WorkFlura Privacy Policy

Scultura Technologies Private Limited · Last updated 12 October 2026

Scultura Technologies Private Limited (“Scultura”, “we”, “us”) publishes this Privacy Policy for the WorkFlura workflow-approval application (“WorkFlura” or the “Service”) and for the website sculturats.com. It explains what information we handle, why, where it is kept, and the choices available to you. WorkFlura is built for organizations that use Google Workspace; most of the data the Service processes is your organization’s own business data, and it stays in your organization’s own Google Cloud project.

If your organization subscribes to WorkFlura, your organization is the controller of the data processed through the Service and Scultura acts on its instructions. Questions about how your organization uses WorkFlura should go to your organization’s WorkFlura System Administrator.

1. The short version

Your data stays with you. All workflow content — users, org units, roles, workflow definitions, form submissions, approvals, attachments and reports — lives in a Firebase / Google Cloud project that your organization creates and owns. Scultura does not hold a copy.
We keep only what we need to run the Service: a registry of subscribing organizations, license and billing status, session records, configuration, anonymous error signals and aggregate usage counts.
We do not sell data, show advertising, or use tracking analytics in the Service or on our website.
Google data is used only to make WorkFlura work, in line with the Google API Services User Data Policy, including its Limited Use requirements.
Google user data is shared only with the providers that host the Service (Google Cloud) and your own organization — see section 6 — and is protected by the mechanisms in section 9.

2. How WorkFlura is built (why this matters for privacy)

WorkFlura has two parts:

Your organization’s data plane — a Firebase project (Cloud Firestore, Cloud Storage and Firebase Authentication) created and owned by your organization during onboarding. WorkFlura reads and writes here using a service account that your organization creates in that project and whose key it provides to WorkFlura. Every workflow record lives here.
Scultura’s control plane — a Google Cloud project operated by Scultura in the asia-south1 (Mumbai) region. It holds the tenant registry, licensing and billing status, platform configuration, session records, error signals that contain no personal data, and lean adoption metrics.

The service-account key your organization provides is encrypted at rest in the control plane, decrypted only in memory when a request needs it, and never written to logs. Your organization can revoke it at any time from its own Google Cloud console, which immediately ends WorkFlura’s access.

3. Information we collect

3.1 Account and identity information

When you sign in with Google we receive your name, email address and profile picture from your Google Account. Your email address is used to resolve which organization you belong to, to identify you within workflows (Submitter, Approver, Manager) and to display your name and avatar in the interface. Your organization’s System Administrator may also load user names, email addresses and manager relationships from your organization’s Google Workspace directory into your organization’s data plane.

3.2 Workflow content

Form submissions, attachments, approval decisions, comments, SLA timings, policy values and workflow designs are created by your organization’s users and stored only in your organization’s data plane. Scultura personnel cannot read this content unless your System Administrator grants time-limited support access (see section 8).

Access by your organization’s administrators. Because this data is stored in a Google Cloud project your organization owns, people your organization grants access to that project — in the Google Cloud or Firebase console, outside WorkFlura — can read all data in it, including requests and approvals, independently of the roles WorkFlura assigns. Form responses also remain inside the Google Form, visible to its editors and to managers of the WorkFlura Forms shared drive, until WorkFlura’s Forms Controller script — deployed in your Google Workspace during setup and run on WorkFlura’s standard schedule — removes them shortly after each response has been processed. Who holds project and shared-drive permissions is decided and controlled entirely by your organization. If you use WorkFlura through your employer and have questions about how it handles your information, please ask your employer’s WorkFlura System Administrator.

3.3 Google Workspace data accessed through Google APIs

See section 4 for the full description of the Google user data WorkFlura accesses and how each permission is used.

3.4 Information held in Scultura’s control plane

Organization registry: organization name, primary domain, administrator email addresses, the Google Cloud project identifier your organization created for WorkFlura, and configuration settings (time zone, date format, currency, Google Chat app identifier, Shared Drive identifier, Pub/Sub topic name).
License and Billing: subscription tier, seat counts, license status and expiry, Paddle customer and subscription identifiers, and billing history (dates, tier, amounts). Card details are never seen or stored by Scultura — see section 6.
Sessions: a record of each sign-in (user email, organization, time, authority level) used to authorize requests to the Service.
Error signals: error codes, timestamps and organization identifiers, with no personal data or workflow content. Detailed error records stay in your organization’s data plane.
Adoption metrics: aggregate counts (for example number of active users, workflows and submissions) mirrored no more than once every 24 hours, with weekly snapshots retained for up to four years for platform health reporting.
Audit log: changes to platform configuration and license overrides made by Scultura staff.

