Data processing terms

Last updated: 25 October 2026

These terms are the data processing agreement under Article 28 of the GDPR between you, the customer or the organization you act for ("you", the controller where applicable), and Salesflare BV, Delacenseriestraat 14, 2018 Antwerp, Belgium, enterprise number 0564.785.369 ("we", the processor). They are part of the terms of service and apply to the personal data your machine processes for you.

1. Subject matter and duration

We host and run a private server for you that runs OpenClaw and The Machine. These terms apply while we process personal data for you, including the retention periods after the service ends described in section 11.

2. Nature and purpose

Your server reads the sources you connect, organizes what it finds, remembers context, and prepares drafts and actions for you. We host, set up, update, monitor and repair that server, and deliver short-lived access to the accounts you connect. We process personal data only for that purpose.

The Fleet and Friends. If you join a Fleet or connect an accepted friend, we also relay short answers between your server and the servers of the people in your Fleet or your accepted friends. Machines encrypt and sign every message end to end, and the relay accepts nothing else; we retain routing and delivery metadata, public keys and sealed content. Your server builds each answer itself, under the rules you set in your dashboard; we pass it on and delete it once the receiving Machine acknowledges saving it, or after at most 3 days. Answering a teammate is your own decision as controller, and the relaying is processing on your instructions. Your teammate is the controller of what their server does with the answer. If a Fleet pays for your server (a seat), the Fleet owner is the customer for that seat; the relevant person or organization remains the controller of the server's data, and the owner as payer sees only your name, email and server size, never the data. A self-hosted Machine you pair is yours to run: we only relay its questions and answers as described here, including free Friends and Family connections. Shared skills and email task links that you choose to create are also processed on your instructions; task links retain sealed content for at most 30 days, and delivery metadata for at most 90 days. We do not host its local data. These processing terms also apply to that relay for as long as it is in use.

Work Fleet Shared Graph and connectors. On the controller's instructions through Work Fleet membership and confirmed Machine access, the relay also forwards Work contact/organization/project records, client email threads and eligible attachments, encrypted and signed end to end. It is off until a Fleet admin turns it on. Personal accounts and unselected accounts stay excluded. Threads classified as personal, sensitive, automated or internal-only are excluded from automatic sharing, including any indication that they exist. Classification is best effort, not a guarantee: the controller can review and correct it. The controller's explicit sharing choices can override sensitive or automated classifications. Board sharing alone still excludes automated mail. Personal and internal-only conversations stay excluded. Unsharing or removal deletes recipients' copies when they next sync. Each sealed item remains in the relay until every recipient acknowledges it, or at most 30 days. Routing, recipient, timing, size and sequence metadata is not end-to-end encrypted. The receiving Machines keep the shared records; leaving the Fleet or deleting one account does not erase teammates' copies. The relevant organization determines its lawful basis and access, gives required notices and coordinates erasure with recipients. These shares are not governed by the separate Ask me first rules for individual Fleet answers. Shared connector credentials are also relayed end to end to admin-approved Machines; shared Intercom accounts only read. Stopping a share removes app-held copies on recipients' next sync, but provider revocation or token replacement is required to invalidate any separately retained credential. Self-hosted recipients' local stores are not hosted by us.

3. Data and data subjects

Data subjects: you, and the people who appear in the sources you connect, such as your contacts, colleagues, customers and anyone who writes to you.

Categories of data: names, email addresses, phone numbers and other contact details; the contents of emails, calendar events, chats and documents; public company data; and whatever else those sources contain. That may include special categories of data if they appear in your sources. You decide what to connect.

4. Your instructions

We process your data only on your documented instructions. These terms, your settings and what you do in the dashboard are your instructions. If we believe an instruction breaks the law, we tell you. If the law requires us to process data in another way, we tell you first unless the law forbids it.

5. Confidentiality

Everyone at Salesflare who can access your data is bound by confidentiality. Access is limited to the few people who run the service, and used only to fix a problem you report, to keep the service secure, or when the law requires it.

