children's data
|
||||
|
||||
- B2B IT-professional tool. Disclaim under 16 / COPPA in Privacy Policy.
|
||||
|
||||
## Open commercial / legal decisions punted to attorney
|
||||
|
||||
Captured for the attorney-review checklist (Phase 4) — not blockers for generation:
|
||||
|
||||
- Governing law + venue / arbitration vs litigation
|
||||
- Liability cap calibration
|
||||
- Indemnification scope
|
||||
- Refund / proration policy
|
||||
- Article 27 EU representative designation
|
||||
- Whether to pursue EU-US DPF certification
|
||||
- Whether to use a registered-agent address for the LLC on public + contractual docs
|
||||
104
legal/cookie-policy.md
Normal file
104
legal/cookie-policy.md
Normal file
@@ -0,0 +1,104 @@
|
||||
# Cookie Policy
|
||||
|
||||
**Effective Date:** 2026-05-14
|
||||
**Version:** 1.0
|
||||
|
||||
> **DRAFT — not legal advice.** This document was generated from a code scan and is intended for review by a qualified attorney before publication.
|
||||
|
||||
This Cookie Policy explains how ResolutionFlow LLC ("ResolutionFlow," "we," "us," or "our") uses cookies and similar technologies on the ResolutionFlow website and Services.
|
||||
|
||||
## 1. What are cookies and similar technologies?
|
||||
|
||||
Cookies are small text files stored on your device when you visit a website. We also use related technologies, including:
|
||||
|
||||
- **Local storage and session storage** — browser storage similar to cookies but typically larger and not sent on every request
|
||||
- **Software development kits (SDKs)** — code that collects information from your browser as you use a website
|
||||
|
||||
For simplicity, we use "cookies" to refer to all of these throughout this policy unless we note otherwise.
|
||||
|
||||
## 2. Cookies and storage we use
|
||||
|
||||
We categorize browser storage by purpose. Where applicable laws require consent for non-essential cookies and storage, we will obtain consent before setting them. `[LEGAL REVIEW: a consent banner is required before PostHog and any non-essential analytics fires for EU/UK visitors]`
|
||||
|
||||
### 2.1 Strictly necessary
|
||||
|
||||
These items are essential for the Services to function. They cannot be disabled while you use the Services.
|
||||
|
||||
| Name / pattern | Type | Set by | Purpose | Duration |
|
||||
|---|---|---|---|---|
|
||||
| `access_token` | localStorage | ResolutionFlow (first-party) | Holds your short-lived API access token so you stay signed in across pages and reloads | Until logout / token expiry |
|
||||
| `refresh_token` | localStorage | ResolutionFlow (first-party) | Used to obtain a new access token without re-entering your password | Until logout or session limit (default 14 days absolute, 3 days idle) |
|
||||
|
||||
**Note on storage choice.** We deliberately store these tokens in your browser's `localStorage` rather than in HTTP-only cookies. Tokens in `localStorage` are accessible to JavaScript running on the page, so a cross-site-scripting (XSS) attack against the Services could expose them. We mitigate this risk with content-security headers, short access-token lifetimes, idle and absolute session limits, and the ability to revoke all sessions on password change.
|
||||
|
||||
### 2.2 Functional / preference
|
||||
|
||||
These items are not strictly necessary but disabling them reduces functionality.
|
||||
|
||||
| Name | Type | Set by | Purpose | Duration |
|
||||
|---|---|---|---|---|
|
||||
| `theme-storage` | localStorage | ResolutionFlow (first-party) | Remembers your dark / light theme preference | Persistent |
|
||||
| `rf-editor-fullscreen` | localStorage | ResolutionFlow (first-party) | Remembers whether you prefer fullscreen editor mode | Persistent |
|
||||
| `rf-intended-plan` | localStorage | ResolutionFlow (first-party) | Carries a pricing-page selection into the signup flow | Cleared after signup |
|
||||
| `recentFlows` storage key | localStorage | ResolutionFlow (first-party) | Remembers the flows you've recently opened so the navigation MRU works | Persistent |
|
||||
| "Step feedback hint shown" flag | localStorage | ResolutionFlow (first-party) | Hides a one-time coachmark after you've seen it | Persistent |
|
||||
| "Rated sessions" list | localStorage | ResolutionFlow (first-party) | Suppresses the post-session rating prompt for sessions you've already rated | Persistent (capped at 100 entries) |
|
||||
| "Escalation queue seen" set | localStorage | ResolutionFlow (first-party) | Marks notifications you've seen so badges clear correctly | Persistent |
|
||||
|
||||
### 2.3 Analytics
|
||||
|
||||
These items help us understand how the Services are used so we can improve them. They are set only with your consent in jurisdictions that require it. `[LEGAL REVIEW: the consent banner described here is not currently implemented]`
|
||||
|
||||
| Name | Type | Set by | Purpose | Duration |
|
||||
|---|---|---|---|---|
|
||||
| `ph_*` (e.g., `ph_<token>_posthog`) | Cookie + localStorage | PostHog (third-party) | Identifies your browser to PostHog so we can attribute events to a stable identifier, capture page views, autocapture interactions, and report Web Vitals. The cookie is set because we configure PostHog with `persistence: 'localStorage+cookie'`. | Up to 12 months |
|
||||
|
||||
We also use Sentry to monitor errors and a sampled subset of browser sessions (1% of normal sessions, 100% of sessions in which an error occurs). Sentry does not set tracking cookies but does collect telemetry about your browser interactions during sampled sessions. See the [Privacy Policy](privacy-policy.md) and our [Subprocessor List](subprocessor-list.md).
|
||||
|
||||
### 2.4 Advertising
|
||||
|
||||
We do not use advertising cookies, advertising pixels, or cookies for cross-context behavioral advertising.
|
||||
|
||||
### 2.5 Embedded third-party services
|
||||
|
||||
- **Google Fonts** — Our public website loads fonts from `fonts.googleapis.com` and `fonts.gstatic.com`. Google receives your IP address as part of loading the fonts. Google does not set cookies via these requests, but the IP-address exposure is a disclosure. `[LEGAL REVIEW: consider self-hosting fonts to remove this disclosure]`
|
||||
|
||||
## 3. Your choices
|
||||
|
||||
### 3.1 Managing consent
|
||||
|
||||
Where required by law, we obtain your consent for analytics and other non-essential storage via a consent mechanism on the Services. You can change your preferences at any time. `[LEGAL REVIEW: implement and link to the consent mechanism here]`
|
||||
|
||||
### 3.2 Browser controls
|
||||
|
||||
Most browsers allow you to:
|
||||
|
||||
- Block all cookies
|
||||
- Block third-party cookies
|
||||
- Clear cookies when you close the browser
|
||||
- Receive notification when a cookie is set
|
||||
|
||||
Disabling all cookies and `localStorage` will prevent the Services from functioning correctly because authentication relies on browser storage.
|
||||
|
||||
For browser-specific instructions, see:
|
||||
|
||||
- [Chrome](https://support.google.com/chrome/answer/95647)
|
||||
- [Firefox](https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer)
|
||||
- [Safari](https://support.apple.com/guide/safari/manage-cookies-sfri11471/mac)
|
||||
- [Edge](https://support.microsoft.com/en-us/help/4027947/microsoft-edge-delete-cookies)
|
||||
|
||||
### 3.3 Do Not Track signals
|
||||
|
||||
The Services do not currently respond to "Do Not Track" browser signals because there is no industry consensus on how to interpret them.
|
||||
|
||||
### 3.4 Global Privacy Control
|
||||
|
||||
We treat **Global Privacy Control (GPC)** signals as an opt-out of sale or sharing of personal information for California and other states where required by law. We do not sell or share personal information for cross-context behavioral advertising regardless of GPC.
|
||||
|
||||
## 4. Changes to this Cookie Policy
|
||||
|
||||
We may update this Cookie Policy from time to time. Material changes will be announced through the Services and the "Effective Date" above will be updated.
|
||||
|
||||
## 5. Contact
|
||||
|
||||
Questions about our use of cookies? Contact us at **support@resolutionflow.com**.
|
||||
289
legal/data-inventory.md
Normal file
289
legal/data-inventory.md
Normal file
@@ -0,0 +1,289 @@
|
||||
# ResolutionFlow Data Inventory
|
||||
|
||||
Generated: 2026-05-14
|
||||
Repo path: `/config/workspace/resolutionflow`
|
||||
Scanned commit: `0564646` (branch `feat/public-landing-routing-refactor`)
|
||||
|
||||
> Derived directly from the FastAPI backend, React 19 frontend, and deployment config. Anything ambiguous from the scan is flagged in **Section 5 — Open questions** and must be confirmed by the user before generation.
|
||||
|
||||
---
|
||||
|
||||
## 1. First-party data (ResolutionFlow as controller)
|
||||
|
||||
These are categories where ResolutionFlow itself decides why and how the data is processed (i.e., its own users, billing, telemetry).
|
||||
|
||||
### 1a. Account identity & authentication
|
||||
|
||||
| Table | Fields | Sensitivity | Retention |
|
||||
|---|---|---|---|
|
||||
| `users` | `email` (unique), `password_hash` (bcrypt), `name`, `phone`, `job_title`, `timezone`, `avatar_url`, `logo_data`, `company_display_name`, `role_at_signup`, `last_login`, `email_verified_at`, `deleted_at` (soft) | Direct PII + credential | Indefinite (soft-delete only; no automated purge of soft-deleted rows) |
|
||||
| `accounts` | `name`, `display_code`, `stripe_customer_id`, `branding_*`, `team_size_bucket`, `primary_psa`, `chat_retention_days` (default 90), `chat_retention_max_count` (default 100), `session_idle_minutes`, `session_absolute_minutes`, `sso_provider`, `sso_config` (JSONB) | Account metadata; tenant boundary | Indefinite |
|
||||
| `account_invites` | `email`, `code`, `role`, `invited_by_id`, `expires_at`, `revoked_at`, `email_sent_at` | PII (invitee email) | Until expiry/revocation; no automated purge |
|
||||
| `oauth_identities` | `provider` (google/microsoft), `provider_subject`, `provider_email_at_link`, `user_id` | PII (federated identity binding) | Until manual unlink/account deletion |
|
||||
| `email_verification_tokens` | `token_hash` (SHA-256), `user_id`, `expires_at`, `used_at` | Auth token (hashed) | Until used or expired; no automated purge of expired rows confirmed |
|
||||
| `password_reset_tokens` | (parallel structure expected) | Auth token (hashed) | Until used or expired |
|
||||
| `refresh_tokens` | `token_hash`, `user_id`, `expires_at`, `revoked_at` | Auth token (hashed) | Idle 3d / absolute 14d defaults (overridable per-account); rows persist after expiry — no purge job confirmed |
|
||||
|
||||
**Authentication mechanics:** JWT with HS256, 5-min access tokens, refresh-token rotation (idle 3d / absolute 14d defaults from `Settings.SESSION_*_MINUTES_DEFAULT`). Passwords hashed with bcrypt (12 rounds). OAuth supported for Google and Microsoft.
|
||||
|
||||
### 1b. Authorization & audit
|
||||
|
||||
| Table | Fields | Sensitivity | Retention |
|
||||
|---|---|---|---|
|
||||
| `audit_logs` | `user_id`, `account_id`, `action`, `resource_type`, `resource_id`, `details` (JSONB), `ip_address` (up to 45 chars — IPv6) | PII (IP address), behavioral | Indefinite — no purge job |
|
||||
| `teams`, `team` membership | team metadata | Tenant metadata | Indefinite |
|
||||
|
||||
### 1c. Billing & subscriptions
|
||||
|
||||
| Table | Fields | Sensitivity | Retention |
|
||||
|---|---|---|---|
|
||||
| `subscriptions` | `account_id`, `stripe_subscription_id`, `stripe_price_id`, `plan`, `status`, `current_period_*`, `cancel_at_period_end`, `seat_limit` | Billing metadata | Indefinite |
|
||||
| `plan_billing` | (account billing snapshot fields) | Billing metadata | Indefinite |
|
||||
| `stripe_events` | `id` (Stripe event id), `event_type`, `payload_excerpt` (JSONB), `processed_at` | Billing metadata | Indefinite (idempotency table) |
|
||||
|
||||
**Card data:** ResolutionFlow does not store card numbers. Stripe Elements (`@stripe/stripe-js` on the frontend) collects card details directly; only Stripe IDs are stored server-side.
|
||||
|
||||
### 1d. Telemetry, AI usage, product behavior
|
||||
|
||||
| Table | Fields | Notes |
|
||||
|---|---|---|
|
||||
| `ai_usage` | `user_id`, `account_id`, `conversation_id`, `tier_at_time`, `input_tokens`, `output_tokens`, `estimated_cost_usd`, `succeeded`, `extra_data` (JSONB) | Per-AI-call accounting; no message bodies |
|
||||
| `feature_flag` / overrides | flag membership | Operational |
|
||||
| `feedback`, `beta_feedback` | `user_id`, `reaction`, `category`, `text`, `page_url`, `session_id` | User-supplied free-text feedback |
|
||||
| `survey_invite`, `survey_response` | survey content | User-supplied |
|
||||
| `session_rating` | 1–5 star rating + feedback text | User-supplied |
|
||||
|
||||
### 1e. Marketing / pre-signup leads
|
||||
|
||||
| Table | Fields | Notes |
|
||||
|---|---|---|
|
||||
| `sales_leads` | `email`, `name`, `company`, `team_size`, `message`, `source`, `posthog_distinct_id`, `status` | Contact/demo requests from public pages |
|
||||
| (beta signup endpoint) | similar — see `api/endpoints/beta_signup.py` | Pre-onboarding leads |
|
||||
|
||||
### 1f. Frontend telemetry (client-originated, server-collected)
|
||||
|
||||
- **PostHog (`posthog-js`)** initialized in [main.tsx](frontend/src/main.tsx#L17): `autocapture: true`, `capture_pageview: true`, `capture_pageleave: 'if_capture_pageview'`, `persistence: 'localStorage+cookie'`. Identified by `user.id`, grouped by `account_id`. Sends to `us.i.posthog.com` (US instance). Web Vitals events also forwarded.
|
||||
- **Sentry (`@sentry/react` + `sentry-sdk[fastapi]`)**: error tracking + 20% traces sample rate in prod, Session Replay at 1% normal / 100% error sessions; **`maskAllText: false`, `blockAllMedia: false`** ([instrument.ts](frontend/src/instrument.ts#L9-L12)), so replays can contain visible text and media unless an explicit `data-sentry-mask` is added.
|
||||
- **Backend Sentry:** `send_default_pii=True` ([main.py:18](backend/app/main.py#L18)) — Sentry receives user identifiers, request paths, and request body fragments by default.
