Skip to content
MoveWorkflows

Privacy Policy

As of 2026-10-21.

1. Controller

Nursultan Imanov, Drorygasse 4a/70, 1030 Wien, Austria
E-mail: workspacetoolkit@gmail.com

We have not appointed a data protection officer, as we are not required to.

2. The short version

3. Processing in your browser (no transfer to us)

When you load an export, your browser reads and converts it locally. To keep it available across pages and after the redirect to the payment page, the export is stored in your browser's IndexedDB (database "moveworkflows") until you click "Load another export" or clear the site data. We have no access to it.

Your browser also stores, in local storage: your cookie choice (mw-consent), the download key after payment (mw-tokens, valid 60 days), which workflows you selected and which free workflow you took. These entries are strictly necessary to provide the service you request (§ 165 Abs. 3 TKG 2021) and never leave your device except as described in section 5.

4. Visiting the website

a) Hosting and server logs. The website runs on Google Cloud (Firebase App Hosting, Cloud Run, Firestore) of Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, region the EU (europe-west4, Netherlands; database europe-west1, Belgium). When you open a page, the server processes your IP address, the requested URL, time, browser type (user agent) and referrer to deliver the page and protect the service against abuse. Request logs are kept by Google Cloud Logging for 30 days. Technical error reports (Google Cloud Error Reporting) contain no export content. For rate limiting, IP addresses are held only in server memory for at most one day. Legal basis: Art. 6 (1) (f) GDPR (secure and stable operation). Google acts as our processor (Art. 28 GDPR).

b) Our own event log. To see where visitors drop off, we record events such as "page viewed", "export loaded", "report shown" (with counts of green, yellow and red workflows), "free workflow downloaded", "checkout started", "paid" and "downloaded". Each event contains the event name, time, page path, counts, a random visitor ID and, with the first event of a visit, the referring page, campaign parameters (utm_*, ad click IDs such as gclid) and the browser type. No workflow content and no IP address are stored in this log. Without your consent the visitor ID exists only in the page's memory and is lost on reload; with consent it is kept in local storage (mw-visitor) so that visits can be linked, and the screen width is added. Storage: Google Firestore (processor as above). Retention: 13 months, then automatic deletion. Legal basis: Art. 6 (1) (f) GDPR (improving the service); for the device storage after consent, Art. 6 (1) (a) GDPR and § 165 Abs. 3 TKG 2021.

c) Google Analytics 4 (only with consent). If you click "Accept", we load Google Analytics 4 of Google Ireland Ltd. It sets cookies (_ga, _ga_*) and processes usage data (pages, events such as "begin_checkout" and "purchase", device and approximate location). Google Analytics 4 does not store full IP addresses. We have disabled Google signals and ad personalisation. Data is kept for 14 months. Google may process data in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). Legal basis: your consent, Art. 6 (1) (a) GDPR and § 165 Abs. 3 TKG 2021. You can withdraw consent at any time with "Cookie settings" in the footer; the Analytics cookies are then deleted.

5. Buying the files

a) Checkout. When you click "Pay", our server creates a payment session with Stripe. It passes on: the number of workflows, the price, a fingerprint (SHA-256 hash) of your export and, if available, your random visitor ID. The hash cannot be turned back into your export; it only ties the download to the export you paid for.

b) Payment. Payment is processed through Stripe Managed Payments. The sale is made by a company of the Stripe group acting as reseller and merchant of record, as shown on the checkout page. It and Stripe Payments Europe Ltd. (1 Grand Canal Street Lower, Dublin 2, Ireland) process your payment data, e-mail address, billing address and, for business customers, VAT number as independent controllers under their own privacy policies (stripe.com/privacy), including for tax and fraud prevention. We receive the payment status, amount, country, e-mail address and, if given, company name and VAT number. We never see your card details.

c) Download key. After payment our server issues a signed download key that contains the Stripe session ID, the number of workflows, the export fingerprint and an expiry date (60 days). It is stored in your browser and checked by our server before each download. We keep a short technical record that a payment was processed (60 days) so it is counted only once.

d) Legal basis and retention. Art. 6 (1) (b) GDPR (performing the contract) and Art. 6 (1) (c) GDPR (tax and accounting obligations). Order and payment records are kept for 7 years under Austrian tax law (§ 132 BAO).

6. E-mail

a) Launch notification. While the full export is not on sale yet, you can leave your e-mail address with "Notify me". We use it only to send you one e-mail when the full export launches. It is stored in Google Firestore (processor as in section 4) together with the time of sign-up; it is not written to our event log or server logs, and the event log only records that a sign-up happened. Legal basis: your consent, Art. 6 (1) (a) GDPR. We delete the address after sending the launch e-mail, or earlier if you ask us or withdraw your consent by writing to workspacetoolkit@gmail.com.

b) Writing to us. If you write to us, we process your e-mail address and message to answer you (Art. 6 (1) (b) or (f) GDPR). Our mailbox is hosted by Google (Gmail). We delete correspondence when it is no longer needed, at the latest after 3 years, unless it is part of an order record (section 5 d).

7. Recipients and transfers

Recipients are only the processors and controllers named above (Google, Stripe). Transfers to the USA are based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and, where applicable, standard contractual clauses (Art. 46 (2) (c) GDPR). There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

8. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw consent at any time with effect for the future (Art. 7 (3) GDPR). Write to workspacetoolkit@gmail.com. Because we do not store names with funnel events, please tell us your visitor ID or your Stripe receipt so we can find your data.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). In Austria: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, dsb.gv.at. You can also contact the authority in your EU country of residence.

9. Is providing data required?

You can use the free report and the free workflow without giving us any personal data. For a purchase, Stripe needs your payment details and e-mail address; without them we cannot complete the sale.