Privacy Notice

Controller and contact

TriageFlow AI is operated under the name TriageFlow-ai, based in Ireland. TriageFlow-ai is the controller for personal data described in this notice. Privacy questions and requests can be sent to [email protected].

Informational public mode

The public informational website provides:

• no public registration, login or contact form;
• an optional supervised Customer Service demonstration that accepts synthetic evaluation messages;
• no first-party analytics or advertising scripts; and
• no non-essential cookies.

The contact link opens your own email service. Correspondence is processed only if you choose to email the published address, in which case the message, your email address and any other information you provide will be processed to respond to you.

The active public hostname is triageflow-ai.com, hosted on Cloudflare Pages. When you request a page or asset, Cloudflare receives normal hosting request metadata such as your IP address, request path, timestamp, user-agent, traffic-routing data and related security or network information. Cloudflare Web Analytics is disabled.

Cloudflare responses may include Network Error Logging configuration. A compatible browser may therefore send Cloudflare a report about a failed network request. The current configuration does not request reports for successful requests.

The supervised demonstration is served from widget.triageflow-ai.com through Cloudflare Tunnel. Cloudflare Turnstile checks conversation creation for automated abuse. Cloudflare therefore processes the challenge result and normal network and security metadata for demonstration requests. The demonstration may be unavailable whenever its supervised local operator has stopped it.

Supervised demonstration and interactive modes

The public demonstration and separately enabled local or private interactive mode process conversation messages and related context using locally running AI models. Active-chat credentials are held in browser session storage and are not placed in public URLs. Model credentials, model endpoints and internal services are not exposed to the browser.

Raw conversations are retained for 90 days after the latest message. Non-identifying processed analytics may be retained after raw conversation deletion. Viewer registration and contact data is deleted 90 days after account creation, with earlier deletion supported.

The application does not store raw IP addresses. Registration limiting uses a keyed pseudonymous digest instead. The system does not autonomously send customer messages.

Personal data and purposes

Depending on how the prototype is used, the categories may include:

• email correspondence and contact details you choose to provide;
• interactive account and registration details;
• conversation messages, selected issue and generated responses;
• active-chat and session credentials;
• pseudonymous registration-limiting data; and
• informational-site hosting, technical and security metadata processed by Cloudflare.

These data are used to answer correspondence, operate and secure an explicitly enabled prototype, generate and retrieve relevant information, support human review, enforce limits, delete data when requested and understand non-identifying aggregate operation.

Proposed lawful bases — subject to legal review

The proposed bases are steps requested before providing an interactive service or performance of that service where applicable; legitimate interests in responding to enquiries, securing and evaluating the prototype; consent where a specific optional use requires it; and compliance with legal obligations where necessary. These proposed bases must receive professional legal review before a paid or unrestricted service launch.

Recipients and processing locations

Data may be handled by the people operating TriageFlow-ai, the provider of the published email mailbox when you make contact, and Cloudflare as the provider of the informational website, Tunnel and Turnstile protection. Interactive AI processing is currently locally operated and is not hosted by Cloudflare Pages.

Cloudflare operates a global network. Its Data Processing Addendum anticipates that Cloudflare and its subprocessors may process personal data outside the European Economic Area, Switzerland and the United Kingdom. Cloudflare maintains a current subprocessor list with activities and locations. Its Data Processing Addendum provides for the applicable EU Standard Contractual Clauses, UK Addendum and additional safeguards for restricted transfers. The email provider may process correspondence in other countries under its own published terms and safeguards.

Retention

Email correspondence is kept only as long as reasonably needed to respond, manage the relationship and meet applicable legal obligations. Interactive-mode retention is described above. Cloudflare's Privacy Policy says it retains personal information consistently with the stated business purpose or as needed for legal obligations, using criteria including the purpose of collection. Its Data Processing Addendum describes customer personal-data retention as ending at the earlier of agreement expiry or termination, or when processing is no longer necessary for the parties' obligations, where applicable. No shorter Pages-specific request-metadata period is claimed here.

Security

The prototype uses measures including scoped access, non-public model endpoints, session-bound active-chat credentials and limited raw-data retention. No system can guarantee absolute security, and controls will require review before wider operation.

Your rights

Where applicable, you may request access to, correction or deletion of your personal data, restriction of processing, object to processing, or request data portability. You may also withdraw consent where processing relies on consent. Rights can depend on the circumstances and applicable law.

Send a request to [email protected]. You also have the right to complain to the Irish Data Protection Commission at dataprotection.ie.

Children

This prototype is not intended for children.

Changes to this notice

This is version 1.2, dated 26 July 2026. Material changes will be reflected by updating the version and date on this page.