|
||||
|
||||
---
|
||||
|
||||
## 2. Customer data (ResolutionFlow as processor)
|
||||
|
||||
Data flowing through ResolutionFlow on behalf of MSP customers. The MSP is the controller; ResolutionFlow processes on their instruction. These are the categories where the DPA's processor obligations apply.
|
||||
|
||||
### 2a. Troubleshooting session content
|
||||
|
||||
| Table | Fields | Notes |
|
||||
|---|---|---|
|
||||
| `ai_sessions` | `intake_content` (JSONB: text, image URLs, log contents, ticket data), `problem_summary`, `problem_domain`, `conversation_messages` (full LLM history JSONB), `system_prompt_snapshot`, `pending_task_lane`, `resolution_summary`, `resolution_action`, `resolution_note_markdown`, `escalation_reason`, `escalation_package` (JSONB), `escalation_package_markdown`, `session_feedback`, `ticket_data` (PSA snapshot) | **High sensitivity** — may contain end-client names, hostnames, IPs, emails, internal credentials, ticket bodies. The MSP's clients are the data subjects here, not the MSP. |
|
||||
| `ai_session_steps` | per-step actions/notes | Same sensitivity as parent |
|
||||
| `ai_session_embeddings` | pgvector embeddings | Derived from session content |
|
||||
| `ai_conversations` | AI flow-builder wizard state, `messages` (JSONB), `wizard_state`, `generated_tree`, `expires_at` | **TTL: 24h, purged hourly** via `_cleanup_expired_ai_conversations` |
|
||||
| `sessions` (legacy guided sessions) | `tree_snapshot`, `path_taken`, `decisions`, `custom_steps`, `scratchpad`, `next_steps`, `ticket_number`, `client_name`, `outcome_notes` | Same sensitivity |
|
||||
| `session_branches`, `fork_point`, `session_handoff`, `session_facts`, `session_resolution_output`, `session_suggested_fixes` | branching + handoff artifacts | Same sensitivity |
|
||||
| `assistant_chat`, `copilot_conversation` | open-ended chat threads with the model | Same sensitivity. **Retention: account-configurable, default 90 days OR 100-chat cap** ([retention_cleanup.py](backend/app/services/retention_cleanup.py)). Pinned chats are exempt. |
|
||||
| `ai_chat_session` | parallel chat session table | Auto-archived after 30 days of inactivity ([main.py:45](backend/app/main.py#L45)) — archived (not deleted) |
|
||||
| `kb_import` | uploaded KB content for ingestion | Same sensitivity |
|
||||
|
||||
### 2b. Flow / Tree authoring
|
||||
|
||||
| Table | Notes |
|
||||
|---|---|
|
||||
| `trees`, `tree`, `tree_embedding`, `tree_share`, `tree_chunker`, `draft_template`, `template_tree`, `step_library`, `step_category`, `script_template`, `script_builder_session`, `network_diagram`, `flow_proposal`, `platform_step`, `supporting_data` | Customer-authored content. Tenant-isolated except for `template_trees`, `platform_steps`, `script_categories`, `plan_feature_defaults`, `accounts` (global tables). |
|
||||
|
||||
### 2c. PSA connection & ticket data
|
||||
|
||||
| Table | Fields | Notes |
|
||||
|---|---|---|
|
||||
| `psa_connections` | `provider`, `display_name`, `site_url`, `company_id`, **`credentials_encrypted`** (Fernet, key derived via HKDF from `SECRET_KEY` — see [encryption.py](backend/app/services/psa/encryption.py)), `flowpilot_settings` | One per account. Application-layer encryption of credentials at rest. |
|
||||
| `psa_activity_log`, `psa_post_log`, `psa_member_mapping` | PSA push history, retry state | Internal audit of round-trip writes |
|
||||
|
||||
PSA ticket bodies, contact names, company names, and notes flow into `ai_sessions.ticket_data` and `intake_content`. **ConnectWise is the MSP's existing data source, not a ResolutionFlow subprocessor** (see `references/msp-context.md` and Subprocessor section below). When ResolutionFlow writes back (resolution notes, escalation packages), that's the MSP instructing a write to their own data store — `resolution_note_external_id` and `escalation_package_external_id` capture the round-trip pointer.
|
||||
|
||||
### 2d. File uploads
|
||||
|
||||
| Table | Fields | Storage | Retention |
|
||||
|---|---|---|---|
|
||||
| `file_uploads` | `account_id`, `uploaded_by`, `session_id`, `filename`, `content_type`, `size_bytes`, `storage_key`, `ai_description`, `extracted_content`, `content_summary` | Railway Object Storage (S3-compatible) bucket `resolutionflow-uploads` | Indefinite — no automated purge surfaced |
|
||||
| `attachments` | session attachments | Same | Indefinite |
|
||||
|
||||
PDFs and DOCX files are text-extracted (`pypdf`, `python-docx`). Images are resized via Pillow and forwarded as multimodal blocks to Claude — but per repo convention, images are **not stored in conversation history**.
|
||||
|
||||
### 2e. Notifications & emails
|
||||
|
||||
| Table | Notes |
|
||||
|---|---|
|
||||
| `notifications` | In-app notifications |
|
||||
| `notification_log` | Delivery attempts |
|
||||
| `notification_config` | Per-user/account preferences |
|
||||
|
||||
Transactional email is sent via **Resend** (`resend==2.21.0`, `RESEND_API_KEY`). FROM address: `invites@resolutionflow.com`. Sales-lead notifications go to `sales@resolutionflow.com`.
|
||||
|
||||
---
|
||||
|
||||
## 3. Subprocessors
|
||||
|
||||
Each row reflects what the scan found in the codebase or deployment configuration.
|
||||
|
||||
### Subprocessor: Railway
|
||||
- **Service type:** Application + database hosting + S3-compatible object storage
|
||||
- **Data categories:** All stored data — primary PostgreSQL database (DB name `railway` in prod, alias `patherly`), application compute, uploaded files in `resolutionflow-uploads` bucket
|
||||
- **Location:** US (Railway default region; confirm specific region used)
|
||||
- **Detected via:** `backend/railway.toml`, `frontend/railway.toml`, `DATABASE_URL`, `STORAGE_*` env vars
|
||||
- **DPA reference:** https://railway.com/legal/dpa
|
||||
|
||||
### Subprocessor: Anthropic
|
||||
- **Service type:** LLM API (Claude — Sonnet 4.6 standard tier, Haiku 4.5 fast tier)
|
||||
- **Data categories:** Session intake text, conversation history, ticket data, file content (PDF/DOCX text + resized image bytes), prompt cache contents
|
||||
- **Location:** US
|
||||
- **Purpose:** FlowPilot guided troubleshooting, AI flow builder, chat, resolution-note + escalation-package generation, fact synthesis, template extraction, network-diagram generation, script builder
|
||||
- **Detected via:** `ANTHROPIC_API_KEY`, `anthropic>=0.40.0`, `AI_PROVIDER='anthropic'` in [config.py:153-208](backend/app/core/config.py#L153-L208)
|
||||
- **DPA reference:** https://www.anthropic.com/legal/commercial-dpa
|
||||
- **[LEGAL REVIEW: verify training carve-out]** Anthropic's commercial API tier does not train on customer data by default — confirm the tier in use matches before publishing.
|
||||
|
||||
### Subprocessor: Google AI (Gemini)
|
||||
- **Service type:** LLM API fallback
|
||||
- **Data categories:** Same as Anthropic when `AI_PROVIDER='gemini'`
|
||||
- **Location:** US
|
||||
- **Detected via:** `GOOGLE_AI_API_KEY`, `google-genai>=1.0.0`, `AI_MODEL_GEMINI='gemini-2.5-flash'`
|
||||
- **DPA reference:** https://cloud.google.com/terms/data-processing-addendum
|
||||
- **[LEGAL REVIEW: confirm whether Gemini is currently active]** The code path exists but Anthropic is the configured default. Disclose either as "primary + fallback" or remove if Gemini key is not provisioned in prod.
|
||||
|
||||
### Subprocessor: Voyage AI
|
||||
- **Service type:** Embeddings (RAG / similarity search)
|
||||
- **Data categories:** Text excerpts from sessions and flows used to compute vector embeddings (`voyage-3.5`, 1024 dimensions)
|
||||
- **Location:** US
|
||||
- **Detected via:** `VOYAGE_API_KEY`, `voyageai>=0.3.0`, `EMBEDDING_MODEL='voyage-3.5'`
|
||||
- **DPA reference:** https://www.voyageai.com/dpa **[LEGAL REVIEW: confirm Voyage DPA URL and zero-retention status]**
|
||||
|
||||
### Subprocessor: Stripe
|
||||
- **Service type:** Payment processing
|
||||
- **Data categories:** Billing contact, card details (collected by Stripe Elements client-side — ResolutionFlow does not see PANs), Stripe customer/subscription IDs, webhook event payloads
|
||||
- **Location:** US (Stripe Global)
|
||||
- **Detected via:** `STRIPE_SECRET_KEY`, `STRIPE_PUBLISHABLE_KEY`, `STRIPE_WEBHOOK_SECRET`, `stripe==14.3.0`, `@stripe/stripe-js`
|
||||
- **DPA reference:** https://stripe.com/legal/dpa
|
||||
- **PCI:** SAQ-A scope (Stripe Elements). ResolutionFlow never receives full card data.
|
||||
|
||||
### Subprocessor: Resend
|
||||
- **Service type:** Transactional email
|
||||
- **Data categories:** Recipient email addresses, email subject + body content (account invites, password resets, email verification, feedback notifications, sales-lead notifications)
|
||||
- **Location:** US
|
||||
- **Detected via:** `RESEND_API_KEY`, `resend==2.21.0`, `FROM_EMAIL='invites@resolutionflow.com'`
|
||||
- **DPA reference:** https://resend.com/legal/dpa
|
||||
|
||||
### Subprocessor: Sentry
|
||||
- **Service type:** Error tracking + performance tracing + Session Replay
|
||||
- **Data categories:** Stack traces, request paths, **user IDs and request body fragments (`send_default_pii=True`)**, browser session replays at 1%/100% sampling with text + media **unmasked**, breadcrumbs
|
||||
- **Location:** US (Sentry SaaS) — **[LEGAL REVIEW: confirm Sentry data region]**
|
||||
- **Detected via:** `SENTRY_DSN`, `sentry-sdk[fastapi]>=2.54.0`, `@sentry/react`, [main.py:14-26](backend/app/main.py#L14-L26), [instrument.ts](frontend/src/instrument.ts)
|
||||
- **DPA reference:** https://sentry.io/legal/dpa/
|
||||
- **[LEGAL REVIEW: PII posture]** `send_default_pii=True` + unmasked Session Replay is broader than typical defaults. Either narrow the configuration (recommended: enable text masking on sensitive routes; set `send_default_pii=False`; add Sentry scrubbing rules for `intake_content`, `conversation_messages`, `ticket_data`) or disclose explicitly.
|
||||
|
||||
### Subprocessor: PostHog
|
||||
- **Service type:** Product analytics + Web Vitals
|
||||
- **Data categories:** User ID, account ID (as group), email + name + plan + role on identify, page paths, autocaptured DOM interactions, custom events
|
||||
- **Location:** US (`us.i.posthog.com` instance)
|
||||
- **Detected via:** `posthog-js`, `@posthog/react`, [main.tsx:17-23](frontend/src/main.tsx#L17-L23), `VITE_PUBLIC_POSTHOG_KEY`
|
||||
- **DPA reference:** https://posthog.com/dpa
|
||||
- **Cookies:** PostHog sets a first-party cookie because `persistence: 'localStorage+cookie'` is configured — **disclosure required in Cookie Policy and consent flow** if EU/UK visitors are reachable on public pages.
|
||||
|
||||
### Subprocessor: Google Fonts
|
||||
- **Service type:** Font CDN
|
||||
- **Data categories:** Visitor IP address (Google Fonts exposes IPs to Google)
|
||||
- **Location:** Global Google CDN
|
||||
- **Detected via:** [index.html:11-13](frontend/index.html#L11-L13) — `fonts.googleapis.com` + `fonts.gstatic.com`
|
||||
- **DPA reference:** Google's terms (Google Fonts is normally treated as a service, not a controller-controller share, but the IP exposure is a known disclosure)
|
||||
- **[LEGAL REVIEW: Schrems II / EU caution]** For EU/UK visitors, Google Fonts loaded over `fonts.googleapis.com` is a recurring GDPR enforcement target. Consider self-hosting (Bunny Fonts or bundling) to remove the disclosure.
|
||||
|
||||
### NOT subprocessors (deliberately excluded)
|
||||
|
||||
- **ConnectWise PSA** — MSP customer's existing data source/controller, not a ResolutionFlow subprocessor (see `references/msp-context.md`). Disclose as "data source the customer authorizes ResolutionFlow to read from and, when instructed, write to."
|
||||
- **Autotask, HaloPSA** — same classification (provider stubs exist in `services/psa/`; current scan suggests ConnectWise is the only live provider, but **[OPEN QUESTION]** below asks the user to confirm)
|
||||
- **GoDaddy / DNS registrar** — DNS only, no traffic proxy
|
||||
- **GitHub mirror, Gitea** — source control, no customer data flows
|
||||
- **Microsoft Learn MCP** — read-only documentation lookup; the MCP server returns docs to ResolutionFlow, no customer data flows to Microsoft as part of this integration
|
||||
|
||||
---
|
||||
|
||||
## 4. Cookies and trackers
|
||||
|
||||
| Name / pattern | Type | Set by | Purpose | Strict-necessary? |
|
||||
|---|---|---|---|---|
|
||||
| `ph_*` (PostHog) | Persistent first-party | `posthog-js` (`persistence: 'localStorage+cookie'`) | Analytics — distinct ID, session, feature-flag state | **No** — requires consent under GDPR/UK PECR |
|
||||
| `access_token`, `refresh_token` | **localStorage** (NOT cookies) | `authStore`, `OAuthCallbackPage`, `SessionExpiryToast` | Auth bearer tokens for API calls | Strict-necessary |
|
||||
| `theme-storage` | localStorage | `index.html` inline script | UI theme preference | Strict-necessary (preference) |
|
||||
| `rf-editor-fullscreen` | localStorage | `Modal.tsx` | UI preference | Strict-necessary (preference) |
|
||||
| `rf-intended-plan` | localStorage | `RegisterPage.tsx` | Carry pricing-page selection into signup | Strict-necessary (UX) |
|
||||
| `recentFlows` storage key | localStorage | `lib/recentFlows.ts` | Recent flow MRU | Strict-necessary (UX) |
|
||||
| Step-feedback "hint shown" flag | localStorage | `StepFeedback.tsx` | Suppress repeated coachmark | Strict-necessary (UX) |
|
||||
| Rated-sessions list | localStorage | `csatUtils.ts` | Hide CSAT widget after rating | Strict-necessary (UX) |
|
||||
| Escalation-queue "seen" set | localStorage | `EscalationQueue.tsx` | Mark notifications seen | Strict-necessary (UX) |
|
||||
|
||||
**Backend-set cookies:** None found. Auth uses bearer tokens delivered in JSON, stored client-side in localStorage. No `Set-Cookie` headers issued by FastAPI middleware.
