This privacy policy explains how Getss LLC ("we", "us") handles personal information in connection with Easyflow, our website at https://easy.wf, and the emails and public pages that are part of the service. It is effective as of 2026-10-11.
Who we are and the role we play
Getss LLC provides Easyflow, a service that businesses use to run approvals and internal processes. We handle personal information in two different roles, and the difference matters.
| Information | Our role | Who decides how it is used |
|---|---|---|
| Account, billing, website and newsletter data | Controller (a "business" under California law) | We do, as described in this policy |
| Customer content: everything a customer's workspace holds | Processor (a "service provider" under California law) | The customer that owns the workspace |
Customer content includes processes, form values, files, comments, generated documents, lists and schedules, as well as the information that people outside the customer's company submit through it. We process customer content only on the customer's behalf and under its instructions, as set out in our Data Processing Addendum. The customer decides what it collects and why, and is responsible for its own privacy notices.
If you submitted information to an organization that uses Easyflow, for example through one of its request forms, please contact that organization first. We will help it answer your request.
Information we collect
Account information
When someone creates a workspace, we collect their name, work email, password, company name, language and timezone. Passwords are hashed with bcrypt and are never stored in plain text.
Members are invited by email. The person sending the invitation enters only the email address; the invited person sets their own name and password through a one-time link. Nobody can set another person's password.
We also keep the preferences you choose in the app, such as your language and whether you receive notification emails and the daily digest.
Billing information
When a workspace subscribes, we collect the billing contact and the details needed to invoice and collect payment.
Customer content
Workspaces store their own content: processes, form values, uploaded files, comments, generated documents, lists and schedules. This content may include personal information about the customer's employees, clients, vendors or other people, depending on how the customer uses Easyflow.
People outside the customer's company
Customers can involve people who do not have an account:
- Public request forms: a person submits their name, email address and answers to the form.
- Guest steps: a person receives an email link and fills in a single step of a process.
- Tracking pages: a person who submitted a request can follow its progress on a tracking page and receives email updates about it.
This information is customer content. We process it for the customer that published the form or sent the request.
Signatures, photos and location
- Signatures: when someone signs a form, we store the typed name, the acceptance of the text being signed, the time, the user and email address, and a salted hash of the IP address. We do not store the IP address itself.
- Photos: photo fields can stamp the date and time on the image. When a process requires it, they also stamp the device's GPS location. Location is only read with the permission you grant in your browser.
Activity records and technical information
- Audit log: every change in a workspace is recorded with who made it, what changed and when.
- Request timeline: each request keeps a timeline of its steps, field changes and comments.
- Rate limiting: public pages are rate limited, which counts requests per IP address over a short window.
- Like most online services, the infrastructure that runs Easyflow may record standard technical information about requests, such as timestamps and errors, to keep the service running and secure.
Emails
We send transactional emails (assignments, approvals, reminders and a daily digest), onboarding emails to the workspace owner during the trial, and, only if you subscribe, our blog newsletter. Newsletter subscriptions use double opt-in: we keep your email address and send the newsletter only after you confirm.
Website analytics and sign-up attribution
On the public pages of our website we use GeraFlow, an analytics tool, to see how many people visit, which pages they read and which links and buttons they click. It sets a first-party cookie, gf_v, that holds a random visitor id for up to one year, so a returning visitor is counted once. It is not loaded inside the Easyflow app or on pages opened from private links, such as approval, password reset, guest step or shared document links.
When someone arrives at our website, the campaign parameters in the link (UTM parameters), the referring site and the first page they landed on are kept in their browser's local storage. If that person then signs up, this information is stored with the new workspace so we can tell which channels bring customers.
When someone arrives by clicking one of our ads on Google or Microsoft Bing, the ad platform adds a click identifier to the link (gclid or msclkid). We keep it in the browser's local storage for up to 90 days, and if that person signs up, we store it with the new workspace. We then report back to that ad platform, using only that identifier, when the click led to a sign-up, to the workspace's first request or to a subscription, with the time and, for a subscription, the plan's yearly value. We do not send names, email addresses or workspace content. This tells us which ads bring customers. We do not load advertising tags or cookies on our website.
Browser storage
The Easyflow app uses your browser's local storage for your login token, the workspace you are working in, your theme, your language and the sign-up attribution and ad click identifiers described above. Apart from the analytics cookie described above, we do not use cookies, and we never use advertising or cross-site tracking cookies.
How we use information
We use the information we control to:
- Provide the service: create and secure accounts, run processes, deliver notifications and the emails a customer configures, and generate documents.
- Keep it secure: authenticate users, enforce permissions, rate limit public pages, keep audit records and prevent abuse.
- Communicate: answer support requests, send onboarding emails during the trial, and tell you about changes to the service, our terms or this policy.