6. Security

We take the technical and organisational measures listed in the annex below. We may improve them over time, but never lower the overall level of protection.

When you request a remote coding-agent handoff, its result is also processed in our EU control plane to return it to your Machine. The result is encrypted at rest, not end-to-end, and is removed on acknowledgment or within seven days. Encrypted control-plane recovery backups expire within 30 days and must not be used to reintroduce deleted or expired records.

7. Subprocessors

You give us general permission to use subprocessors. The current ones are:

  • Hetzner Online GmbH, Gunzenhausen, Germany: hosting of your server, in its data centers in Nuremberg or Falkenstein (Germany) or Helsinki (Finland). The Network standby in Germany also handles routing/membership metadata and end-to-end sealed messages, under the same processing terms and retention periods.
  • Microsoft Ireland Operations Limited, Dublin, Ireland (Microsoft Azure): hosting of our control plane, of your server if it runs on Azure, and of the encrypted backups of every server, in the West Europe region (the Netherlands).
  • Google Cloud EMEA Limited, Dublin, Ireland (Google Cloud): hosting of Salesflare's lead API, which looks up public company data for organization domains and public work profiles for work contacts, in Google Cloud's European regions.
  • Automattic Inc. (Gravatar), US: contact photos by hashed work address, hosted Machines only. It receives a SHA-256 hash of a work contact's address, never the address itself. Its international processing is covered by section 8.
  • komoot GmbH (Photon), Potsdam, Germany: address suggestions for an event's location, from OpenStreetMap data. It receives the text typed in the Calendar's Where field, which may include a private address, plus ordinary connection metadata (the server IP address and app User-Agent), not an account identifier or other calendar or message fields.
  • Twilio Inc. (SendGrid) and Google (our support mailbox provider): delivery and handling of support reports you ask us to investigate, to the extent they contain data processed on your behalf. Their international processing is covered by section 8. Our own account and billing notices are controller processing described in the privacy notice.

We bind each subprocessor to data protection duties that match these terms, and we remain responsible for them.

We tell you by email at least 30 days before adding or replacing a subprocessor. You can object in that time. If we cannot address your objection, you can end your subscription before the change applies and get a refund of any prepaid amount for the time not used.

Your AI model provider and any other service you connect yourself (such as your Google or Microsoft account, your own Telegram bot or your chat tools) are not our subprocessors. You use them under your own agreements.

8. Transfers outside the EU

Your server runs in the EU, and so does our control plane. Hosting remains in the EU. Support that you request may send customer content or diagnostics through Twilio SendGrid and our Google support inbox, including processing outside the EEA. Hosted servers also ask Automattic's Gravatar, in the US, for contact photos by a hashed work address. For that processing we require the applicable provider data-processing agreement and a lawful transfer safeguard, such as the European Commission's standard contractual clauses (with supplementary safeguards where required) or an applicable adequacy decision. We do not rely on a recipient's location alone as a transfer safeguard. Before adding a new support subprocessor, we tell you in advance under section 7 and use a lawful safeguard, such as the European Commission's standard contractual clauses. Data your machine sends to providers you chose, such as your AI provider, falls under your own agreement with them.

9. Helping you

Taking into account what we can reasonably do, we help you:

  • answer requests from data subjects. You can find and delete data yourself, and can export your whole setup from your account page. If a data subject contacts us directly, we pass the request on to you without delay;
  • meet your security duties;
  • carry out data protection impact assessments and consult a supervisory authority, by giving you the information we have about how the service works.

10. Personal data breaches

If we become aware of a personal data breach affecting your data, we tell you without undue delay, and where feasible within 48 hours. We share what we know: what happened, what data and how many people are likely affected, the likely consequences, and what we are doing about it. We update you as we learn more.

11. End of the service

When your subscription ends, we keep your server and its data for 30 days, then delete them, including the Google and Microsoft access stored for it. For an unpaid subscription, the longer retention period in the terms of service, section 4 (Failed payments), applies: up to 6 months after the machine was paused. Before that, you can export your whole setup with "Export everything", or delete everything right away with "Wipe everything now" on your account page. We do not keep copies, unless the law requires us to.