|
||||
|
||||
**Note on auth tokens in localStorage:** This is a known security-disclosure point. Tokens in localStorage are accessible to any JS running on the page; XSS would expose them. Disclose in the security section of the Privacy Policy as a deliberate architecture choice.
|
||||
|
||||
---
|
||||
|
||||
## 5. Retention and deletion logic — confirmed gaps
|
||||
|
||||
What the scan **confirms** has automated retention:
|
||||
- **AI flow-builder wizard conversations** (`ai_conversations`): 24h TTL, purged hourly ([scheduler.py:118](backend/app/core/scheduler.py#L118))
|
||||
- **Assistant chats** (`assistant_chat`): account-configurable retention, default **90 days OR 100 chats** (whichever first) for non-pinned chats; cleanup runs daily ([retention_cleanup.py](backend/app/services/retention_cleanup.py))
|
||||
- **AI chat sessions** (`ai_chat_session`): auto-archived (not deleted) after 30 days idle ([main.py:45](backend/app/main.py#L45))
|
||||
|
||||
What the scan **confirms is missing**:
|
||||
- `audit_logs` — no purge job; grows indefinitely (IP addresses retained forever)
|
||||
- `refresh_tokens` — expired/revoked rows persist; no GC
|
||||
- `email_verification_tokens`, `password_reset_tokens` — no purge of expired rows confirmed
|
||||
- `file_uploads` and Railway storage objects — no lifecycle policy surfaced
|
||||
- `ai_sessions` and full session content (intake, conversation, ticket snapshots) — no automated purge; tied only to soft-delete of the owning user
|
||||
- `ai_usage` — telemetry retained indefinitely
|
||||
- `sales_leads`, `beta_feedback`, `survey_response` — no purge job
|
||||
- `notifications`, `notification_log` — no purge job
|
||||
- `stripe_events` — idempotency table grows indefinitely
|
||||
- Soft-deleted users (`users.deleted_at`) — no hard-delete job; `hard_delete_user` exists as a super-admin endpoint only
|
||||
|
||||
**Account deletion behavior** ([accounts.py:524](backend/app/api/endpoints/accounts.py#L524)): owner-only, blocked if other members exist, performs **soft-delete of the user** + revoke all refresh tokens. Account row, audit logs, sessions, files, etc. are **not** purged.
|
||||
|
||||
**[LEGAL REVIEW: GDPR Article 5(1)(e) storage limitation]** A controller-facing claim of "we retain data only as long as necessary" would conflict with the current state. The Privacy Policy should either (a) describe the actual state honestly ("retained until you request deletion") with an explicit deletion-on-request commitment and SLA, or (b) implement scheduled purge for the categories above before publishing.
|
||||
|
||||
---
|
||||
|
||||
## 6. Logging & encryption posture
|
||||
|
||||
**Logging** (`app/core/middleware.py` `RequestLoggingMiddleware`, `ErrorLoggingMiddleware`): request paths and errors logged via Python `logging`. **[LEGAL REVIEW: confirm whether request bodies are logged]** — if yes, structured PII (emails, ticket content) ends up in `logs/` and on Railway. Audit `logger.info` / `logger.exception` call sites to verify.
|
||||
|
||||
**At-rest encryption:**
|
||||
- **PSA credentials** (`psa_connections.credentials_encrypted`): application-layer Fernet encryption, key derived from `SECRET_KEY` via HKDF. ✅ Confirmed.
|
||||
- **Railway-managed Postgres + Object Storage**: disk-level encryption from the platform. **[LEGAL REVIEW: verify Railway encryption attestation]** before claiming "encrypted at rest" globally.
|
||||
- **No additional column-level encryption** for `password_hash` (bcrypt is the protection there), `ai_sessions.*`, `intake_content`, `conversation_messages`, etc.
|
||||
|
||||
**In transit:** HTTPS on prod (`resolutionflow.com`, `api.resolutionflow.com`). Backend serves over HTTP locally; production CORS gated by `ALLOW_RAILWAY_ORIGINS` for PR envs.
|
||||
|
||||
**Security headers:** `SecurityHeadersMiddleware` present with CSP in report-only mode (`CSP_REPORT_ONLY=True` default).
|
||||
|
||||
---
|
||||
|
||||
## 7. Open questions for the user
|
||||
|
||||
These must be confirmed before generation:
|
||||
|
||||
1. **Live PSA providers** — `services/psa/` has stubs for ConnectWise, Autotask, and HaloPSA. Is only ConnectWise active in production, or are Autotask/HaloPSA also enabled? (Affects DPA and Privacy Policy data-source list.)
|
||||
2. **Gemini status** — is `GOOGLE_AI_API_KEY` provisioned in prod, or is Anthropic the sole live LLM provider? (Disclose one or both.)
|
||||
3. **Voyage AI status** — is `VOYAGE_API_KEY` provisioned in prod? Embeddings are a live code path but the key may not be set.
|
||||
4. **Sentry data region** — US or EU? (Affects EU data-transfer disclosure.)
|
||||
5. **Railway region** — which region is the prod project deployed in? (Affects data-location claims.)
|
||||
6. **Jurisdictions targeted** — should we assume EU/UK reachable (default yes for B2B SaaS), California (yes), other US states (Virginia, Colorado, Connecticut, Texas — newer laws now in force)? Anything to exclude?
|
||||
7. **Business entity** — what is the legal entity name and address that should appear as "Controller" / "Service Provider" on the documents? (Required for binding contact / notices section.)
|
||||
8. **DPO / privacy contact email** — is there a dedicated address (e.g., `privacy@resolutionflow.com`), or should we use `support@` / `michael@resolutionflow.com`?
|
||||
9. **Whether Microsoft Learn MCP usage is enabled in prod** — `ENABLE_MCP_MICROSOFT_LEARN=True` default. The integration retrieves docs only (no customer data outflow), but worth confirming.
|
||||
10. **Non-codebase tools** — does ResolutionFlow use any of: Zapier/n8n/Make, HubSpot/Salesforce CRM, DocuSign, Help Scout/Zendesk, transcription/voice (Whisper, Eleven Labs), customer-data-platform tooling? None found in code; common to be configured elsewhere.
|
||||
11. **AGE: Children's data** — confirm ResolutionFlow has no users under 13 (US COPPA) / 16 (UK GDPR). Should be implicit for a B2B MSP product but the policy needs to state it.
|
||||
12. **Free tier / EULA** — confirm whether the product accepts unauthenticated visitors who can submit anything other than the public sales-lead form and public flow shares.
|
||||
13. **Backup retention** — Railway Postgres backups (point-in-time recovery window) extend effective retention. Confirm the PITR window and disclose.
|
||||
|
||||
---
|
||||
|
||||
**Stop point.** Per the skill workflow, generation is blocked on user confirmation of this inventory. Please review and either confirm or correct each section — and answer Section 7 — before I move to Phase 2 (classification) and Phase 3 (generation).
|
||||
334
legal/dpa.md
Normal file
334
legal/dpa.md
Normal file
@@ -0,0 +1,334 @@
|
||||
# Data Processing Agreement
|
||||
|
||||
**Effective Date:** 2026-05-14
|
||||
**Version:** 1.0
|
||||
|
||||
> **DRAFT — not legal advice.** This DPA was generated from a code scan with reasonable defaults. Commercial-risk provisions (audit rights, breach SLA, sub-processor notice period, liability allocation) are flagged for attorney calibration.
|
||||
|
||||
This Data Processing Agreement ("DPA") supplements the [Terms of Service](terms-of-service.md) ("Terms") between **ResolutionFlow LLC** ("ResolutionFlow," "we," "us," or "Processor") and the customer identified in the applicable subscription or order form ("Customer," "you," "your," or "Controller"). This DPA applies to ResolutionFlow's processing of Personal Data on behalf of Customer in connection with the Services.
|
||||
|
||||
Where the Terms and this DPA conflict regarding the processing of Personal Data, this DPA controls.
|
||||
|
||||
## 1. Definitions
|
||||
|
||||
Terms not defined here have the meanings given in the Terms. The following terms have the meanings set forth below:
|
||||
|
||||
- **"Applicable Data Protection Laws"** means all laws and regulations applicable to the parties' processing of Personal Data, including the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK Data Protection Act 2018 and UK GDPR ("UK GDPR"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and other US state comprehensive privacy laws in force.
|
||||
- **"Customer Data"** means the data Customer or its authorized users submit to the Services or that ResolutionFlow retrieves on Customer's behalf from connected systems.
|
||||
- **"Personal Data"** means any information within Customer Data relating to an identified or identifiable natural person, as defined under Applicable Data Protection Laws. "Personal Information" has the meaning under CCPA/CPRA and is included within Personal Data for purposes of this DPA.
|
||||
- **"Data Subject"** means an identified or identifiable natural person to whom Personal Data relates.
|
||||
- **"Sub-processor"** means any third party engaged by ResolutionFlow to process Personal Data on Customer's behalf.
|
||||
- **"Processing"** has the meaning given under Applicable Data Protection Laws and includes any operation performed on Personal Data, whether automated or not.
|
||||
- **"Data Subject Request"** means a request from a Data Subject to exercise rights under Applicable Data Protection Laws.
|
||||
|
||||
## 2. Roles and scope
|
||||
|
||||
### 2.1 Roles
|
||||
|
||||
For Customer Data containing Personal Data:
|
||||
- **Customer is the Controller** (or, where Customer itself processes on behalf of its own customers, the Processor) of the Personal Data.
|
||||
- **ResolutionFlow is the Processor** acting on Customer's documented instructions.
|
||||
|
||||
Under CCPA/CPRA terminology, ResolutionFlow acts as a **Service Provider** to Customer.
|
||||
|
||||
### 2.2 Chain of processing
|
||||
|
||||
Customer acknowledges that, where Customer is itself a Processor acting on behalf of its own end-clients (for example, an MSP processing PSA data on behalf of its IT-service clients), ResolutionFlow acts as a Sub-processor to Customer in that chain. Customer represents that it has the legal authority under its agreements with its end-clients to appoint ResolutionFlow as a Sub-processor.
|
||||
|
||||
### 2.3 Subject matter and details
|
||||
|
||||
The subject matter, duration, nature and purpose of processing, types of Personal Data, and categories of Data Subjects are described in **Annex A**.
|
||||
|
||||
### 2.4 Documented instructions
|
||||
|
||||
ResolutionFlow processes Personal Data only on Customer's documented instructions. The Terms, this DPA, and Customer's configuration and use of the Services constitute Customer's complete and final instructions for processing.
|
||||
|
||||
If ResolutionFlow believes an instruction violates Applicable Data Protection Laws, it will inform Customer without undue delay and may suspend that processing.
|
||||
|
||||
### 2.5 No use for ResolutionFlow's purposes
|
||||
|
||||
ResolutionFlow will not retain, use, sell, share, or disclose Personal Data for any purpose other than performing the Services for Customer, except:
|
||||
- For internal use to operate, secure, and improve the Services in a manner consistent with Customer's instructions and using de-identified or aggregated information
|
||||
- As required by law
|
||||
|
||||
ResolutionFlow will not "sell" or "share" Personal Data as those terms are defined under CCPA/CPRA, and will not combine Customer's Personal Data with personal information received from other sources except as permitted under CCPA/CPRA service-provider exemptions.
|
||||
|
||||
## 3. ResolutionFlow obligations
|
||||
|
||||
### 3.1 Compliance
|
||||
|
||||
ResolutionFlow will comply with Applicable Data Protection Laws in performing its obligations under this DPA.
|
||||
|
||||
### 3.2 Confidentiality
|
||||
|
||||
ResolutionFlow will ensure that personnel authorized to process Personal Data are bound by written confidentiality obligations.
|
||||
|
||||
### 3.3 Security measures
|
||||
|
||||
ResolutionFlow will implement and maintain appropriate technical and organizational measures designed to protect Personal Data, as described in **Annex B**.
|
||||
|
||||
### 3.4 Sub-processors
|
||||
|
||||
#### 3.4.1 Authorization
|
||||
|
||||
Customer authorizes ResolutionFlow to engage the Sub-processors listed in **Annex C** (the current list is also published at the [Subprocessor List](subprocessor-list.md)).
|
||||
|
||||
#### 3.4.2 Notification of new Sub-processors
|
||||
|
||||
ResolutionFlow will provide at least **30 days' prior notice** of any new Sub-processor by updating the Subprocessor List and notifying Customer through the Services or by email. `[LEGAL REVIEW: 30 days is a common baseline; some enterprise buyers will insist on 60-90 days]`
|
||||
|
||||
#### 3.4.3 Objection
|
||||
|
||||
Customer may object to a new Sub-processor on reasonable data-protection grounds by notice to support@resolutionflow.com within the notice period. If the parties cannot resolve the objection in good faith, Customer may terminate the affected portion of the Services and receive a prorated refund of prepaid fees for the unused period.
|
||||
|
||||
#### 3.4.4 Sub-processor obligations
|
||||
|
||||
ResolutionFlow will impose on each Sub-processor data-protection obligations materially equivalent to those in this DPA, and ResolutionFlow remains liable to Customer for the performance of its Sub-processors' obligations.
|
||||
|
||||
### 3.5 Assistance to Customer
|
||||
|
||||
ResolutionFlow will provide reasonable assistance to Customer in:
|
||||
- Responding to Data Subject Requests, taking into account the nature of the processing and information available to ResolutionFlow
|
||||
- Ensuring compliance with security, breach-notification, and data-protection-impact-assessment obligations under Applicable Data Protection Laws
|
||||
|
||||
ResolutionFlow may charge for assistance that exceeds the scope of standard Services usage, at its then-current rates.
|
||||
|
||||
### 3.6 Data Subject Requests
|
||||
|
||||
If ResolutionFlow receives a Data Subject Request directly relating to Customer Data, it will promptly forward the request to Customer and will not respond except on Customer's instruction or as required by law.
