Privacy policy
Last updated 30 October 2026
Flow Composer, including the Composer by Tachytelic connector for Power Automate, is run by Accendo Solutions Ltd, trading as Tachytelic, in the United Kingdom ("we", "us"). This policy explains what personal data we collect, why, who we share it with and what your rights are. If you have a question, email composerhelp@tachytelic.net.
Who is responsible for your data
We are the controller of your account, billing and usage data, and of data collected through this website.
For the content your flows send to Composer actions, we act as a processor on behalf of whoever owns the flow: we process that content only to run the action you asked for.
Content you send to actions
When a flow runs a Composer action, its inputs (text, files, arrays and so on) are sent to our API over HTTPS, processed in memory and returned in the response. We do not store your content, files, passwords or results, and we never use your content for any other purpose, such as training models or analytics.
Our diagnostic logs record which action ran, when, how long it took, whether it succeeded and, if it failed, the type of error. They never include the content you sent. Diagnostic logs are kept for 90 days and then deleted automatically.
The SharePoint and Dataverse batching actions only build request text. They never connect to your SharePoint or Dataverse environment, and we never receive your credentials for those services.
Account and billing data
When you sign up, we collect your name, email address, company name (if you give one) and your plan.
Your account is linked to your API keys and to a count of the calls you have made in the current period. If you buy a paid plan, our payment provider, Stripe, takes the payment and stores your card details. We never see your full card number.
Usage data
For every API call we record the API key used, the action called, the time, the response status, and the size and duration of the request. We use this to enforce plan limits, show you your usage, spot abuse and fix problems.
This website
- We do not use advertising or analytics cookies, and we do not track you across other sites.
- When you sign in, Outseta stores a login token in your browser's local storage so you stay signed in. Signing out removes it.
- The site is served by Cloudflare. Cloudflare processes your IP address to deliver pages and protect the site from attacks, and may set strictly necessary security cookies.
- Fonts are loaded from Google Fonts, so your browser sends your IP address to Google when it fetches them.
Why we use your data
Under UK data protection law (the UK GDPR), we rely on these legal bases:
- Contract: to create your account, provide the API, take payment and support you.
- Legitimate interests: to secure and improve the service, prevent abuse and diagnose faults.
- Legal obligation: to keep billing and tax records.
We send you emails about your account and the service. We do not sell your data or share it for advertising.
Who we share it with
We use a small number of providers who process data for us under contract:
| Provider | What for | Where |
|---|---|---|
| Microsoft Azure | Running the API, usage records and diagnostic logs | United States (East US) |
| Outseta | Accounts, sign-in, subscriptions and account emails | United States |
| Stripe | Payments | United States and others |
| Cloudflare | Hosting and protecting this website | Global network |
| Web fonts | Global network |
We may also disclose data if the law requires it, or to protect our rights or the safety of others.
International transfers
Some of these providers process data outside the UK, mainly in the United States. Where they do, we rely on recognised safeguards, such as the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Addendum to standard contractual clauses.
How long we keep it
- Action content: not kept.
- Diagnostic logs: 90 days.
- Account and usage data: while your account is open. We delete it within 90 days of you closing your account.
- Billing records: six years, as UK tax law requires.
Security
All traffic to our API and website is encrypted with HTTPS, and every API call needs a valid API key. Keep your key private. If you think it has been exposed, email us and we will issue a new one.
Your rights
You have the right to:
- ask for a copy of your data;
- have it corrected or deleted;
- restrict or object to how we use it;
- receive it in a portable format.
To use any of these rights, email composerhelp@tachytelic.net. We will reply within one month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put things right first.
Children
Flow Composer is a business service. It is not intended for anyone under 18.
Changes to this policy
If we change this policy, we will update the date at the top of this page. If a change is significant, we will email account holders before it takes effect.