FluidGrids — Privacy Policy

Document ID: FG-LEGAL-PUB-001 Version: 1.0 Effective date: 8 July 2026 Last updated: 2026-07-08 Publisher: Algoshred Technologies Private Limited (Burdenoff Group) Canonical location: https://fluidgrids.com/legal/privacy Status: Approved — India jurisdiction, 2026-08-01.

---

Summary (plain English)

• Who we are. FluidGrids is operated by Algoshred Technologies Private Limited, a company incorporated in India and part of the Burdenoff Group.
• Where it lives. All Customer Data is stored in India by default (Microsoft Azure Central India as the primary backend platform). Some operational metadata transits Cloudflare's edge.
• What we collect. Account and profile data, what you do in the product, machine / connection data, billing data, support correspondence, workflow definitions, run inputs/outputs, logs, connection credentials, and anything you choose to put into your workspace.
• Why we use it. To run the Service, keep it secure, bill you, support you, comply with law, and improve the product. We do not sell your personal data. We do not train AI models on your data, prompts or completions.
• Credentials. Connection secrets are encrypted at rest with AES-256-GCM and unwrapped only in memory when a node executes.
• Subprocessors. Listed in DPA Annex 3 and at https://burdenoff.com/contracts/subprocessors. They include Azure, Cloudflare, Razorpay, Stripe (via our US entity), and the AI providers you choose under "Bring Your Own Key" or platform-provided keys.
• Your rights. Under India's DPDP Act, GDPR, UK GDPR and (where applicable) US state privacy laws you can access, correct, erase, port, restrict or object to processing. Contact [email protected].
• AI features. AI prompts go to the provider you configure. You may use your own API key where supported.
• Age. FluidGrids is intended for users aged 13 and over.
• Grievance Officer (DPDP Act §8(10)). Vignesh T.V., Founder, CEO & CTO, Algoshred Technologies Private Limited — [email protected].

---

1. Who we are and how to reach us

FluidGrids (the "Service") is operated by:

Algoshred Technologies Private Limited ("Algoshred", "we", "us", "our") A company incorporated under the Companies Act, 2013 CIN: U72900TN2022PTC156974 GSTIN: 33AAXCA9689B1Z3 Registered office: "VISWAM", Plot No. 43, Veeramani Nagar, 2nd Cross Street, Nanmangalam, Chennai – 600117, Tamil Nadu, India.

Algoshred is part of the Burdenoff Group. International payment processing is handled by Algoshred Technologies Corp (Delaware, USA; EIN 35-2845680), with a virtual PO at 8 The Green, Ste A, Dover, DE 19901, USA.

Contacts

Topic	Email
Privacy / data subject requests	[email protected]
Grievance Officer (DPDP Act)	[email protected]
Security & responsible disclosure	[email protected]
Support	[email protected]
General	[email protected]

---

2. Scope of this Policy

This Policy applies to:

• the FluidGrids website at fluidgrids.com (marketing pages, pricing, public docs);
• the FluidGrids product, including the web app at app.fluidgrids.com and the embeddable SDK where it communicates with our Service;
• sales, support, billing and other business interactions with Algoshred about FluidGrids.

It does not cover third-party services you integrate (e.g., Slack, Stripe, GitHub, OpenAI, Anthropic). Those have their own privacy notices. For AI providers, you are their contractual counterparty when you use your own key.

---

3. Our role: controller vs. processor

3.1 Algoshred as controller / data fiduciary. For data we collect to run our business — your account, billing, support, security, website analytics, marketing — we are the controller under GDPR / UK GDPR and the Data Fiduciary under India's DPDP Act, 2023.

3.2 Algoshred as processor / data processor. For data you and your team put into FluidGrids (workflows, runs, logs, connections, templates), your workspace owner is the controller / Data Fiduciary and Algoshred is the processor on their documented instructions under our Data Processing Addendum (DPA) (https://burdenoff.com/contracts/fluidgrids/FG-LEGAL-003).