|
||||
|
||||
### 3.7 Personal Data Breach
|
||||
|
||||
ResolutionFlow will notify Customer of a confirmed Personal Data Breach affecting Personal Data without undue delay and in any event within **72 hours** of confirming the Breach. The notification will include, to the extent known:
|
||||
|
||||
- Nature of the Breach
|
||||
- Categories and approximate number of Data Subjects and records affected
|
||||
- Likely consequences
|
||||
- Measures taken or proposed to address the Breach
|
||||
|
||||
ResolutionFlow will provide reasonable cooperation in Customer's regulatory notifications. `[LEGAL REVIEW: 72 hours follows the GDPR baseline; some enterprise buyers demand 24-48 hours]`
|
||||
|
||||
### 3.8 Audit rights
|
||||
|
||||
#### 3.8.1 Information
|
||||
|
||||
ResolutionFlow will make available to Customer all information reasonably necessary to demonstrate compliance with this DPA, including by providing copies of relevant third-party audit reports (such as SOC 2, when available).
|
||||
|
||||
#### 3.8.2 Audit
|
||||
|
||||
Where third-party reports are insufficient to satisfy Customer's legitimate audit needs, Customer (or an independent auditor mutually agreed by the parties) may, on at least 30 days' written notice and not more than once per 12-month period, conduct an audit of ResolutionFlow's data-protection practices. Audits will be conducted during business hours, will not unreasonably interfere with ResolutionFlow's operations, and will be subject to confidentiality obligations. Customer bears its own audit costs.
|
||||
|
||||
#### 3.8.3 SCC audits
|
||||
|
||||
For audits required under Standard Contractual Clauses, those clauses prevail to the extent of inconsistency.
|
||||
|
||||
## 4. Customer obligations
|
||||
|
||||
### 4.1 Lawful basis
|
||||
|
||||
Customer represents and warrants that it has all necessary rights, consents, and legal bases to share Personal Data with ResolutionFlow and to authorize the processing described in this DPA. This includes, where Customer is acting on behalf of its own end-clients, having appropriate agreements in place authorizing ResolutionFlow's processing.
|
||||
|
||||
### 4.2 Permitted data categories
|
||||
|
||||
Customer will not submit (and will use reasonable efforts to prevent its users from submitting) to the Services:
|
||||
|
||||
- Special categories of Personal Data under GDPR Article 9 (or analogous categories under other Applicable Data Protection Laws) except as appears incidentally in ticket content
|
||||
- Protected Health Information as defined under HIPAA, unless a Business Associate Agreement is in place between Customer and ResolutionFlow
|
||||
- Payment card data, other than Stripe-collected payment information for ResolutionFlow's own billing
|
||||
- Government-issued identifiers (Social Security numbers, passport numbers, driver's license numbers) of third parties
|
||||
|
||||
### 4.3 Data Subject communications
|
||||
|
||||
Customer is responsible for providing notices to Data Subjects regarding ResolutionFlow's processing under this DPA, and for responding to Data Subject Requests, with ResolutionFlow's reasonable assistance as set out in Section 3.5.
|
||||
|
||||
## 5. International transfers
|
||||
|
||||
### 5.1 Transfers from the EEA, UK, and Switzerland
|
||||
|
||||
To the extent ResolutionFlow's processing involves transfer of Personal Data from the European Economic Area, United Kingdom, or Switzerland to a country not subject to an adequacy decision, the parties agree:
|
||||
|
||||
- For EEA transfers: the **Standard Contractual Clauses** (Module 2 — Controller to Processor, or Module 3 — Processor to Processor, as applicable) approved by the European Commission in Decision 2021/914 are incorporated by reference and apply as if set out in full.
|
||||
- For UK transfers: the **UK Addendum** to the EU SCCs (issued by the UK ICO) is incorporated by reference.
|
||||
- For Swiss transfers: the SCCs apply with appropriate adaptations under Swiss law.
|
||||
|
||||
The Module(s), the parties' roles, optional clauses, and Annex content are specified in **Annex D**.
|
||||
|
||||
### 5.2 EU-US Data Privacy Framework
|
||||
|
||||
If ResolutionFlow becomes certified to the EU-US Data Privacy Framework (or its UK or Swiss extensions), the parties may, at Customer's election, rely on that certification as the transfer mechanism in lieu of the SCCs. `[LEGAL REVIEW: consider applying for DPF certification when eligible]`
|
||||
|
||||
## 6. Term, return, and deletion
|
||||
|
||||
### 6.1 Term
|
||||
|
||||
This DPA applies for as long as ResolutionFlow processes Personal Data on Customer's behalf.
|
||||
|
||||
### 6.2 Return or deletion
|
||||
|
||||
Upon termination of the Services, ResolutionFlow will, at Customer's election:
|
||||
|
||||
- Make Personal Data available for export through the Services for **30 days** following termination, OR
|
||||
- Provide a one-time export of Personal Data in a structured, commonly-used format upon Customer's reasonable request
|
||||
|
||||
After the export window, ResolutionFlow will delete or anonymize Personal Data, except where retention is required by law. ResolutionFlow will certify deletion upon request. `[LEGAL REVIEW: today, deletion of account-scoped Personal Data on customer offboarding is not automated. Either implement scheduled deletion or rewrite this section to describe the actual flow. We strongly recommend the former before signing this DPA with enterprise customers.]`
|
||||
|
||||
### 6.3 Backup retention
|
||||
|
||||
Customer acknowledges that Personal Data may persist in routine backups for up to **90 days** after deletion, and that ResolutionFlow will not actively delete Personal Data from backups but will not restore deleted Personal Data from backups except to recover from a system failure.
|
||||
|
||||
## 7. Liability
|
||||
|
||||
The Terms govern allocation of liability between the parties, except that any provisions of the SCCs governing liability between the parties under those clauses apply in addition to (and not in limitation of) the Terms.
|
||||
|
||||
## 8. Order of precedence
|
||||
|
||||
To the extent of any conflict regarding the processing of Personal Data, the order of precedence is:
|
||||
|
||||
1. The Standard Contractual Clauses (where they apply)
|
||||
2. This DPA
|
||||
3. The Terms
|
||||
|
||||
## 9. General
|
||||
|
||||
### 9.1 Modifications
|
||||
|
||||
ResolutionFlow may update this DPA to reflect changes in Applicable Data Protection Laws or its operations, provided that no update will materially reduce the protections afforded to Customer or Personal Data without Customer's consent.
|
||||
|
||||
### 9.2 Severability
|
||||
|
||||
If any provision of this DPA is held unenforceable, the remaining provisions remain in effect.
|
||||
|
||||
### 9.3 Entire agreement on processing
|
||||
|
||||
This DPA, together with its Annexes and the SCCs (where applicable), constitutes the entire agreement between the parties regarding processing of Personal Data under the Services.
|
||||
|
||||
### 9.4 Notices
|
||||
|
||||
Notices under this DPA may be sent to support@resolutionflow.com. For service of legal process or any notice requiring a physical mailing address for ResolutionFlow LLC, contact support@resolutionflow.com to receive the appropriate address.
|
||||
|
||||
---
|
||||
|
||||
# Annex A — Description of Processing
|
||||
|
||||
**Subject matter:** Processing of Personal Data within Customer Data as necessary to provide the Services.
|
||||
|
||||
**Duration:** For the term of Customer's subscription, plus the export and deletion windows in Section 6.
|
||||
|
||||
**Nature and purpose:** Hosting, storing, transmitting, displaying, indexing, embedding, analyzing, and otherwise processing Customer Data as necessary to deliver the Services. This includes AI-assisted features that involve transmission of Personal Data to designated Sub-processors, generation of resolution notes and escalation packages, computation of vector embeddings for similarity search, and write-back to Customer's PSA platform when instructed by Customer.
|
||||
|
||||
**Types of Personal Data (illustrative, not exhaustive):**
|
||||
|
||||
- Names, email addresses, phone numbers, and job titles of Customer's personnel
|
||||
- Names, email addresses, phone numbers, and contact records of Customer's end-clients and their personnel (as they appear in PSA records, tickets, and notes)
|
||||
- Tenant/site identifiers (e.g., ConnectWise company IDs), configuration data, and infrastructure identifiers (hostnames, IP addresses) that appear in ticket content
|
||||
- Free-text content submitted by Customer's users to ticket intake, AI sessions, chat threads, scratchpads, escalation reasons, resolution summaries, feedback, and similar fields
|
||||
- Files uploaded by Customer's users (PDFs, DOCX, images, log files) and text extracted from them
|
||||
- AI conversation transcripts that incorporate any of the above
|
||||
- Audit-log records of Customer's users' actions, including IP addresses
|
||||
|
||||
**Categories of Data Subjects:**
|
||||
|
||||
- Customer's personnel and authorized users
|
||||
- Customer's end-clients and their personnel (where Customer is itself a Processor or service provider to those end-clients)
|
||||
- Other individuals whose Personal Data appears in tickets, communications, files, or system records routed through the Services
|
||||
|
||||
**Sensitive data:** Customer is instructed not to submit sensitive categories. Incidental sensitive data appearing in free-text ticket content is processed only as part of the broader ticket and is not used by ResolutionFlow for any sensitive-data-specific purpose.
|
||||
|
||||
---
|
||||
|
||||
# Annex B — Technical and Organizational Measures
|
||||
|
||||
`[LEGAL REVIEW: this annex mirrors actual implementation as of the scan date. Update before contracting with each new enterprise customer.]`
|
||||
|
||||
ResolutionFlow implements the following technical and organizational measures:
|
||||
|
||||
### B.1 Encryption
|
||||
|
||||
- **In transit:** TLS for all production traffic between Data Subject browsers, the Services, and Sub-processors
|
||||
- **At rest — infrastructure layer:** Customer Data stored in PostgreSQL and object storage is encrypted at rest by our infrastructure provider (Railway). `[LEGAL REVIEW: verify Railway encryption-at-rest attestation]`
|
||||
- **At rest — application layer:** PSA integration credentials (e.g., ConnectWise public and private keys) are additionally encrypted at the application layer using Fernet (AES-128-CBC + HMAC-SHA256) with a key derived from a server-side secret via HKDF-SHA256
|
||||
- **Passwords:** stored as bcrypt hashes with a work factor of 12; plaintext passwords are never stored
|
||||
|
||||
### B.2 Access control
|
||||
|
||||
- Role-based access control within Customer accounts (super_admin, account owner, admin, engineer, viewer)
|
||||
- Tenant isolation at the database layer using PostgreSQL row-level security keyed on `account_id`
|
||||
- Principle of least privilege for ResolutionFlow personnel access
|
||||
- Authentication of users via email + password (bcrypt-hashed) or federated OAuth (Google, Microsoft)
|
||||
- JWT-based session tokens with short-lived access tokens (5 minutes) and rotated refresh tokens bounded by idle and absolute session limits
|
||||
|
||||
### B.3 Network and infrastructure security
|
||||
|
||||
- Hosting on infrastructure providers that maintain industry-standard security certifications
|
||||
- Network segmentation between production and non-production environments
|
||||
- Patching and dependency management processes
|
||||
- Monitoring for unauthorized access via centralized logs and error monitoring
|
||||
- Rate limiting on authentication endpoints
|
||||
|
||||
### B.4 Operational security
|
||||
|
||||
- Confidentiality obligations binding all personnel with access to Personal Data
|
||||
- Documented incident response procedures `[LEGAL REVIEW: confirm an incident response plan is documented]`
|
||||
- Security awareness expected of personnel `[LEGAL REVIEW: formalize annual training when team grows]`
|
||||
|
||||
### B.5 Data isolation
|
||||
|
||||
- Logical separation of Customer Data between Customer tenants enforced at the database (RLS) and application layers
|
||||
- Global tables (such as platform-wide flow templates and step categories) contain no Personal Data
|
||||
- Cross-tenant access is restricted to ResolutionFlow super-admin personnel acting under audit
|
||||
|
||||
### B.6 Auditing and logging
|
||||
|
||||
- Audit logs of administrative actions, role changes, account ownership transfers, and security-sensitive events
|
||||
- Error and performance monitoring via Sentry with sampled traces and Session Replay
|
||||
- Product-analytics events via PostHog identified by user and account
|
||||
|
||||
### B.7 Business continuity
|
||||
|
||||
- Regular backups of the production database maintained by Railway
|
||||
- Backups retained for up to **90 days**
|
||||
- Recovery procedures exercised periodically `[LEGAL REVIEW: formalize an RTO/RPO target]`
|
||||
|
||||
### B.8 Sub-processor oversight
|
||||
|
||||
- Data Processing Agreement in place with each Sub-processor
|
||||
- Periodic review of Sub-processors' security postures
|
||||
|
||||
---
|
||||
|
||||
# Annex C — Authorized Sub-processors
|
||||
|
||||
The authoritative list, including data categories, regions, and links to each Sub-processor's DPA, is published at the [Subprocessor List](subprocessor-list.md) and is incorporated into this DPA by reference. Customer will be notified of changes as described in Section 3.4.
|
||||
|
||||
As of the Effective Date, the authorized Sub-processors are:
|
||||
|
||||
| Sub-processor | Service | Location | DPA |
|
||||
|---|---|---|---|
|
||||
| Railway Corp. | Application hosting, PostgreSQL, object storage | US | https://railway.com/legal/dpa |
|
||||
| Anthropic, PBC | LLM API for AI features | US | https://www.anthropic.com/legal/commercial-dpa |
|
||||
| Voyage AI, Inc. | Embedding API | US | `[LEGAL REVIEW: confirm DPA URL]` |
|
||||
| Stripe, Inc. | Payment processing | US | https://stripe.com/legal/dpa |
|
||||
| Resend | Transactional email | US | https://resend.com/legal/dpa |
|
||||
| Functional Software, Inc. (Sentry) | Error monitoring, traces, Session Replay | US | https://sentry.io/legal/dpa/ |
|
||||
| PostHog, Inc. | Product analytics | US | https://posthog.com/dpa |
|
||||
| Google LLC | Google Fonts CDN | Global | Google's standard terms |
|
||||
|
||||
---
|
||||
|
||||
# Annex D — Standard Contractual Clauses Configuration
|
||||
|
||||
For transfers under the EU SCCs (Commission Decision 2021/914):
|
||||
|
||||
- **Module:** Module 2 (Controller-to-Processor) for transfers where Customer is the Controller; Module 3 (Processor-to-Processor) for transfers where Customer is itself a Processor for its own end-clients. The applicable Module is determined by Customer's role.
|
||||
- **Clause 7 (Docking clause):** Not applicable.
|
||||
- **Clause 9 (Use of sub-processors):** Option 2 (general written authorization) applies; the notice period is as set out in Section 3.4.2 of this DPA.
|
||||
- **Clause 11 (Redress):** Option (independent dispute-resolution body) is **not** elected.