12. Audits

On request, we give you the information you reasonably need to show that these terms are met. If that is not enough, you can audit our compliance, or have an independent auditor bound by confidentiality do it, with at least 30 days' notice, during business hours, at your own cost and at most once a year, unless a breach or a supervisory authority requires otherwise. Audits must protect other customers' data and system security. We first provide available subprocessor reports and compliance evidence and facilitate further information or audit access where necessary to meet Article 28 of the GDPR. Scheduling, frequency, cost and confidentiality arrangements must not prevent a lawful audit, urgent verification or a supervisory authority's powers.

13. Liability

Liability under these terms follows the limits in the terms of service, as far as the GDPR allows. Each party remains responsible towards data subjects and authorities as the GDPR provides.

14. Order of precedence

If these terms conflict with the terms of service, these terms prevail for anything about processing personal data. Belgian law applies, and the courts set out in the terms of service decide disputes.

Annex: technical and organisational measures

Isolation

  • Each customer gets a separate server. It is not shared with other customers.
  • A server cannot reach other customers' servers or other private addresses in our network.

Network

  • Each server has a firewall that lets in only our control plane, both at the hosting provider and on the server itself.
  • The dashboard on your server is reachable only through our control plane, after you sign in.
  • All connections are encrypted with TLS. Between our control plane and your server, TLS uses certificates from our own certificate authority.

Access

  • Signing in needs your Google or Microsoft account and a second factor (an authenticator app or a one-time recovery code). Five wrong codes lock the second factor for 15 minutes.
  • Session tokens and recovery codes are stored only as hashes.
  • Administrative access to servers uses SSH keys, and only from our control plane.

Secrets and encryption

  • Google and Microsoft OAuth grants and refresh tokens, and second-factor secrets, are sealed with AES-256-GCM before they are stored.
  • What your messages say (subjects, bodies, attachment names and other message text, from every source, and the cards and drafts made from them) is encrypted in your server's database, with a key kept only on your server. Our support tools read states, errors and settings without that key. Administrative access to your server could still reach it; we use that access only as described in these terms.
  • Your Machine holds your connected accounts' refresh tokens encrypted with its own message key, after a temporary encrypted handoff through our control plane. It uses them through our broker to obtain short-lived access tokens. The broker does not retain those refresh requests. Older connections may retain an encrypted refresh token on our control plane until that move completes.
  • Disks are encrypted at rest on both providers. On Azure, the platform encrypts them. On Hetzner, your home folder, app data, browser profiles, exports and swap are on an encrypted disk (LUKS2, AES-XTS) whose key is kept only on our control plane and handed to your server over its authenticated connection when it starts. Wiping your server destroys that key, which makes the data on it unreadable, snapshots included. The server's system logs stay outside the encrypted disk and are deleted with the server.
  • Nightly backups are encrypted on your server before they leave it (restic, AES-256), with a key kept only on our control plane, and stored in Microsoft Azure in the Netherlands. Your server can add backups but cannot delete or change them. We keep 7 daily, 4 weekly and 3 monthly backups and delete them with your server, without a soft-deleted copy.

Operations

  • We keep The Machine and OpenClaw on your server up to date.
  • We monitor each server's health and restart it automatically when it gets stuck.
  • Sign-ins and changes to machines are logged.

Data minimization and deletion

  • Enrichment lookups send only organization domains and, for work contacts, a full name with their company domain; never email addresses, personal mail domains or message contents. Answers about people are not stored by us; they stay on your server.
  • Photos: when a work contact has no photo from the lookup, your server asks Gravatar (Automattic, US) for one using a SHA-256 hash of their work address. Gravatar never receives the address itself, but can match the hash to an address it already knows.
  • You can delete everything yourself at any time, and export your whole setup at any time. Data is deleted after the retention period in section 11.