- Bill: invoice subscriptions and keep the records accounting requires.
- Improve: understand, in aggregate, which pages and channels bring people to Easyflow.
- Comply with the law: meet legal obligations and respond to lawful requests.
We use customer content only to provide the service to the customer, as described in the Data Processing Addendum. We do not sell personal information, and we do not use customer content for advertising.
AI features
Easyflow includes an optional AI assistant. When a manager asks it to draft or edit a process or a document layout, the current process draft and the messages in that conversation are sent to OpenAI's API to generate the answer. OpenAI acts as our subprocessor for this feature.
The assistant is used only when someone asks it something. The conversation is saved with the process so the other people who manage that process can see it. Avoid typing personal information into requests to the assistant, and review the changes it makes to your processes.
How we share information
Subprocessors. We use the following service providers to operate Easyflow. They process personal information only to provide their services to us.
| Subprocessor | Purpose | Location |
|---|---|---|
| Oracle Cloud Infrastructure | Application and database hosting | United States |
| DigitalOcean (Spaces) | File storage | United States |
| Resend | Email delivery | United States |
| OpenAI | AI assistant, only when a manager uses it | United States |
Inside a workspace. Members see workspace content according to the permissions the customer sets. People outside the company see only what the customer shares with them, such as their tracking page and the comments and documents marked as shared.
Ad platforms. When a workspace was created after a click on one of our ads, we report the sign-up, the first request and the subscription to Google or Microsoft, as described in "Website analytics and sign-up attribution". The report carries only the ad platform's own click identifier, the event, its time and, for a subscription, the plan's value.
Destinations the customer chooses. Customers can configure event emails and webhooks that send process data to addresses and systems of their choice. We send that data on the customer's instruction.
Document verification. Generated PDFs carry a verification code. Anyone who has the code can check the document at /verify, which shows only its title, issuer, date and fingerprint.
Legal requests. We may disclose information when we believe in good faith that the law requires it, for example in response to a valid subpoena or court order. Where the request concerns customer content, we will ask the requester to go to the customer, and we will notify the customer unless the law prohibits it.
Business transfers. If we are involved in a merger, acquisition or sale of assets, information may be transferred as part of that transaction, subject to this policy.
With consent. We may share information for other purposes when you ask us to or agree to it.
How long we keep information
- Account information is kept while your account is active, and afterward only as long as needed for the purposes in this policy or as the law requires.
- Customer content is kept until the customer deletes it or closes the workspace. Deleting something in the app removes it from the workspace: it is flagged as deleted, not immediately erased. When a customer asks us to close its workspace, its content is deleted within 30 days, except where the law requires us to keep it.
- Audit records and request timelines are part of the workspace and follow its retention.
- Billing records are kept as long as tax and accounting laws require.
- Newsletter: we stop sending as soon as you unsubscribe.
Your rights and choices
- Access and correction: you can update your name, language and preferences in the app, or write to privacy@easy.wf.
- Deletion: you can ask us to delete your account information. For customer content, the customer that owns the workspace decides; we will pass your request to it and help it respond.
- Notification emails: you can turn off notification emails and the daily digest in your preferences. Messages you need to use the service, such as invitations, may still be sent.
- Onboarding emails: if you prefer not to receive them during your trial, write to hi@easy.wf.
- Newsletter: every newsletter email has a one-click unsubscribe link.
- Location: you can deny or revoke location access in your browser settings. If a process requires location for a photo, you may not be able to complete that field without it.
California residents. Where the California Consumer Privacy Act, as amended by the CPRA, applies, California residents have the right to know what personal information we collect and how we use it, to request deletion and correction, to opt out of the sale or sharing of personal information, and to not be discriminated against for exercising these rights. We do not sell personal information or share it for cross-context behavioral advertising. To make a request, write to privacy@easy.wf. We will verify your request before acting on it, and you may use an authorized agent.
Residents of other US states may have similar rights under their state laws. Write to privacy@easy.wf and we will respond as those laws require.
Security
We protect information with measures such as HTTPS for all traffic, workspace isolation enforced in the data layer, server-side permission checks and a tamper-evident history of every request. No system is perfectly secure, and we cannot guarantee absolute security. Our security overview describes these measures in more detail.
Where information is processed
We and our subprocessors store and process information in the United States. If you use Easyflow from another country, your information is transferred to the United States and protected as described in this policy.
Children
Easyflow is a tool for business use and is not intended for children. We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, write to privacy@easy.wf and we will delete it.
Changes to this policy
We may update this policy as the service changes. We will post the new version on this page with a new effective date and, for material changes, notify workspace owners by email before the changes take effect.
Contact
- Company: Getss LLC
- Privacy questions: privacy@easy.wf
- General questions: hi@easy.wf