|
||||
- **Clause 17 (Governing law):** The law of Ireland. `[LEGAL REVIEW: Irish law is the most common SCC choice; counsel may prefer another EU member state]`
|
||||
- **Clause 18 (Choice of forum and jurisdiction):** The courts of Ireland. `[LEGAL REVIEW]`
|
||||
- **Annex I.A. (List of Parties):** The data exporter is Customer; the data importer is ResolutionFlow LLC.
|
||||
- **Annex I.B. (Description of Transfer):** As set out in Annex A of this DPA.
|
||||
- **Annex I.C. (Competent supervisory authority):** Irish Data Protection Commission. `[LEGAL REVIEW: confirm based on Customer's location]`
|
||||
- **Annex II (Technical and Organisational Measures):** As set out in Annex B of this DPA.
|
||||
- **Annex III (Sub-processors):** As set out in Annex C of this DPA.
|
||||
|
||||
For UK transfers, the **UK Addendum** to the EU SCCs (Information Commissioner's Office, "International Data Transfer Addendum to the EU Commission Standard Contractual Clauses") is incorporated, and Table 4 of the Addendum is completed such that neither party may end the Addendum as set out in Section 19 unless otherwise agreed. `[LEGAL REVIEW: confirm Table 4 election with counsel]`
|
||||
119
legal/implementation-verification.md
Normal file
119
legal/implementation-verification.md
Normal file
@@ -0,0 +1,119 @@
|
||||
# Implementation Verification
|
||||
|
||||
Generated: 2026-05-14
|
||||
Scanned commit: `0564646` on `feat/public-landing-routing-refactor`
|
||||
|
||||
This document checks every concrete claim in the generated legal documents against what the code actually does. Each row is marked:
|
||||
|
||||
- ✅ **Confirmed** — code clearly supports the claim
|
||||
- ⚠️ **Partial** — the code supports a narrower or related claim; the language is acceptable but tighten if possible
|
||||
- ❌ **Not implemented** — the claim is aspirational; either build it or rewrite the claim
|
||||
- ❓ **Cannot verify in scan** — depends on a runtime config, deployment posture, or external attestation the scan can't reach
|
||||
|
||||
> A claim that overpromises is worse than one that underpromises. Anything ❌ must be resolved (built or rewritten) before publication.
|
||||
|
||||
---
|
||||
|
||||
## Privacy Policy
|
||||
|
||||
| Claim | Source in docs | Reality | Verdict |
|
||||
|---|---|---|---|
|
||||
| Passwords are bcrypt-hashed with 12 rounds; plaintext never stored | §3.1, §9 | `BCRYPT_ROUNDS=12` ([config.py:86](../backend/app/core/config.py#L86)); `User.password_hash` ([user.py:36](../backend/app/models/user.py#L36)) | ✅ |
|
||||
| PSA integration credentials encrypted at the application layer using Fernet (AES-128-CBC + HMAC), key derived via HKDF from `SECRET_KEY` | §3.1, §9; DPA Annex B.1 | [encryption.py](../backend/app/services/psa/encryption.py) | ✅ |
|
||||
| TLS for production traffic | §9; DPA Annex B.1 | Hosted at `api.resolutionflow.com` / `resolutionflow.com` via Railway with HTTPS | ❓ (depends on Railway domain config; verify) |
|
||||
| Tenant isolation enforced by PostgreSQL row-level security | §9; DPA Annex B.2 / B.5 | RLS referenced in [PROJECT_CONTEXT.md:206](../.ai/PROJECT_CONTEXT.md#L206) as "Phase 4 RLS"; `account_id` scoping pervasive | ✅ |
|
||||
| Access tokens stored in `localStorage` rather than HTTP-only cookies | §9 | Confirmed in [authStore.ts:47-48](../frontend/src/store/authStore.ts#L47-L48), [OAuthCallbackPage.tsx:100-101](../frontend/src/pages/OAuthCallbackPage.tsx#L100-L101) | ✅ |
|
||||
| 5-minute access tokens, idle 3d / absolute 14d refresh defaults | §6 retention table; Cookie Policy §2.1 | [config.py:69-79](../backend/app/core/config.py#L69-L79) | ✅ |
|
||||
| Account deletion soft-deletes the user and revokes refresh tokens; account-scoped content **not** automatically purged | §6 (drafted as a `[LEGAL REVIEW]` flag) | [accounts.py:524-567](../backend/app/api/endpoints/accounts.py#L524-L567) — confirms the soft-delete + token revoke; no purge of `audit_logs`, `ai_sessions`, etc. | ⚠️ disclosed accurately as a flagged gap; ❌ if you intend to claim "we delete your data" |
|
||||
| AI flow-builder wizard conversations purged 24h after creation | §6 retention | [scheduler.py:118-136](../backend/app/core/scheduler.py#L118-L136), hourly job | ✅ |
|
||||
| Assistant chat threads retained 90 days OR 100-chat cap (account-configurable), pinned exempt | §6 retention | [retention_cleanup.py](../backend/app/services/retention_cleanup.py); defaults in [account.py:40-45](../backend/app/models/account.py#L40-L45) | ✅ |
|
||||
| AI chat sessions auto-archived after 30 days idle | §6 retention | [main.py:45-63](../backend/app/main.py#L45-L63) | ✅ (note: archived, not deleted — disclosed accurately) |
|
||||
| Audit logs retention | §6 (flagged) | No purge job — indefinite | ❌ — fix or rewrite |
|
||||
| Refresh-token row cleanup | §6 retention | Rows persist after expiry/revoke | ❌ — fix or rewrite (data-inventory open item) |
|
||||
| Email-verification / password-reset token cleanup | §6 retention | Rows persist after expiry/use | ❌ — fix or rewrite |
|
||||
| File-upload deletion on account deletion | §6 retention | `file_uploads` rows + Railway Object Storage objects retained | ❌ — fix or rewrite |
|
||||
| Stripe never sees full card data; we hold only Stripe customer/subscription IDs | §3.4; Subprocessor List Stripe row | `@stripe/stripe-js` on frontend (Elements pattern); backend stores `stripe_customer_id`, `stripe_subscription_id` only ([account.py:28](../backend/app/models/account.py#L28), [subscription.py](../backend/app/models/subscription.py)) | ✅ |
|
||||
| PostHog initialized with `persistence: 'localStorage+cookie'`; identified by `user.id`, grouped by `account_id`; US instance | §3.2; Cookie Policy §2.3 | [main.tsx:17-23](../frontend/src/main.tsx#L17-L23); [analytics.ts:34-40](../frontend/src/lib/analytics.ts#L34-L40) | ✅ |
|
||||
| Sentry: backend `send_default_pii=True`; replay 1%/100% with text + media unmasked | §3.2 (disclosed); Subprocessor List | [main.py:14-26](../backend/app/main.py#L14-L26); [instrument.ts:9-12](../frontend/src/instrument.ts#L9-L12) | ✅ (disclosed accurately; ⚠️ recommend narrowing — see Attorney Checklist A2) |
|
||||
| Anthropic is the sole live LLM provider | §5.1; Subprocessor List | `AI_PROVIDER='anthropic'` ([config.py:159](../backend/app/core/config.py#L159)); user-confirmed Gemini not provisioned | ✅ |
|
||||
| Voyage AI is the live embedding provider | Subprocessor List | `VOYAGE_API_KEY`, `EMBEDDING_MODEL='voyage-3.5'` ([config.py:219-221](../backend/app/core/config.py#L219-L221)); user-confirmed key set | ✅ |
|
||||
| No model training on Customer Data (Anthropic, Voyage) | ToS §3.4; Subprocessor List | Public terms commitment of each subprocessor; not enforceable from our side | ❓ — re-verify subprocessor terms before each publish |
|
||||
| Resend is the transactional email provider; address `invites@resolutionflow.com` | Subprocessor List | [config.py:97-99](../backend/app/core/config.py#L97-L99) | ✅ |
|
||||
| Google Fonts loaded over CDN → IP exposed to Google | §5.1; Subprocessor List; Cookie Policy §2.5 | [index.html:11-13](../frontend/index.html#L11-L13) | ✅ |
|
||||
| Microsoft Learn MCP retrieves public docs only; no Customer Data egress | Subprocessor List "What is NOT" | `ENABLE_MCP_MICROSOFT_LEARN=True` ([config.py:216](../backend/app/core/config.py#L216)); the MCP search query string is the only outbound payload | ⚠️ partial — the query string itself can include AI-session context. Disclosed at a high level; if Customer Data text could be substantively included in a query, consider listing MS Learn as a subprocessor. |
|
||||
| Backup retention 90 days | §9 backup language; DPA §6.3 | User-stated target; depends on Railway PITR window configuration | ❓ — verify Railway PITR configuration matches |
|
||||
|
||||
---
|
||||
|
||||
## Terms of Service
|
||||
|
||||
| Claim | Source | Reality | Verdict |
|
||||
|---|---|---|---|
|
||||
| Owner, admin, engineer, viewer role hierarchy; team-admin gate separately | §2.3 | `permissions.py`, `User.account_role` ([user.py:25-52](../backend/app/models/user.py#L25-L52)) | ✅ |
|
||||
| Only owner can delete the account; deletion blocked if other members remain | §9.2 | [accounts.py:524-548](../backend/app/api/endpoints/accounts.py#L524-L548) | ✅ |
|
||||
| Removed members are moved to a personal account on the free tier | §2.3 | [accounts.py:231-254](../backend/app/api/endpoints/accounts.py#L231-L254) | ✅ |
|
||||
| ConnectWise PSA integration available | §1, §3.1, §8 | `services/psa/connectwise/`; only live PSA provider per user | ✅ |
|
||||
| AI features integrate Anthropic; outputs may include errors | §4.2 | Code confirms Anthropic integration; honest disclosure | ✅ |
|
||||
| 30-day export window post-termination | §9.4 | No automated export-window enforcement in code | ❌ — needs implementation or rewrite |
|
||||
| Stripe handles payment processing | §5.3 | `@stripe/stripe-js` + `STRIPE_*` env vars | ✅ |
|
||||
| Auto-renewal of subscriptions | §5.2 | Stripe Subscriptions semantics | ✅ |
|
||||
| 30-day notice for price changes | §5.5 | Operational commitment; not code-enforced | ❓ — operational |
|
||||
| MFA disclosure (not required) | (Privacy Policy §9 — accurate omission) | No MFA code path detected | ✅ |
|
||||
|
||||
---
|
||||
|
||||
## DPA
|
||||
|
||||
| Claim | Source | Reality | Verdict |
|
||||
|---|---|---|---|
|
||||
| Application-layer encryption for PSA credentials | Annex B.1 | Confirmed (above) | ✅ |
|
||||
| RLS for tenant isolation | Annex B.2/B.5 | Confirmed (above) | ✅ |
|
||||
| Authorized sub-processors list matches reality | Annex C | Matches Subprocessor List (Anthropic, Voyage, Stripe, Resend, Sentry, PostHog, Railway, Google Fonts) | ✅ |
|
||||
| 72-hour breach notification SLA | §3.7 | Operational commitment | ❓ — define an internal detection-to-notify procedure to make this credible |
|
||||
| Audit reports (SOC 2) available | §3.8.1 | No SOC 2 today | ⚠️ language says "when available," which is honest |
|
||||
| Customer Data deleted after 30-day export window | §6.2 | Not implemented — see Privacy Policy table above | ❌ — flagged in Attorney Checklist A1 |
|
||||
| 90-day backup retention | §6.3 | User-stated; depends on Railway PITR config | ❓ |
|
||||
| SCC Module 2 / Module 3 incorporation | §5.1 + Annex D | Drafting only — no Customer signed instance yet | ❓ — operational |
|
||||
|
||||
---
|
||||
|
||||
## Subprocessor List
|
||||
|
||||
| Subprocessor | Listed correctly? | Notes |
|
||||
|---|---|---|
|
||||
| Railway | ✅ | Hosting + DB + Object Storage all in one entry |
|
||||
| Anthropic | ✅ | LLM API for FlowPilot and AI features |
|
||||
| Voyage AI | ✅ | Embedding provider; confirm DPA URL with attorney |
|
||||
| Stripe | ✅ | Payment processor |
|
||||
| Resend | ✅ | Transactional email |
|
||||
| Sentry | ✅ | Error + Session Replay; see A2 about config |
|
||||
| PostHog | ✅ | Product analytics; US instance |
|
||||
| Google Fonts | ✅ | Disclosed; consider self-hosting (A3) |
|
||||
| Gemini / Google AI | Omitted (correct) | Not provisioned in prod |
|
||||
| OpenAI | Omitted (correct) | Not detected |
|
||||
| Autotask, HaloPSA | Omitted (correct) | Not live |
|
||||
| ConnectWise | Disclosed as non-subprocessor (correct) | Customer-controlled data source |
|
||||
| Microsoft Learn MCP | Disclosed as non-subprocessor | Verified: doc-retrieval only |
|
||||
|
||||
---
|
||||
|
||||
## Cookie Policy
|
||||
|
||||
| Item | Reality | Verdict |
|
||||
|---|---|---|
|
||||
| `access_token` and `refresh_token` in localStorage | [authStore.ts:47-48, 86-87](../frontend/src/store/authStore.ts) and others | ✅ |
|
||||
| `theme-storage`, `rf-editor-fullscreen`, `rf-intended-plan`, `recentFlows`, step-feedback flag, rated-sessions, escalation-queue seen | All confirmed by grep | ✅ |
|
||||
| `ph_*` cookie set by PostHog due to `persistence: 'localStorage+cookie'` | [main.tsx:17-23](../frontend/src/main.tsx#L17-L23) | ✅ |
|
||||
| Sentry described as telemetry-only, not cookie-setting | Default Sentry browser SDK behavior matches description | ✅ |
|
||||
| Google Fonts disclosed | [index.html:11-13](../frontend/index.html#L11-L13) | ✅ |
|
||||
| Consent mechanism for EU/UK | **Not implemented** | ❌ — see Attorney Checklist A3 |
|
||||
|
||||
---
|
||||
|
||||
## Net verdict
|
||||
|
||||
**Safe to share with an attorney as a starting draft.** Do not publish to the public website until the items marked ❌ are resolved by either:
|
||||
1. Building the missing behavior (recommended path for A1 deletion-on-offboarding, A3 consent banner, A2 Sentry config tightening), OR
|
||||
2. Rewriting the relevant paragraph to describe the actual behavior with no overclaim.
|
||||
|
||||
The factual scaffolding (subprocessors, encryption posture, retention reality, cookie inventory) is accurate. The remaining work is commercial-risk calibration and a small number of high-priority implementation gaps.