3.5 Support correspondence

If you contact us by email, we keep the correspondence to resolve your request and to improve the Service.

3.6 Website

sculturats.com does not use advertising or analytics trackers and sets no cookies of its own. Our hosting provider may keep standard server logs (IP address, browser type, pages requested) for security and operations. The product overview video is embedded from YouTube and loads only when you choose to play it; from that point Google’s privacy policy governs any cookies YouTube sets.

4. Google user data: what we access and why

WorkFlura accesses Google user data in three distinct ways. Each is described below with the exact OAuth scope, who authorizes it and how the data is used.

When a user signs in to WorkFlura with Google, the consent screen asks for the following permissions. They are used only while you are signed in and only for the actions you take in the app:

Google Forms — See, edit, create, and delete all your Google Forms forms (https://www.googleapis.com/auth/forms.body). Used when a Pro user creates a form from the WorkFlura Designer: WorkFlura creates the form, sets its title, enables response email collection, publishes it, and later reads the form’s question list so the workflow can map answers to fields. WorkFlura does not read or modify forms that were not created through WorkFlura.
Google Drive — See, edit, create, and delete only the specific Google Drive files you use with this app (https://www.googleapis.com/auth/drive.file). Used to share a newly created form with your organization’s WorkFlura service account, move it into your organization’s WorkFlura Forms Shared Drive, duplicate a form as a template for a new workflow, move a form to the trash when you delete it from WorkFlura and lets you attach a file from your Drive to a request. This scope reaches only files that WorkFlura created and files you yourself select in WorkFlura (for example, a Drive file you choose to attach to a request); WorkFlura cannot browse or read anything else in your Drive.

The access token obtained at sign-in is kept in your browser session only and is discarded when you sign out or close the browser. Scultura does not store Google access or refresh tokens on its servers.

4.2 Permissions your organization’s administrator grants (domain-wide delegation)

So that workflows keep running when the person who created a form is away or has left the organization, a Google Workspace super administrator authorizes the WorkFlura service accounts, in the Google Admin console, to act on behalf of your organization’s designated WorkFlura System Administrators for these scopes only:

forms.body — to register and renew the Google Forms notification (“watch”) that tells WorkFlura when a form receives a new response. Google requires this to be done by a user who can edit the form.
forms.responses.readonly — to fetch new form responses when Google notifies WorkFlura that one has been submitted. Each response is saved into your organization’s data plane and then processed by the workflow.
drive.file — to manage the lifecycle of WorkFlura-created forms in the Forms Shared Drive.
admin.directory.user.readonly — to let a System Administrator optionally load names, email addresses and manager relationships from your organization’s Google Workspace directory when adding users. Nothing is written to your directory, and this is only invoked when a System Administrator chooses “Load from Directory”.

Two service accounts are authorized: the one your organization created in its own project (used for all reads of your data), and Scultura’s control-plane service account, which is used exclusively to create and renew Forms notifications because Google requires the notification topic and the authorizing credential to belong to the same project. Your administrator can review or withdraw either authorization at any time in the Google Admin console.

4.3 Service-account access without a user

drive.metadata.readonly (your organization’s service account, no impersonation) — to list which users are Managers of the WorkFlura Forms Shared Drive, so that only current administrators are used as delegation subjects. File contents are never read.
chat.bot (your organization’s service account) — to post approval requests, reminders and status updates to users through the Google Chat app your organization deployed in its own project. Messages are sent only to users involved in a workflow.
appsmarketplace.license (Scultura’s control-plane identity) — to confirm with Google that your organization has installed WorkFlura from the Google Workspace Marketplace before self-service provisioning is allowed.

4.4 Google Forms responses

Form responses are copied into your organization’s data plane and become the workflow submission. WorkFlura’s Forms Controller script, which your organization deploys in its own Google Workspace during setup, runs on WorkFlura’s standard schedule and deletes responses from the Google Form itself shortly after WorkFlura has processed them, so that the form does not accumulate a second copy of the data. That script runs entirely inside your organization’s Google Workspace.

