Data Processing Terms
These terms describe how Phloem processes workspace content on your instructions, and the safeguards applied to it.
1. Roles
For workspace content you upload or generate, you are the controller and [RIGHTS HOLDER — TO BE CONFIRMED], Zürich, Switzerland acts as processor, processing on your documented instructions given through the Service.
For account administration, billing, security and service improvement, we act as controller of the limited data required for those purposes.
2. Subject matter and duration
Subject matter: provision of B2B customer discovery, research, qualification and outreach preparation.
Duration: for as long as your workspace is active, plus the retention periods described in the Privacy Policy.
Categories of data subject: your workspace members and the business professionals you research.
Categories of data: business contact and role information, company information, communication drafts and engagement events.
3. Processing instructions
We process workspace content only to deliver the Service, to keep it secure, and where required by law.
We do not sell workspace content, and we do not use it to train foundation models.
4. Sub-processors
We use infrastructure, database, payment and AI model providers as sub-processors, each bound by confidentiality and security obligations.
A current list of sub-processor categories is available on request through the privacy centre. We give notice of material changes to the categories we use.
5. Security measures
Access is scoped per workspace and role, connections are encrypted in transit, privileged actions are logged, and secrets are held in managed secret storage.
Personnel access to customer data is limited to what is needed to operate and support the Service.
6. Assistance and data subject requests
We assist you in responding to access, correction, deletion, objection and suppression requests. Requests can be submitted through the privacy centre.
If we receive a request directly from a data subject relating to your workspace, we route it to you rather than answering on your behalf, unless the law requires otherwise.
7. Return and deletion
You can export workspace data while the workspace is active. On termination, workspace content is deleted or anonymised after the retention window described in the Privacy Policy, except where retention is legally required.
Legal, privacy and security contact runs through the Phloem support form and privacy centre — we do not publish individual inboxes.