Legal
Sub-processors
Last updated 7 September 2026
reflex, operated by Company Flow Pte. Ltd. (UEN 202442050M), trading as workFlowers, uses a small number of third-party services to deliver the product. Each one processes data only on our instructions and under a data-processing agreement.
In use today
| Service | Purpose | Data | Location |
|---|---|---|---|
| Notion | The workspace your flows read from and write to | Pages, databases and properties your flows touch | United States |
| Lovable | Application platform, and the connector gateway that holds your Notion authorisation and brokers our calls to Notion | Notion OAuth grant, request data in transit | United States |
| Supabase | Database, authentication and background job storage | Account details, flow definitions, run records, encrypted connection keys | Singapore (primary region) |
| Cloudflare | Hosting, content delivery and server-side execution | Request data in transit, IP addresses | Global edge network |
| Optional sign-in | Name, email address, account identifier | United States |
Planned, not yet in use
These are listed so you can plan ahead. They process nothing today, and we will confirm by email before any of them starts to.
| Service | Purpose | Data | Location |
|---|---|---|---|
| Resend | Transactional and alert email | Email address, message content | United States |
| Stripe | Subscription billing | Billing contact and payment details (handled by Stripe; we never see card numbers) | United States |
Changes to this list
If we add or replace a sub-processor we will update this page and email account holders at least 30 days before the change takes effect, so you have time to object.
Questions
For a data-processing agreement or details of a specific transfer, email dennis@work.flowers. See also our privacy policy, terms of service and security pages.