4.5 Limited Use disclosure

WorkFlura’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we only use Google user data to provide and improve the WorkFlura features described above; we do not use it for advertising; we do not sell it; we do not transfer it to third parties except to provide the Service, comply with law, or as part of a merger or acquisition with prior notice; and no human at Scultura reads it except with your organization’s explicit consent for support, for security purposes, to comply with law, or where it has been aggregated and anonymized.

5. How we use information

To authenticate you and authorize what you can do in the Service.
To create forms, receive submissions, route approvals, send notifications, track SLAs and produce reports, as configured by your organization.
To administer subscriptions, seats, trials, renewals and invoices.
To monitor the health of the Service, diagnose faults and keep it secure.
To respond to support requests.
To meet legal obligations.

We do not use your data to train machine-learning models, to build profiles, or for marketing to individual users.

“Google user data” means information WorkFlura receives from Google APIs under the permissions described in section 4: your name, email address and profile picture from Google Sign-In; the Google Forms you create through WorkFlura and their question structure; responses submitted to those forms; the identity of Drive files you attach to a request; and directory entries your administrator chooses to load.

We do not sell Google user data. We do not share it with advertisers, data brokers, or analytics providers. We do not transfer it to any other application. We do not use it to develop, improve, or train any product other than WorkFlura. Human access at Scultura is described in section 8 and is limited to what you explicitly authorize.

Google user data is shared, transferred, or disclosed only as follows:

Your own organization. Google user data is stored in the Google Cloud project your organization owns and is visible to your organization’s users according to the roles your administrator sets (submitters see their own requests, approvers see requests assigned to them, administrators and designated reporting users see organization-wide status). Your administrator controls this access.
Google LLC (infrastructure provider). Both your organization’s data plane and Scultura’s control plane run on Google Cloud and Firebase. Google processes data as a service provider under the Google Cloud Platform Terms of Service and Data Processing and Security Terms. Google user data therefore never leaves Google’s infrastructure in the course of WorkFlura’s normal operation.
Paddle (Merchant of Record). Paddle.com Market Limited, or the Paddle entity applicable to your country under the Paddle Buyer Terms, acts as our Merchant of Record. Paddle receives no Google user data. When your organization subscribes, Paddle collects the purchaser’s contact and payment details directly on its own checkout and shares with Scultura only customer and subscription identifiers, plan, amount and status.
Legal requirements. We may disclose information if required by law, regulation, subpoena, or court order, or where necessary to protect the rights, safety, or integrity of the Service or its users. Where legally permitted, we will notify your organization’s System Administrator before doing so.
Business transfers. If Scultura is acquired by or merges with another company, Google user data may be transferred to the successor, which will be bound by this policy. We will notify subscribing organizations’ System Administrators before the transfer, and any use of Google user data will continue to adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not engage any other sub-processor. If that changes, we will update this section and notify subscribing organizations’ System Administrators at least 30 days in advance.

7. Retention and deletion

Workflow content is retained in your organization’s data plane for as long as your organization keeps it. Your organization controls archival and deletion, and owns the underlying Google Cloud project, so it can export or delete everything independently of Scultura. This includes all Google user data described in section 6.
Google access tokens exist only in the browser session and are not retained.
Form responses inside Google Forms are purged by WorkFlura’s Forms Controller script, running inside your Google Workspace on WorkFlura’s standard schedule, shortly after WorkFlura has processed them.
Control-plane records: sessions expire after 15 hours; error signals, job records and staged imports carry automatic time-to-live deletion (hours to days); metric snapshots are kept up to four years; license and billing history are kept for the life of the subscription plus the period required by tax and accounting law (currently eight years in India).
When a subscription ends, your organization’s data plane is untouched — it remains your project. On written request we delete the organization’s registry record, encrypted service-account key and configuration from the control plane within 30 days, and your administrator should revoke the service account and domain-wide delegation in your own consoles.

To ask us to delete data we hold, or to request a copy of it, write to support@sculturats.com.

8. Support access

Because Scultura cannot see your organization’s data, support is tiered. Built-in diagnostics work without data access. If a problem requires it, your System Administrator can grant Scultura a time-limited, read-only support access from the Admin Console; the grant is recorded, has a maximum duration set by your organization, and every access under it is logged in your organization’s data plane. Enterprise agreements may specify different arrangements in writing.