---

4. Personal data we collect

4.1 Information you give us

Category	Examples
Identity & contact	Name, work email, username, profile photo, phone (optional)
Account & authentication	Password hash, SSO subject ID, MFA factors, recovery codes
Workspace & role	Workspace memberships, RBAC roles, team membership, ownership
Billing	Billing contact, billing address, GSTIN / PAN, VAT / tax IDs, tokenised payment-method identifier
Communications	Support tickets, chat transcripts, call notes, survey responses
Workspace content	Workflow definitions, run inputs/outputs, per-node logs, templates, connection settings
Credentials	OAuth tokens, API keys, webhook secrets — always encrypted at rest
AI prompts and outputs	Prompts you send, context you attach, AI responses, session metadata

4.2 Information we collect automatically

Category	Examples
Device & connection	IP address, user agent, OS, browser, language, time zone, city-level geolocation derived from IP
Usage / product analytics	Pages and features used, workflow saves, run counts, feature-flag exposures
Telemetry & diagnostics	Error stack traces, performance metrics, request IDs, audit-log entries
Cookies & similar	See our Cookie Policy at https://fluidgrids.com/legal/cookies

4.3 Information from third parties

• SSO / identity providers (Google, Microsoft, GitHub, your enterprise OIDC IdP): the claims you authorise.
• Payment processors (Stripe, Razorpay): payment-status events and tokenised card metadata.
• Integration providers (Slack, GitHub, Stripe, etc.): data you authorise workflows to access, processed solely on your instructions.

---

5. How we use personal data

We use personal data only where we have a lawful basis:

Purpose	Lawful basis	Examples
Provide the Service	Contract	Running workflows, storing definitions, serving the builder
Security & fraud prevention	Legitimate interest / legal obligation	Authentication, audit logs, abuse detection
Billing	Contract	Invoicing, payment processing, tax compliance
Support	Contract	Responding to tickets, debugging
Product improvement	Legitimate interest	Aggregate analytics, error tracking
Legal compliance	Legal obligation	Responding to lawful requests
Marketing (with consent)	Consent	Newsletters, product updates

---

6. Credentials and workflow execution data

Connection credentials and secrets are encrypted at rest with AES-256-GCM using keys managed in Azure Key Vault. They are decrypted only in memory inside the worker runtime at the moment a node executes. Plaintext credentials are not exposed in the canvas and are not accessible to Algoshred personnel through ordinary operations.

Run inputs, outputs, and logs are retained according to your plan's execution history setting. You can delete individual runs or entire workflows; deletion removes data from active query surfaces within 24 hours and from backups within 90 days.

---

7. AI features

FluidGrids offers AI-assisted workflow generation and AI agent nodes. When you use these features:

• The prompt and any context you attach are sent to the AI provider configured for your workspace (e.g., OpenAI, Anthropic).
• If you provide your own API key, you are the provider's contractual counterparty.
• We do not use your prompts, completions, or workflow content to train or fine-tune any AI model.
• You can disable AI features at the workspace level where the plan allows.

---

8. Subprocessors

We use subprocessors to host, secure, and support the Service. The current list includes:

• Microsoft Azure — compute, database, cache, key vault
• Cloudflare — DNS, CDN, WAF, Zero Trust
• Amazon Web Services — object storage, static site hosting
• Razorpay — Indian payment processing
• Stripe — international payment processing (via Algoshred Technologies Corp)
• SendGrid / Amazon SES — transactional email
• Rybbit — self-hosted product and website analytics
• OpenAI / Anthropic — AI inference (only when you use AI features)

The full subprocessor list is at https://burdenoff.com/contracts/subprocessors.

---

9. International transfers

Customer Data is stored in India by default. Some operational metadata and backup copies may be processed in other jurisdictions where our subprocessors operate. Transfers are protected by intra-group agreements and, where required, Standard Contractual Clauses or adequacy decisions.

---

10. Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data (subject to lawful retention needs).
• Port your data to another service.
• Restrict or object to certain processing.
• Withdraw consent where processing is based on consent.

To exercise these rights, email [email protected]. Workspace members should first contact their workspace owner for workspace-content requests.

---

11. Retention

Data category	Retention
Account data	Until account deletion + 90 days (or longer if required by law)
Workspace content	Until you delete it + 90 days backup cycle
Billing records	7 years (tax and legal compliance)
Audit logs	Per plan retention (7 days to custom)
Execution history	Per plan retention (30 days to custom)
Analytics	13 months (aggregate)

---

12. Security

We implement technical and organisational measures appropriate to the risk, including encryption in transit (TLS 1.2+), encryption at rest, access controls, audit logging, and regular security reviews. Our Security Exhibit describes these measures in detail.

---

13. Children's privacy

FluidGrids is not directed at children under 13. If we learn that we have collected personal data from a child under 13 without verified parental consent, we will delete it.

---

14. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or in-product notice at least 30 days in advance. The current version is always at https://fluidgrids.com/legal/privacy.

---

15. Contact

For privacy questions or data-subject requests, contact [email protected].

---

Document ID: FG-LEGAL-PUB-001 Owner: Privacy Office / Algoshred Review cycle: every 12 months, on material change, or when adding a new subprocessor or AI provider.