|
||||
215
legal/privacy-policy.md
Normal file
215
legal/privacy-policy.md
Normal file
@@ -0,0 +1,215 @@
|
||||
# Privacy Policy
|
||||
|
||||
**Effective Date:** 2026-05-14
|
||||
**Last Updated:** 2026-05-14
|
||||
**Version:** 1.0
|
||||
|
||||
> **DRAFT — not legal advice.** This document was generated from a code scan and is intended for review by a qualified attorney before publication. Sections marked `[LEGAL REVIEW]` require attorney calibration.
|
||||
|
||||
## 1. Introduction
|
||||
|
||||
ResolutionFlow LLC ("ResolutionFlow," "we," "us," or "our") provides a software-as-a-service platform that helps managed service providers (MSPs) triage, resolve, and document IT support tickets. This Privacy Policy explains how we handle personal information when you visit our website, create an account, or use the ResolutionFlow Services.
|
||||
|
||||
**Important — two distinct data categories.** ResolutionFlow processes two distinct categories of data, and they are governed by different documents:
|
||||
|
||||
1. **Personal information of our direct users** — for example, the MSP technician or owner who creates a ResolutionFlow account. This Privacy Policy describes how we handle that information.
|
||||
2. **Customer Data** that flows through the Services on behalf of an MSP customer — for example, ticket data retrieved from a connected ConnectWise PSA instance, file uploads, and the contents of AI sessions. We process Customer Data as a service provider under the [Data Processing Agreement](dpa.md) ("DPA") between ResolutionFlow and the MSP, and the MSP's own privacy notices govern the relationship with the individuals whose data appears in that Customer Data.
|
||||
|
||||
If you are an end-client of an MSP and have questions about how the MSP uses ResolutionFlow to handle data about you, please contact the MSP directly. ResolutionFlow does not have a direct relationship with end-clients of our customers.
|
||||
|
||||
## 2. Who we are
|
||||
|
||||
**Controller:** ResolutionFlow LLC
|
||||
**Country of operation:** United States
|
||||
**Contact:** support@resolutionflow.com
|
||||
|
||||
We do not publish a physical mailing address on this page. For service of legal process, written notice, or to receive our address for a contractual purpose, please contact support@resolutionflow.com.
|
||||
|
||||
`[LEGAL REVIEW: appoint and disclose a Data Protection Officer if required under GDPR Article 37, and an EU/UK representative under Article 27 because ResolutionFlow has no EEA or UK establishment]`
|
||||
|
||||
## 3. Information we collect
|
||||
|
||||
### 3.1 Information you provide to us
|
||||
|
||||
- **Account information** — your name, email address, and password. We use these to create and authenticate your account and to send transactional messages about the Services. We hash passwords using bcrypt; we never store plaintext passwords.
|
||||
- **Profile information** — phone number, job title, time zone, avatar image, and (for solo professionals) optional company display name and uploaded logo. Optional; collected to personalize your experience and your ticket outputs.
|
||||
- **Account / organization information** — the account name, display code, optional team size, optional branding (logo, primary color, company name), and the PSA platform you primarily use. Collected so we can route subscriptions, invites, and integration data correctly.
|
||||
- **Federated sign-in identifiers** — if you sign in with Google or Microsoft, we receive the provider's subject identifier and the email address the provider returns at the time you link the account, and we store the linkage so we can recognize you on future logins.
|
||||
- **Integration credentials** — when you connect a ConnectWise PSA instance, you provide your ConnectWise company ID, public key, and private key. We **encrypt these credentials at rest at the application layer using Fernet (AES-128-CBC + HMAC-SHA256), with a key derived from our server secret via HKDF**. We use them only to retrieve and write data on your behalf. `[LEGAL REVIEW: verify encryption claim if material changes are made to services/psa/encryption.py]`
|
||||
- **Sales / demo requests** — if you submit our contact or demo form, we collect your name, work email, company, optional team size, and any message you choose to send. We use this to contact you and to follow up on your inquiry.
|
||||
- **Beta / waitlist signups** — if you sign up for our beta or waitlist, we collect your email and any other information you choose to provide.
|
||||
- **Support communications** — when you contact us at support@resolutionflow.com, we receive the contents of your message and any information you choose to include.
|
||||
- **Feedback** — if you submit in-product feedback, beta feedback, surveys, or session ratings, we collect what you submit and link it to your account so we can respond and learn from it.
|
||||
|
||||
### 3.2 Information we collect automatically
|
||||
|
||||
- **Usage data** — pages and features you interact with, timestamps of actions, AI-feature inputs and outputs you generate. We use this to understand how the Services are used and to bill the right account for AI usage.
|
||||
- **Device and connection data** — IP address, browser type, operating system, time zone. We collect this for security, fraud prevention, and to deliver content appropriately. IP addresses are captured in our audit logs and (subject to your sampling rate) in error reports.
|
||||
- **Authentication and security events** — login attempts, OAuth identity linking, password resets, refresh-token rotations, and administrative actions are recorded in our internal audit log. `[LEGAL REVIEW: today these records are retained indefinitely; we recommend implementing a defined retention window (e.g., 12 months) and stating it here]`
|
||||
- **Product analytics** — when you use the Services, our analytics provider (PostHog) records page views, feature interactions ("autocapture"), and custom events, identified by your user ID and grouped by your account. Web Vitals (page-load performance metrics) are also captured.
|
||||
- **Error and performance monitoring** — our error-tracking provider (Sentry) records errors, performance traces, and a sampled subset of browser sessions. By default, our backend sends error reports including user identifiers and request metadata. Our frontend captures Session Replay at 1% of normal sessions and 100% of sessions in which an error occurs; replays may capture visible page contents. `[LEGAL REVIEW: this configuration is broader than typical defaults — see implementation-verification.md. Either narrow the configuration (mask text and media, set send_default_pii=False, add scrubbing rules) or expand this disclosure with specific examples of what may be captured]`
|
||||
|
||||
### 3.3 Information from third-party services
|
||||
|
||||
- **ConnectWise PSA** — when you connect a ConnectWise instance, we retrieve ticket, company, contact, configuration, and note data on your behalf. **This data is Customer Data governed by the DPA, not this Privacy Policy.** ConnectWise is your PSA provider; it is not a ResolutionFlow subprocessor. Your relationship with ConnectWise is governed by your agreement with ConnectWise.
|
||||
- **Stripe** — when you subscribe, Stripe handles your payment information directly and sends us a customer ID, a subscription ID, billing status, and webhook event metadata. We do not see or store your full payment card number.
|
||||
- **Google / Microsoft (Sign-in)** — if you choose to sign in via Google or Microsoft, we receive the identifiers described in Section 3.1.
|
||||
|
||||
### 3.4 Information we do not collect
|
||||
|
||||
We do not knowingly collect:
|
||||
|
||||
- Sensitive personal information categories about our direct users in the ordinary course of providing the Services (health data, financial account credentials, biometrics, precise geolocation, government IDs). If a free-text field (for example, a support message or in-product feedback) contains this kind of information because you typed it, we treat the field as ordinary content; we recommend you avoid placing such information into free-text fields. `[LEGAL REVIEW: this is an honest disclosure of incidental risk]`
|
||||
- Personal information from individuals under 16 years of age. The Services are designed for IT professionals and are not directed to children.
|
||||
- Full credit card numbers. Payment information is collected and processed directly by Stripe; we receive only a Stripe customer ID, a subscription ID, and billing status.
|
||||
|
||||
## 4. How we use information
|
||||
|
||||
We use personal information for the following purposes, each with the indicated legal basis under GDPR / UK GDPR. Under CCPA/CPRA, we use the same information for the same business and commercial purposes.
|
||||
|
||||
| Purpose | Information used | Legal basis (GDPR) |
|
||||
|---|---|---|
|
||||
| Create and operate your account; deliver the Services | Account, profile, federated identity, integration credentials | Contract performance (Art. 6(1)(b)) |
|
||||
| Authenticate you and secure the Services | Authentication and security events, device/connection data, audit logs | Legitimate interests (Art. 6(1)(f)) — securing the Services |
|
||||
| Send transactional messages (invites, password resets, verification, billing receipts, security alerts) | Account, email | Contract performance |
|
||||
| Process subscription billing | Stripe customer ID, billing metadata | Contract performance |
|
||||
| Respond to your support, demo, sales, beta, or feedback submissions | The submission itself | Contract performance / legitimate interests (responding to your request) |
|
||||
| Generate AI-assisted outputs (FlowPilot, chat, resolution notes, escalation packages, embeddings, network diagrams, scripts) | Inputs you submit, Customer Data you authorize | Contract performance (provision of Services) |
|
||||
| Operate product analytics and Web Vitals via PostHog | User identifier, behavioral events, page paths | Legitimate interests + (in the EU/UK) consent where required for non-essential cookies / local storage `[LEGAL REVIEW: a consent banner is required for EU/UK before PostHog initializes]` |
|
||||
| Operate error monitoring via Sentry | Error reports, request metadata, sampled Session Replay | Legitimate interests (improving and securing the Services) |
|
||||
| Aggregate usage to improve the Services | Aggregated, de-identified usage data | Legitimate interests |
|
||||
| Send marketing emails (if you opt in) | Email, name | Consent (you can withdraw at any time) `[LEGAL REVIEW: confirm whether marketing emails are sent today — if so, ensure opt-in capture is recorded]` |
|
||||
| Comply with legal obligations | As required | Legal obligation (Art. 6(1)(c)) |
|
||||
|
||||
We do not use Customer Data for our own purposes — including model training, advertising, or marketing — except as necessary to provide the Services to the MSP customer that supplied it. AI feature inputs are sent to our AI subprocessor (Anthropic) for the purpose of generating the response; Anthropic does not train its models on these inputs under the API tier we use. `[LEGAL REVIEW: re-verify Anthropic's no-training-on-API-traffic commitment for the current API tier at each publication]`
|
||||
|
||||
## 5. How we share information
|
||||
|
||||
We share personal information only as described below. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.
|
||||
|
||||
### 5.1 Service providers (subprocessors)
|
||||
|
||||
We share information with carefully selected third parties who process personal information on our behalf to deliver the Services. The complete and current list is at [/legal/subprocessors](subprocessor-list.md). Today, our subprocessors are:
|
||||
|
||||
- **Railway Corp.** (United States) — application and database hosting + S3-compatible object storage for uploaded files
|
||||
- **Anthropic, PBC** (United States) — large-language-model API for FlowPilot and other AI-assisted features
|
||||
- **Voyage AI** (United States) — embedding model for similarity search and retrieval-augmented features
|
||||
- **Stripe, Inc.** (United States) — payment processing
|
||||
- **Resend** (United States) — transactional and account email delivery
|
||||
- **Sentry** (United States) — error monitoring, performance traces, and Session Replay
|
||||
- **PostHog** (United States) — product analytics
|
||||
- **Google LLC** (Global) — Google Fonts CDN used by our website; receives your IP address as part of loading the fonts `[LEGAL REVIEW: consider self-hosting fonts to remove this disclosure for EU/UK visitors]`
|
||||
|
||||
Each subprocessor is bound by a data processing agreement and processes personal information only on our documented instructions.
|
||||
|
||||
### 5.2 Business transfers
|
||||
|
||||
If ResolutionFlow is involved in a merger, acquisition, financing, or asset sale, personal information may be transferred to the involved parties. We will provide notice through the Services or by email before personal information becomes subject to a materially different privacy policy.
|
||||
|
||||
### 5.3 Legal requirements
|
||||
|
||||
We may disclose personal information when we believe in good faith that disclosure is required by law, regulation, legal process, or government request, or to protect our rights, our users, or the public.
|
||||
|
||||
### 5.4 With your consent
|
||||
|
||||
For any sharing not described above, we will obtain your consent.
|
||||
|
||||
## 6. Data retention
|
||||
|
||||
We retain personal information only as long as needed for the purposes described in this Privacy Policy. The retention picture today is:
|
||||
|
||||
| Category | Retention |
|
||||
|---|---|
|
||||
| Account information | For the life of your account, plus up to **90 days** of backup retention after account deletion |
|
||||
| AI flow-builder wizard conversations | **24 hours** (purged hourly) |
|
||||
| Assistant chat threads | Account-configurable, **default 90 days** OR a maximum of **100 chats** (whichever first); pinned chats are exempt |
|
||||
| AI chat sessions inactive for 30 days | Auto-archived; not deleted unless you delete them |
|
||||
| Stripe webhook event records | Retained for idempotency and audit |
|
||||
| Audit logs, authentication and security events | `[LEGAL REVIEW: today retained indefinitely; implement a 12-month default and update this row to "12 months"]` |
|
||||
| AI session content, escalation packages, resolution notes, file uploads, and other Customer Data | Retained for the life of the account; deleted on customer request as described in the DPA |
|
||||
| Marketing-communication opt-outs | Retained indefinitely so we can honor your preference |
|
||||
| Billing records | As required by tax and accounting law (typically 7 years in the US) |
|
||||
|
||||
When you delete your account, we soft-delete your user record, revoke your refresh tokens, and stop your access. **`[LEGAL REVIEW: today, the account row and account-scoped content such as audit logs, session content, file uploads, and AI usage records are not automatically purged on account deletion. Either implement scheduled deletion or rewrite this paragraph to describe the actual behavior and provide a deletion-on-request path with a stated SLA. We recommend the former.]`** Personal information may persist in routine backups for up to 90 days after deletion. We will not restore deleted information from backups except to recover from a system failure.
|
||||
|
||||
## 7. Your rights
|
||||
|
||||
Depending on where you live, you may have some or all of the following rights regarding your personal information:
|
||||
|
||||
- **Right to know / access** — request a copy of the personal information we hold about you
|
||||
- **Right to correct** — request that we correct inaccurate personal information
|
||||
- **Right to delete** — request that we delete your personal information
|
||||
- **Right to portability** — receive your personal information in a structured, machine-readable format
|
||||
- **Right to restrict or object to processing** — limit how we process your personal information in certain circumstances
|
||||
- **Right to opt out of sale or sharing for advertising** — we do not sell personal information or share it for cross-context behavioral advertising; if this ever changes, we will offer an opt-out
|
||||
- **Right to limit use of sensitive personal information** — under CPRA, where applicable
|
||||
- **Right to withdraw consent** — where processing is based on consent, you may withdraw it at any time without affecting prior processing
|
||||
- **Right to non-discrimination** for exercising any of these rights
|
||||
- **Right to appeal** — if we deny a rights request, you may appeal by replying to our response with "Appeal"
|
||||
- **Right to lodge a complaint with a supervisory authority** — EU/UK residents may contact their national data protection authority (for example, the UK's Information Commissioner's Office)
|
||||
|
||||
To exercise these rights, email us at **support@resolutionflow.com** with the subject "Privacy Rights Request." We will respond within 45 days (extendable by an additional 45 days for complex requests) as required by applicable law. We may request information sufficient to verify your identity before responding.