9. How we protect Google user data and other sensitive data

WorkFlura’s Google Forms permission (forms.body) is classified by Google as a sensitive scope. The following mechanisms apply to all Google user data and to every other category of sensitive data the Service handles (service-account keys, shared secrets, session credentials):

Encryption in transit. All traffic between your browser, WorkFlura, and Google APIs uses HTTPS with TLS 1.2 or higher. Internal calls between Google Cloud services carry signed identity tokens that WorkFlura verifies against the expected service-account identity before acting.
Encryption at rest. All data in Cloud Firestore and Cloud Storage — in your organization’s project and in Scultura’s control plane — is encrypted at rest by Google Cloud using AES-256. In addition, the service-account key and shared secret your organization provides during setup are encrypted at the application layer with AES-256-GCM before being stored, decrypted only in memory for the duration of a request, and never written to logs.
Handling of Google access tokens. The OAuth access token obtained when you sign in is held only in your browser session, sent to WorkFlura solely for the action you are performing, and discarded when you sign out or close the browser. Scultura does not store Google access tokens or refresh tokens on its servers. Domain-wide delegation credentials are created per request and are not persisted.
Least-privilege access. WorkFlura requests only the two permissions listed in section 4.1, and delegated access is limited to the four scopes in section 4.2, which your administrator can review or withdraw at any time. Firestore and Cloud Storage security rules published into your project default to deny and permit users to read only records they are authorized to see. Cloud Functions run under dedicated service accounts with the minimum IAM roles required.
Access control and authentication. Users authenticate only through Google Sign-In; WorkFlura stores no passwords. Every request is authorized against a short-lived session bound to the user’s organization and role. Administrative functions are gated by role checks, and Scultura staff cannot reach one organization’s data through another organization’s console.
Human access. Scultura personnel have no standing access to Google user data. Access is possible only under a time-limited, read-only grant that your System Administrator issues from the Admin Console (section 8); every access under a grant is logged in your organization’s project.
Secrets management. Deployment credentials and encryption secrets are held in Google Secret Manager with access restricted to the production service identity; they are not present in source code or configuration files.
Auditability. Approval decisions are attributed to the authenticated user and timestamped; audit records in your organization’s project cannot be altered by end users. Configuration and license changes made by Scultura staff are recorded in a control-plane audit log.
Retention and deletion. Google user data is retained only as described in section 7, and can be deleted by your organization at any time because it resides in your own project. On termination, Scultura deletes its control-plane records for your organization within 30 days of request.
Secure development and monitoring. Changes are reviewed before deployment, dependencies are kept current, and the Service is monitored for errors and anomalous activity; error signals stored centrally contain no Google user data.
Incident response. If we become aware of a security breach affecting your organization’s Google user data, we will notify your System Administrator without undue delay, and in any event within 72 hours of confirming the incident, with the information needed to meet your own notification obligations.

No system is perfectly secure, but these controls are designed so that Google user data is protected at every point at which WorkFlura handles it.

10. Your rights

Depending on where you live you may have rights to access, correct, delete, restrict or export personal information, or to object to certain processing. Because your organization controls most data processed through WorkFlura, requests about workflow content should go to your System Administrator, who can act within the Admin Console. Requests about information Scultura holds can be sent to support@sculturats.com; we respond within 30 days. Residents of India may also exercise their rights under the Digital Personal Data Protection Act, 2023.

You can withdraw the Google permissions you granted at any time at https://myaccount.google.com/permissions. Doing so will stop you from creating or managing forms in WorkFlura until you sign in again.

11. Children

WorkFlura is a business tool for organizations and is not directed at children under 18. We do not knowingly collect information from children.

12. International transfers

Scultura’s control plane runs in Google Cloud’s Mumbai region. Your organization chooses where its own project runs. Paddle processes payments from the United Kingdom and the United States under its own safeguards. Where information crosses borders we rely on the contractual and technical protections of our providers.

13. Changes to this policy

We will post any changes on this page and update the date at the top of it. For material changes affecting Google user data we will also notify subscribing organizations’ System Administrators by email before the change takes effect.

14. Contact

Scultura Technologies Private Limited
Mumbai, Maharashtra, India

Email: support@sculturats.com (privacy and support) · info@sculturats.com (general inquiries)