Changes to our legal documents
This page lists every published change to our terms, data processing agreement, sub-processor list, privacy policy and cookie policy since the new edition of July 30, 2026. Each version of the terms and of the data processing agreement stays readable under its own link, so you can always check the version you accepted. The privacy policy, cookie policy and sub-processor list link to their current text.
New rules for changes. A customer who does not agree with a new sub-processor or a change to the Terms can terminate the contract with effect from the date the change takes effect and gets a pro-rata refund of fees already paid. Notice is 14 days for both (previously six weeks for the Terms). Main obligations and prices cannot be changed this way; price changes keep their own six-week notice. A new rule covers replacing a sub-processor at short notice, for example when a provider stops its service, and changes that only benefit the customer take effect on publication.
Email now runs on Amazon Web Services in the AWS European Sovereign Cloud (Germany) instead of Postmark (US). AWS replaces Postmark in Annex 3 and in the sub-processor list. Every entry in the list now links the provider's data processing terms.
All AI features run on Google Cloud's Vertex AI in the EU, with Claude and Gemini models. Anthropic and Cursor/xAI are no longer sub-processors and receive no customer data. The separate approval per AI provider is gone; AI features run only when an authorized user starts them. Section 6.1 of the Terms, Annexes 1 to 3 of the DPA and the privacy policy describe the new setup.
finAPI and Plaid are listed as bank connectivity providers instead of sub-processors. The customer engages them directly under their own terms, and they act as independent controllers (§ 5(6) of the DPA in this version). Connecting a bank automatically stays optional; manual import is the alternative. The privacy policy now explains bank connections.
The move to Google Cloud in Frankfurt is complete. PlanetScale, Vercel and Cloudflare are no longer sub-processors. The Google Cloud entry now covers hosting, the database and file storage in Germany.
Intercom is no longer a sub-processor. Support now runs through a form in the product and is answered by email. The app no longer shows a consent banner, because it only sets the cookies needed to sign in; the cookie policy lists them.
Sentry is no longer a sub-processor. Errors in the browser now go to SaaSFlow's own servers, without a third party and without a cookie. The privacy policy describes what an error report contains.
Google Workspace and Slack are removed from the sub-processor list. They are internal tools that do not process customer data on the customer's behalf. The list and Annex 3 now state which tools are out of scope, and the privacy policy describes them separately.
New set of legal documents in German and English. Terms 2.0 replace the previous terms with a contract under German law for business customers. The new data processing agreement under Art. 28 GDPR includes the technical and organizational measures and the approved sub-processors. The sub-processor list, the privacy policy and the cookie policy were completed and corrected to match the websites and the product.