Privacy Policy

Effective date: June 1, 2025

This Privacy Policy describes how BPMN Server ("we", "us", or "our") collects, uses, and protects information when you use our workflow automation service at bpmn.omniworkflow.com.

1. Information We Collect

1a. Information you provide directly

Username and email address when you register
Password (stored as a one-way bcrypt hash — we never store your plain-text password)
Profile information you choose to add (display name, picture)

1b. Information from Google Sign-In

If you choose to sign in with Google, we receive from Google only:

Your Google account ID (used to link your account)
Your email address
Your display name and profile picture

We do not request access to your Gmail, Google Drive, Google Calendar, or any other Google service. We request only the profile and email scopes.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy , including the Limited Use requirements.

1c. Usage data

Workflow instances you create and the data submitted in workflow forms
Execution logs generated while running workflows
Session data stored server-side (expires on logout)

2. How We Use Your Information

To authenticate you and maintain your session
To run and persist the workflow instances you create
To send password-reset and email-verification messages when requested
To display your name and picture in the application interface

We do not sell, rent, or share your personal information with third parties for marketing purposes.

3. Data Storage and Security

All data is stored in a MongoDB database
Passwords are hashed with bcrypt before storage
Sessions are stored server-side, identified by a secure HTTP-only cookie
We apply industry-standard measures to protect data in transit and at rest

4. Data Retention

We retain your account and workflow data for as long as your account is active. You may delete your account at any time from the Account settings page, which permanently removes your personal data and workflow history.

5. Your Rights

Depending on your location you may have the right to:

Access the personal data we hold about you
Correct inaccurate data
Request deletion of your data
Object to or restrict certain processing

To exercise any of these rights, contact us at the email below.

6. Cookies

We use a single session cookie to keep you logged in. No third-party tracking or advertising cookies are used.

7. Changes to This Policy

We may update this policy from time to time. The effective date at the top of this page will reflect the most recent revision. Continued use of the service after changes are posted constitutes acceptance of the updated policy.

8. Contact Us

Questions or concerns about this policy? Email us at hanna.ralph@gmail.com.

← Back to home