|
||||
|
||||
You may designate an authorized agent to make a request on your behalf, subject to identity verification.
|
||||
|
||||
We treat Global Privacy Control (GPC) browser signals as an opt-out of sale or sharing of personal information.
|
||||
|
||||
## 8. International data transfers
|
||||
|
||||
ResolutionFlow LLC is based in the United States, and our infrastructure is hosted in the United States. When you use the Services, your personal information will be transferred to and processed in the United States, which may have different data protection laws than your home country.
|
||||
|
||||
For transfers of personal information from the European Economic Area, United Kingdom, or Switzerland to the United States, we rely on:
|
||||
|
||||
- The **Standard Contractual Clauses** approved by the European Commission in Decision 2021/914 (Module 2 or Module 3, as applicable to the parties' roles)
|
||||
- The **UK Addendum** to the EU Standard Contractual Clauses for UK transfers
|
||||
- Equivalent safeguards required by Swiss law for Swiss transfers
|
||||
|
||||
`[LEGAL REVIEW: consider EU-US Data Privacy Framework certification when ResolutionFlow LLC qualifies; until then SCCs are the baseline transfer mechanism. Designate an Art. 27 EU/UK representative if required.]`
|
||||
|
||||
## 9. Security
|
||||
|
||||
We implement technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These include:
|
||||
|
||||
- **Encryption in transit** using TLS for all production traffic
|
||||
- **Encryption at rest** — Railway-managed Postgres and Object Storage are encrypted at rest at the infrastructure layer, and we additionally apply **application-layer Fernet encryption to stored PSA integration credentials** (the keys we hold on your behalf to talk to ConnectWise) `[LEGAL REVIEW: verify Railway's encryption-at-rest attestation]`
|
||||
- **Password hashing** using bcrypt with 12 rounds; we never store plaintext passwords
|
||||
- **Authentication tokens** delivered as bearer tokens to your browser; we store hashes (not the tokens themselves) on the server
|
||||
- **Role-based access control** at the application layer (super_admin / owner / admin / engineer / viewer), and PostgreSQL row-level security for tenant isolation between accounts
|
||||
- **Audit logging** of administrative actions
|
||||
- **Periodic security review** of subprocessors
|
||||
- **OAuth-based sign-in** options via Google and Microsoft
|
||||
|
||||
We do not currently require multi-factor authentication. `[LEGAL REVIEW: consider whether to disclose MFA explicitly once available, or to require MFA for admin/owner roles]`
|
||||
|
||||
We deliberately store our short-lived access and refresh tokens in your browser's `localStorage` rather than in HTTP-only cookies. This choice carries a known trade-off: tokens in `localStorage` are accessible to any JavaScript running on the page, so a successful cross-site-scripting (XSS) attack against the Services could expose them. We mitigate this risk with content-security headers, short access-token lifetimes, idle and absolute session limits, and bulk token revocation on password change. `[LEGAL REVIEW: this is an honest disclosure; calibrate as needed]`
|
||||
|
||||
No security measure is perfect. If we become aware of a personal data breach affecting your information, we will notify you and supervisory authorities as required by applicable law.
|
||||
|
||||
## 10. Cookies and similar technologies
|
||||
|
||||
We use cookies and similar technologies on the Services. See the [Cookie Policy](cookie-policy.md) for the full list.
|
||||
|
||||
In short: we use authentication tokens stored in your browser to keep you signed in; we store a small number of UI preferences in your browser's local storage; and our product analytics provider (PostHog) sets one cookie alongside its `localStorage` data when you use authenticated parts of the Services. We do not use advertising cookies or cross-context behavioral advertising trackers.
|
||||
|
||||
## 11. Children's privacy
|
||||
|
||||
The Services are not directed to individuals under 16 years of age. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child under 16, please contact us at support@resolutionflow.com and we will delete it.
|
||||
|
||||
## 12. Changes to this Privacy Policy
|
||||
|
||||
We may update this Privacy Policy from time to time. We will notify you of changes by posting the updated Privacy Policy with a new "Last Updated" date. For material changes affecting how we use your personal information, we will provide notice through the Services or by email at least **30 days** before the change takes effect.
|
||||
|
||||
Your continued use of the Services after the effective date constitutes acceptance of the updated Privacy Policy.
|
||||
|
||||
## 13. Contact us
|
||||
|
||||
For privacy questions or to exercise your rights, contact us at **support@resolutionflow.com**.
|
||||
|
||||
For California residents:
|
||||
- See Section 7 for your CCPA/CPRA rights.
|
||||
- You may designate an authorized agent.
|
||||
- We do not sell or share personal information for cross-context behavioral advertising.
|
||||
|
||||
For EU / UK residents:
|
||||
- You have the right to lodge a complaint with your national data protection authority.
|
||||
- `[LEGAL REVIEW: name the Art. 27 EU and UK representatives once appointed]`
|
||||
82
legal/subprocessor-list.md
Normal file
82
legal/subprocessor-list.md
Normal file
@@ -0,0 +1,82 @@
|
||||
# ResolutionFlow Subprocessor List
|
||||
|
||||
**Effective Date:** 2026-05-14
|
||||
**Last Updated:** 2026-05-14
|
||||
**Version:** 1.0
|
||||
|
||||
> **DRAFT — not legal advice.** This list reflects subprocessors active in the codebase as of the scan date. It must be kept current; new subprocessors require advance customer notice as set out in the DPA.
|
||||
|
||||
This page lists the third-party subprocessors that ResolutionFlow LLC uses to process Customer Data in providing the Services. Each subprocessor is bound by a data processing agreement that imposes obligations materially equivalent to those in our [Data Processing Agreement](dpa.md).
|
||||
|
||||
Existing customers receive at least **30 days' notice** of new subprocessors and may object on reasonable data-protection grounds as set out in the DPA.
|
||||
|
||||
## Infrastructure subprocessors
|
||||
|
||||
| Subprocessor | Service | Data categories processed | Region |
|
||||
|---|---|---|---|
|
||||
| Railway Corp. | Application hosting, PostgreSQL database hosting, and S3-compatible object storage for uploaded files | All account data, all Customer Data stored or processed by the Services, file uploads in the `resolutionflow-uploads` bucket | United States |
|
||||
|
||||
DPA: https://railway.com/legal/dpa
|
||||
|
||||
## AI and machine-learning subprocessors
|
||||
|
||||
| Subprocessor | Service | Data categories processed | Region |
|
||||
|---|---|---|---|
|
||||
| Anthropic, PBC | Large-language-model API (FlowPilot, chat assistant, resolution-note generation, escalation-package generation, fact synthesis, script-builder, network-diagram generation, template extraction) | Prompts submitted to AI features, which may contain Customer Data including PSA ticket content, configuration details, file content extracted from uploads, resized images supplied to multimodal features, conversation history within an AI session | United States |
|
||||
| Voyage AI, Inc. | Embedding model for similarity search and retrieval-augmented features | Text excerpts from your flows, sessions, and knowledge content used to compute vector embeddings (`voyage-3.5`) | United States |
|
||||
|
||||
DPAs:
|
||||
- Anthropic: https://www.anthropic.com/legal/commercial-dpa
|
||||
- Voyage AI: contact subprocessor for current DPA `[LEGAL REVIEW: confirm Voyage AI DPA URL]`
|
||||
|
||||
**Important — no model training on Customer Data.** We use Anthropic's API at a commercial tier that does not train Anthropic's models on Customer Data. Voyage AI processes embedding requests transactionally. We do not authorize either subprocessor to use Customer Data for any purpose other than producing the requested response. `[LEGAL REVIEW: re-verify the no-training stance against each subprocessor's current public terms each time this list is republished]`
|
||||
|
||||
## Payment and billing subprocessors
|
||||
|
||||
| Subprocessor | Service | Data categories processed | Region |
|
||||
|---|---|---|---|
|
||||
| Stripe, Inc. | Payment processing and subscription billing | Customer billing contact, Stripe customer ID, payment method details (collected directly by Stripe — ResolutionFlow does not store full card numbers), subscription transactions, webhook event payloads | United States |
|
||||
|
||||
DPA: https://stripe.com/legal/dpa
|
||||
|
||||
## Communication subprocessors
|
||||
|
||||
| Subprocessor | Service | Data categories processed | Region |
|
||||
|---|---|---|---|
|
||||
| Resend | Transactional and account email delivery (account invites, password resets, email verification, billing-related messages, internal sales-lead and feedback notifications) | Recipient email addresses, message subject and body | United States |
|
||||
|
||||
DPA: https://resend.com/legal/dpa
|
||||
|
||||
## Operational subprocessors
|
||||
|
||||
| Subprocessor | Service | Data categories processed | Region |
|
||||
|---|---|---|---|
|
||||
| Functional Software, Inc. (dba Sentry) | Error monitoring, performance traces, and Session Replay | Error reports, stack traces, request metadata, user identifiers, sampled browser session replays (1% of normal sessions, 100% of sessions in which an error occurred); see implementation-verification.md for the current configuration | United States |
|
||||
| PostHog, Inc. | Product analytics, autocapture, page-view tracking, and Web Vitals reporting | User identifier, account identifier (as a group), behavioral events, page paths, autocaptured DOM interactions, performance metrics | United States (`us.i.posthog.com`) |
|
||||
| Google LLC | Google Fonts CDN (font assets loaded by ResolutionFlow's public website) | Visitor IP address (exposed to Google as part of font requests) | Global Google CDN |
|
||||
|
||||
DPAs:
|
||||
- Sentry: https://sentry.io/legal/dpa/
|
||||
- PostHog: https://posthog.com/dpa
|
||||
- Google: Google's standard terms
|
||||
|
||||
`[LEGAL REVIEW: Google Fonts loaded over fonts.googleapis.com is a recurring GDPR enforcement target; consider self-hosting fonts to remove this row]`
|
||||
|
||||
## What is NOT a subprocessor
|
||||
|
||||
The following are referenced for completeness but are **not** ResolutionFlow subprocessors:
|
||||
|
||||
- **ConnectWise PSA** — When you connect a ConnectWise instance, ResolutionFlow retrieves data from that instance under your authorization. ConnectWise is your PSA provider, not our subprocessor. Your relationship with ConnectWise is governed by your agreement with ConnectWise.
|
||||
- **DNS and domain registrars** — These providers hold ResolutionFlow's domain records but do not process Customer Data.
|
||||
- **Microsoft Learn (Model Context Protocol)** — When AI features benefit from Microsoft technical documentation, ResolutionFlow's backend retrieves public Microsoft Learn content. No Customer Data is sent to Microsoft as part of this lookup; only the search query string formed from the AI session is sent.
|
||||
- **Customer-side integrations** that you connect to ResolutionFlow are governed by your agreements with those third parties.
|
||||
|
||||
## Changes to this list
|
||||
|
||||
We update this list when we add, remove, or materially change subprocessors. We notify existing customers of new subprocessors as set out in the DPA. The "Effective Date" above reflects the most recent change.
|
||||
|
||||
Historical versions are available on request from support@resolutionflow.com.
|
||||
|
||||
## Questions
|
||||
|
||||
Questions about subprocessors? Contact **support@resolutionflow.com**.
|
||||
287
legal/terms-of-service.md
Normal file
287
legal/terms-of-service.md
Normal file
@@ -0,0 +1,287 @@
|
||||
# Terms of Service
|
||||
|
||||
**Effective Date:** 2026-05-14
|
||||
**Version:** 1.0
|
||||
|
||||
> **DRAFT — not legal advice.** This document was generated from a code scan with reasonable defaults. Commercial-risk provisions (liability cap, indemnification, dispute resolution, refunds) are flagged for attorney calibration.
|
||||
|
||||
These Terms of Service ("Terms") govern your use of the ResolutionFlow software-as-a-service platform provided by ResolutionFlow LLC ("ResolutionFlow," "we," "us," or "our"). By creating an account or using the Services, you agree to these Terms.
|
||||
|
||||
If you are entering into these Terms on behalf of a company or other legal entity, you represent that you have the authority to bind that entity to these Terms. In that case, "you" and "your" refer to that entity.
|
||||
|
||||
## 1. The Services
|
||||
|
||||
ResolutionFlow provides a software-as-a-service platform that assists managed service providers (MSPs) in triaging, resolving, and documenting IT support tickets. The Services include:
|
||||
|
||||
- A ticket triage and session interface
|
||||
- An AI-assisted troubleshooting copilot ("FlowPilot")
|
||||
- A general-purpose AI assistant for IT workflows
|
||||
- Integration with the ConnectWise PSA platform
|
||||
- A knowledge base feature ("Knowledge Flywheel") that derives suggestions from your own resolved sessions
|
||||
- A flow and procedural builder, a script builder, and a network-diagram builder
|
||||
- File upload, document analysis, and image analysis for use within sessions
|
||||
|
||||
We may modify, suspend, or discontinue any feature of the Services at any time. For material adverse changes affecting paid subscriptions, we will provide reasonable advance notice through the Services or by email.
|
||||
|
||||
## 2. Eligibility and accounts
|
||||
|
||||
### 2.1 Eligibility
|
||||
|
||||
You must be at least 18 years old and capable of entering into a binding contract to use the Services. The Services are intended for use by businesses providing managed IT services and are not directed to consumers.
|
||||
|
||||
### 2.2 Account responsibilities
|
||||
|
||||
You are responsible for:
|
||||
- Providing accurate account information and keeping it current
|
||||
- Maintaining the confidentiality of your credentials
|
||||
- All activities that occur under your account
|
||||
- Promptly notifying us of unauthorized access at support@resolutionflow.com
|
||||
|
||||
You may not share your account credentials with any person outside your organization or use another person's account.
|
||||
|
||||
### 2.3 Roles within an account
|
||||
|
||||
An account has one **owner**, optional **admins**, and **engineer** or **viewer** members. Only the owner can delete the account, transfer ownership, or invite others. Members may be removed from an account by the owner; a removed member is moved into a personal account on the free tier.
|
||||
|
||||
## 3. Customer Data and your responsibilities
|
||||
|
||||
### 3.1 Definitions
|
||||
|
||||
"**Customer Data**" means the data that you or your authorized users submit to the Services or that the Services retrieve on your behalf from connected third-party systems including ConnectWise PSA. Customer Data may include personal information about your employees, your end-clients, and your end-clients' employees and contacts. Customer Data includes, without limitation: ticket bodies and notes; intake text, images, and log files; AI session conversation histories; resolution notes and escalation packages; uploaded files; and flows, scripts, and diagrams you create within the Services.
