Data processing agreement

This agreement applies to all personal data that Pipeflow processes on behalf of the customer when the application at app.pipeflow.at is used (Art. 28 GDPR).

1. Parties

The controller is the customer who has registered in the Pipeflow application. The processors are Paul Hölzl and Ben Braunsperger (Pipeline AI Solutions, a civil-law partnership under Austrian law); addresses: see legal notice.

2. Subject matter, duration, nature and purpose

The subject matter is the operation of the Pipeflow application: Pipeflow reads the customer’s website, creates posts with text and images for Instagram and LinkedIn, plans them and publishes them after approval. The agreement applies as long as the customer uses the application and ends when use ends.

3. Types of data and data subjects

Types of data: content of the customer’s website (texts, images), information about the business, generated posts and images, approval status, statistics on published posts, access tokens of connected accounts, sign-in details (such as name and email address). Data subjects: the customer and their contact persons as well as persons appearing in the customer’s content or images (such as employees and customers).

4. Obligations of the processor

We process the data only on the customer’s documented instructions. The customer’s use of the application, input and approvals count as instructions. Persons with access are bound to confidentiality. We support the customer in answering data subject requests and in complying with their obligations under Art. 32 to 36 GDPR. We notify the customer without undue delay of a personal data breach.

5. Technical and organisational measures

We protect the data with appropriate technical and organisational measures. We have no access to passwords for Instagram or LinkedIn; accounts are connected through the official authorisation dialogs. The website is only reachable via https. [TODO: add measures of the application, for example encryption of tokens, database location, access control, backups]

6. Sub-processors

The customer consents to the use of the following sub-processors where required for the respective function: Railway (hosting), Anthropic, Google and DeepSeek (AI models), an intermediary service for AI interfaces, fal.ai (image creation). Details on seat and legal basis can be found in the privacy policy, section 10. [TODO: add further services of the application, for example database and sign-in] We inform the customer of changes in advance; they may object to the change or end use.

7. Deletion

After use ends, we automatically delete the customer’s data after 30 days. On the customer’s request we delete it earlier. Statutory retention obligations remain unaffected. [TODO: verify automatic deletion in the application or implement]

8. Evidence and audits

On request we provide the customer with the information needed to demonstrate compliance with this agreement. We allow audits by arrangement.

9. Acceptance and applicable law

The customer accepts this agreement when registering in the application. Austrian law applies.

Last updated: 24 October 2026