Customer privacy policy

01Scope

This policy applies to personal data that Shapes handles while delivering services to clients: designing, building, testing, and supporting workflows, AI agents, assistants, integrations, and reports. Examples include customer records in a CRM, invoices processed by a workflow, or documents indexed for an assistant.

It forms part of our agreement with each client. Where a client has signed a data processing agreement with us, that agreement takes precedence over this policy.

02Our role

For personal data in client projects, the client decides why and how it is processed and is the controller. Shapes acts as a processor (a “service provider” under US state privacy laws). We:

• process client personal data only on the client's documented instructions, as set out in the proposal, statement of work, or data processing agreement;
• never use it for our own purposes, to train AI models, or for marketing;
• never sell or share it for advertising;
• tell the client if we believe an instruction breaks data protection law.

Contact details of the people we work with at client businesses are handled under our Privacy policy, where Shapes is the controller.

03Where client data is processed

We build workflows inside systems the client owns: the client's n8n instance (on n8n Cloud or self-hosted in the client's cloud account) and the client's existing business applications. Personal data normally stays in those systems and is not copied to Shapes' own systems.

For development and testing we use the minimum data needed, and prefer anonymised or sample data where it gives a reliable result. Real data is used in testing only when the client agrees.

04Use of AI models

Many workflows use AI models from third-party providers. When they do:

• the provider, model, and purpose are agreed with the client before use;
• we use business or API offerings whose terms state that customer inputs and outputs are not used to train their models by default, and confirm those terms for each provider;
• only the data a step needs is sent to the model, and personal data can be redacted or masked first where agreed;
• special category data is never sent to an AI model without the client's explicit written agreement;
• AI outputs that affect people are designed with human review where the impact warrants it.

05Sub-processors

Depending on the project, personal data may be processed by these categories of provider:

• AI model providers selected for the project, such as OpenAI, Anthropic, or Google;
• the automation platform, where the client uses n8n Cloud;
• cloud hosting for self-hosted instances, normally in the client's own account;
• communication and collaboration tools we use with the client during delivery.

We confirm the sub-processors for each project in writing, give clients notice of intended changes, and let them object. We choose providers that commit to confidentiality and appropriate security, and pass equivalent data protection obligations on to them.

06Security measures

• Access through accounts the client grants and can revoke, with the least privilege each task needs.
• Multi-factor authentication on the accounts we use, wherever the service supports it.
• Credentials kept in n8n's encrypted credential store or a secrets manager, never in workflow code or documents.
• Encryption in transit for all connections between systems.
• Separate development, testing, and production environments where the project allows.
• Error alerts, execution logs, and audit trails, with retention set to what the client needs.
• Confidentiality obligations for everyone at Shapes who can access client data.

07Personal data breaches

If we become aware of a personal data breach affecting client data, we will notify the client without undue delay, and give the information the client needs to assess the breach and meet its own notification duties. We will take reasonable steps to contain the breach and prevent it happening again.

08Helping clients meet their obligations

We will help clients respond to requests from individuals exercising their rights, carry out data protection impact assessments where a workflow needs one, and keep the records they need. Where a workflow has to support access, correction, or deletion requests, we design that capability in.

09International transfers

Where client personal data is transferred outside the European Economic Area, the United Kingdom, or the client's country, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses. Clients who need data processed in a specific region, for example within the EU, can choose a self-hosted setup and AI providers that offer that region.

10Retention and deletion

Workflows, credentials, and data remain in the client's systems after an engagement ends. At the end of a project, or on request, we delete or return any client personal data held in our own systems, unless the law requires us to keep it, and remove our access to client systems when asked.

11Data processing agreement

We sign a data processing agreement with any client that needs one, covering the terms above in contract form, including Standard Contractual Clauses where relevant. Ask for it during your proposal or at any time through our contact page.