|
||||
|
||||
### 3.2 Your representations regarding Customer Data
|
||||
|
||||
You represent and warrant that:
|
||||
- You have all rights, consents, and legal bases necessary to share Customer Data with ResolutionFlow and authorize its processing as described in these Terms and the [Data Processing Agreement](dpa.md) ("DPA")
|
||||
- Your collection and use of Customer Data complies with all applicable laws, including data protection and privacy laws
|
||||
- You will not submit Customer Data that you are not authorized to process for the purposes for which you use the Services
|
||||
- You will not submit **Protected Health Information** as defined under HIPAA unless a Business Associate Agreement is in place between you and ResolutionFlow
|
||||
- You will not submit payment card numbers, government-issued ID numbers, or financial-account credentials of third parties into the Services, except as Stripe handles for ResolutionFlow's own billing
|
||||
- Where you are acting on behalf of your own end-clients, you have all necessary authority to appoint ResolutionFlow as a sub-processor in your chain of processing
|
||||
|
||||
### 3.3 Ownership
|
||||
|
||||
You retain all right, title, and interest in Customer Data. You grant ResolutionFlow a limited, non-exclusive, worldwide license to host, store, process, transmit, display, analyze, and otherwise use Customer Data solely as necessary to provide the Services and as further described in the DPA. This license terminates when Customer Data is deleted as set out in the DPA, except for de-identified, aggregated data used to operate and improve the Services.
|
||||
|
||||
### 3.4 No model training on Customer Data
|
||||
|
||||
We do not use Customer Data to train our own machine-learning models, and we use AI subprocessors at API tiers that do not train on Customer Data. We use de-identified, aggregated usage information to operate, secure, and improve the Services.
|
||||
|
||||
### 3.5 Data Processing Agreement
|
||||
|
||||
The DPA is incorporated into these Terms by reference and governs ResolutionFlow's processing of personal information within Customer Data. Where these Terms and the DPA conflict regarding personal information processing, the DPA controls.
|
||||
|
||||
## 4. Acceptable use
|
||||
|
||||
### 4.1 Prohibited activities
|
||||
|
||||
You may not, and may not permit anyone to:
|
||||
|
||||
- Use the Services for any unlawful purpose or in violation of any applicable law
|
||||
- Use the Services to harass, abuse, defame, or stalk any person
|
||||
- Send spam or other unsolicited messages from or through the Services
|
||||
- Attempt to gain unauthorized access to the Services or any other user's account
|
||||
- Reverse engineer, decompile, or attempt to extract the source code of the Services, except where this restriction is prohibited by applicable law
|
||||
- Interfere with the integrity or performance of the Services, including via denial-of-service attacks, rate-limit evasion, or resource exhaustion
|
||||
- Use the Services to develop a competing service
|
||||
- Resell, sublicense, or provide the Services as a service bureau to third parties without our prior written consent
|
||||
- Use automated means to access the Services other than through documented APIs
|
||||
- Submit content that infringes a third party's intellectual property or violates a third party's privacy rights
|
||||
- Use the Services to process Protected Health Information without a Business Associate Agreement in place between you and ResolutionFlow
|
||||
- Use the Services to process payment card data outside Stripe's payment flow
|
||||
|
||||
### 4.2 AI feature use
|
||||
|
||||
When you use AI-assisted features including FlowPilot, the chat assistant, the script builder, the network-diagram builder, and Knowledge Flywheel outputs, you acknowledge that:
|
||||
|
||||
- AI outputs may contain errors, omissions, or fabricated information ("hallucinations")
|
||||
- You are responsible for reviewing AI outputs before relying on them, posting them to a PSA ticket, sharing them with an end-client, or running scripts generated by them
|
||||
- ResolutionFlow does not guarantee the accuracy, completeness, or safety of AI-generated content
|
||||
- Inputs you submit to AI features are transmitted to AI subprocessors as described in the DPA and Subprocessor List
|
||||
|
||||
### 4.3 Suspension for violation
|
||||
|
||||
We may suspend or terminate your account for violations of this Section 4 with or without notice, depending on the severity of the violation. For clear and active threats to the Services or to other users, we may act immediately.
|
||||
|
||||
## 5. Subscriptions, fees, and payment
|
||||
|
||||
### 5.1 Subscriptions
|
||||
|
||||
The Services are offered on a subscription basis. Subscription details, pricing, and term length are specified at the point of subscription or in a separate order form.
|
||||
|
||||
### 5.2 Billing and renewal
|
||||
|
||||
- Fees are billed in advance for the subscription period (monthly or annually as elected)
|
||||
- Subscriptions automatically renew at the end of each term unless cancelled before the renewal date
|
||||
- Fees are non-refundable except as expressly stated or required by law `[LEGAL REVIEW: confirm refund and proration policy — common alternatives include a 14-day satisfaction window or prorated refunds on annual plans]`
|
||||
|
||||
### 5.3 Payment processor
|
||||
|
||||
Payment is processed by Stripe. By providing payment information, you authorize us to charge the applicable fees to your payment method via Stripe.
|
||||
|
||||
### 5.4 Taxes
|
||||
|
||||
Fees are exclusive of taxes. You are responsible for all applicable sales, use, value-added, and similar taxes.
|
||||
|
||||
### 5.5 Price changes
|
||||
|
||||
We may change subscription prices. For existing subscriptions, price changes take effect on the next renewal and we will provide at least **30 days' notice** before the renewal date.
|
||||
|
||||
### 5.6 Trials and free tiers
|
||||
|
||||
We may offer free trials or a free tier. These may be modified or discontinued at any time. Usage of free or trial features is subject to the same Terms.
|
||||
|
||||
## 6. Intellectual property
|
||||
|
||||
### 6.1 Our IP
|
||||
|
||||
ResolutionFlow and its licensors own all right, title, and interest in the Services, including all software, designs, trademarks, models, prompts, and content (other than Customer Data). These Terms do not grant you any rights to our intellectual property except the limited right to use the Services as expressly provided.
|
||||
|
||||
### 6.2 Feedback
|
||||
|
||||
If you provide feedback, suggestions, or ideas about the Services, you grant us a perpetual, irrevocable, worldwide, royalty-free license to use that feedback without obligation to you.
|
||||
|
||||
### 6.3 Trademarks
|
||||
|
||||
You may not use our trademarks, logos, or trade names without our prior written consent, except for descriptive references (e.g., "we use ResolutionFlow").
|
||||
|
||||
## 7. Privacy
|
||||
|
||||
Our handling of personal information is described in our [Privacy Policy](privacy-policy.md). For Customer Data containing personal information, processing is governed by the [DPA](dpa.md).
|
||||
|
||||
## 8. Third-party services
|
||||
|
||||
The Services may integrate with third-party services that you choose to connect (including ConnectWise PSA). Your use of those third-party services is governed by your agreements with them. We are not responsible for third-party services and disclaim all liability arising from them.
|
||||
|
||||
If a third-party service modifies its API or terms in a way that affects the Services, we may modify or discontinue the integration. We will provide reasonable notice where practicable.
|
||||
|
||||
## 9. Term and termination
|
||||
|
||||
### 9.1 Term
|
||||
|
||||
These Terms remain in effect for as long as you have an account or active subscription with ResolutionFlow.
|
||||
|
||||
### 9.2 Termination by you
|
||||
|
||||
You may terminate your account at any time by following the account-deletion flow in the Services or contacting support@resolutionflow.com. Account deletion requires that you are the sole remaining member of your account. Termination is effective at the end of the current paid subscription period unless otherwise required by law.
|
||||
|
||||
### 9.3 Termination by us
|
||||
|
||||
We may terminate or suspend your account immediately if:
|
||||
|
||||
- You materially breach these Terms (including Section 4)
|
||||
- You fail to pay fees when due and do not cure within 10 days of notice
|
||||
- Required by law or government order
|
||||
- Your use of the Services creates a material legal or security risk to ResolutionFlow or other users
|
||||
|
||||
For other reasons, we may terminate with **30 days' notice**.
|
||||
|
||||
### 9.4 Effect of termination
|
||||
|
||||
Upon termination:
|
||||
|
||||
- Your right to access and use the Services ends
|
||||
- We will make Customer Data available for export for **30 days** following termination as further described in the DPA `[LEGAL REVIEW: confirm export window aligns with what the Services actually support today]`
|
||||
- After the export window, we will delete or anonymize Customer Data as described in the DPA, except where retention is required by law
|
||||
- Sections that by their nature survive termination (intellectual property, confidentiality, indemnification, limitation of liability, dispute resolution) will survive
|
||||
|
||||
## 10. Disclaimers
|
||||
|
||||
`[LEGAL REVIEW: warranty disclaimers are commercial decisions; calibrate with counsel]`
|
||||
|
||||
THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT, EXCEPT TO THE EXTENT THESE DISCLAIMERS ARE PROHIBITED BY APPLICABLE LAW.
|
||||
|
||||
WE DO NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, ERROR-FREE, OR SECURE, OR THAT AI-GENERATED OUTPUTS WILL BE ACCURATE, COMPLETE, OR FIT FOR ANY PARTICULAR PURPOSE.
|
||||
|
||||
## 11. Limitation of liability
|
||||
|
||||
`[LEGAL REVIEW: liability caps are critical commercial decisions; calibrate to insurance posture and revenue]`
|
||||
|
||||
TO THE MAXIMUM EXTENT PERMITTED BY LAW:
|
||||
|
||||
(a) NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, REVENUE, DATA, OR BUSINESS OPPORTUNITIES, ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICES.
|
||||
|
||||
(b) EACH PARTY'S TOTAL LIABILITY IN ANY 12-MONTH PERIOD IS LIMITED TO THE FEES PAID OR PAYABLE BY YOU TO RESOLUTIONFLOW IN THE 12 MONTHS PRECEDING THE EVENT GIVING RISE TO THE CLAIM.
|
||||
|
||||
(c) THE LIMITATIONS IN (a) AND (b) DO NOT APPLY TO: (i) BREACH OF CONFIDENTIALITY OBLIGATIONS; (ii) INDEMNIFICATION OBLIGATIONS; (iii) BREACH OF THE DPA; (iv) GROSS NEGLIGENCE OR WILLFUL MISCONDUCT; (v) LIABILITY THAT CANNOT BE LIMITED UNDER APPLICABLE LAW.
|
||||
|
||||
## 12. Indemnification
|
||||
|
||||
`[LEGAL REVIEW: indemnification scope is a major commercial-risk decision; calibrate with counsel]`
|
||||
|
||||
### 12.1 By you
|
||||
|
||||
You will indemnify, defend, and hold harmless ResolutionFlow from any third-party claim arising from:
|
||||
- Your use of the Services in violation of these Terms or applicable law
|
||||
- Customer Data, including any allegation that Customer Data infringes a third party's rights or was processed without proper legal basis
|
||||
- Your representations regarding Customer Data being inaccurate
|
||||
|
||||
### 12.2 By us
|
||||
|
||||
We will indemnify, defend, and hold you harmless from any third-party claim alleging that the Services as provided by us infringe a valid US patent, copyright, or trademark. Our obligation is conditioned on you promptly notifying us of the claim, giving us sole control of the defense, and reasonably cooperating in the defense.
|
||||
|
||||
If we believe the Services may be subject to such a claim, we may at our option: (a) procure the right for you to continue using them; (b) modify them to be non-infringing; or (c) terminate the affected portion of the Services and refund prepaid fees for the unused period.
|
||||
|
||||
This Section 12.2 is your sole remedy for IP infringement claims.
|
||||
|
||||
## 13. Dispute resolution
|
||||
|
||||
`[LEGAL REVIEW: arbitration vs litigation, class-action waiver, and venue selection are major decisions with significant commercial impact — calibrate with counsel and your insurer]`
|
||||
|
||||
### 13.1 Governing law
|
||||
|
||||
These Terms are governed by the laws of the State of Georgia, United States, without regard to conflict-of-law principles. `[LEGAL REVIEW: Georgia chosen as a reasonable default for a Georgia-based LLC; counsel may prefer Delaware]`
|
||||
|
||||
### 13.2 Venue
|
||||
|
||||
Any dispute arising out of or related to these Terms will be brought exclusively in the state or federal courts located in Cobb County, Georgia, and both parties consent to the personal jurisdiction of those courts. `[LEGAL REVIEW: consider arbitration as an alternative — JAMS or AAA — depending on your insurance and litigation posture]`
|
||||
|
||||
### 13.3 Class action waiver
|
||||
|
||||
To the extent permitted by law, each party waives the right to participate in a class, collective, or representative action.
|
||||
|
||||
### 13.4 Time bar
|
||||
|
||||
Any cause of action arising out of or related to these Terms must be brought within one (1) year after the cause of action accrues, except where prohibited by applicable law.
|
||||
|
||||
## 14. General
|
||||
|
||||
### 14.1 Entire agreement
|
||||
|
||||
These Terms, together with the Privacy Policy, Cookie Policy, Subprocessor List, and DPA, constitute the entire agreement between you and ResolutionFlow regarding the Services.
|
||||
|
||||
### 14.2 Modifications to these Terms
|
||||
|
||||
We may modify these Terms by posting the updated Terms and updating the Effective Date. For material changes adverse to existing customers, we will provide at least **30 days' notice** through the Services or by email. Your continued use of the Services after the new Effective Date constitutes acceptance. If you do not accept material changes, you may terminate your account before they take effect.
|
||||
|
||||
### 14.3 Assignment
|
||||
|
||||
You may not assign these Terms without our prior written consent. We may assign these Terms in connection with a merger, acquisition, or sale of substantially all of our assets. Any unauthorized assignment is void.
|
||||
|
||||
### 14.4 Severability
|
||||
|
||||
If any provision of these Terms is held unenforceable, the remaining provisions will remain in effect.
|
||||
|
||||
### 14.5 No waiver
|
||||
|
||||
Our failure to enforce any provision of these Terms is not a waiver of our right to do so later.
|
||||
|
||||
### 14.6 Force majeure
|
||||
|
||||
Neither party is liable for delays or failures caused by events beyond reasonable control, including natural disasters, war, terrorism, civil unrest, government action, pandemic, or major network or infrastructure outages.
|
||||
|
||||
### 14.7 Notices
|
||||
|
||||
Notices to ResolutionFlow must be sent to support@resolutionflow.com. For service of legal process or any notice requiring a physical mailing address, contact us at support@resolutionflow.com to receive the appropriate address. Notices to you may be sent to the email associated with your account.
|
||||
|
||||
### 14.8 Export control
|
||||
|
||||
You will not use or export the Services in violation of US export control laws.
|
||||
|
||||
### 14.9 Headings
|
||||
|
||||
Section headings are for convenience only and do not affect interpretation.
|
||||
|
||||
## 15. Contact
|
||||
|
||||
Questions about these Terms? Contact us at **support@resolutionflow.com**.
|
||||
Reference in New Issue
Block a user