n8n Privacy Policy

Table of content:

1. Introduction
2. Scope of Application; Updates
3. Categories of Personal Data
4. How do we use your Personal Data
5. Data processing for payment processing
6. Email and contact form
7. Data processing via our website
8. Disclosure of Personal Data; International Transfers
9. Use of Cookies
10. Automated Decision-Making and Profiling; Use of AI
11. How long do we keep your data for?
12. What are my rights under data protection laws?
13. Questions, comments and more details

We are n8n GmbH (registered with number HRB 212509 B) trading as n8n.

Our registered address is:
Novalisstr. 10
10115 Berlin
Germany

If you have any questions about this privacy notice, including requests to exercise your data subject rights, please contact us at [email protected]. Your request may be processed by automated means and forwarded to the relevant teams in order to fulfil it.

For confidential inquiries to our external Data Protection Officer, please contact them at [email protected]. Kindly include a reference to n8n and a brief description of your inquiry. The current postal address of our external Data Protection Officer is available here https://freshcompliance.de/en/legal-notice/.

1. Introduction

n8n GmbH, with its registered business address at Novalisstr. 10, 10115, Berlin, Germany ("Company", "us", "our", "we"), is committed to protecting your privacy. "User", "you", or "your" refers to any individual who accesses or uses our Websites (“https://n8n.io/” and “https://learn.n8n.io/”) or Services, including any features, tools, or functionality made available through them.

2. Scope of Application; Updates

This Privacy Policy, which applies to all Users, is designed to explain why, how we and when we process personal data to offer and provide our Website and Services. It also describes the choices available to you regarding the processing of your personal data.

Our Website and Services may contain links to third-party websites and may integrate third-party functionalities, such as social media plug-ins, tools, or APIs, to enhance your experience. We do not control these third parties or how they process, or use personal data, and their privacy practices may differ from ours. Any personal data you provide or that is processed through such third-party websites or functionalities is governed solely by the respective third party’s privacy policy and terms.

We may update this Privacy Policy from time to time without prior notice and immediate effect to reflect legal changes or enhancements to our Website or Services. The latest version is always available on our Website. The "last updated" date indicates if and as of when changes have been made to this Privacy Policy.

3. Categories of Personal Data

We may process the following categories of personal data that you provide to us directly, that are generated through your use of our Website or Services, or that we receive from third-party services or publicly available sources:

• Contact Data (i.e. information used to identify and contact you, such as name, email address, phone number, country or place of residence);

• Professional Data (i.e. information relating to your professional background, such as job title, role, company or organization, and, where applicable, in recruitment contexts CVs, application documents, or similar materials);

• Communication Data (i.e. information contained in communications with us, such as emails, chat messages, support requests, feedback, or other content you voluntarily provide when contacting us or using our Website or Services);

• Account and Usage Data (i.e. information relating to your account, workspace, subscription and use of the Services, such as pseudonymized User and workspace identifiers, account settings, authentication events, workflow configuration, usage metrics, enabled integrations, and billing information);

• Marketing Data (i.e. information relating to marketing communications and interactions, such as contact preferences, newsletter subscriptions, email engagement, and registrations for events, webinars or product updates);

• Event Data (i.e. information relating to your registration for and attendance at our events, such as attendee category, ticket and order details, badge details, any accessibility or dietary information you choose to give us, your event app profile and the settings you choose in it, and photographs, video and audio recordings made at the event).

• Traffic and Device Data (i.e. technical information generated when you access or use the Website or Services, such as IP address, device and browser type, operating system, language settings, access times, device identifiers and tokens, instance and user identifiers, system diagnostic data, log files, and related technical and usage metadata, such as HTTP request data, workflow or lifecycle events, feature interactions, and associated usage metrics).

We do not use personal data processed in connection with the Website or Services, including data from third-party services or integrations, to train n8n or third party machine learning (ML) models.

Our Website and Services are not intended for children under 16 years of age. We do not knowingly process personal data from children under 16. If we become aware that such data has been processed, we will delete it. Parents or guardians who believe their child has provided personal data to us may contact us at any time. Where one of our events expressly admits attendees aged 16 or 17, they may register and attend only if an adult with parental responsibility, or an adult authorised by them in writing, registers them, is the contracting party and accompanies them at the event. That adult also gives, on their behalf, any consent required for photography, video and event marketing. Attendees under 18 are not included in the optional networking features of our event app.

4. How do we use your Personal Data

First, we would like to give you an overview of our data processing activities and the purposes of these processes, which we will then explain in more detail below.

When you register for n8n cloud. When you sign up for an account with us, we process your name and email. We process these details to put the contract in place between us that enables you to access our platform. The legal basis for this data processing is Art. 6(1)(b) GDPR.

We use third party providers in order to better understand how people use our product and to optimize our service and experience. Additional data including address and credit card information will be processed by our Merchant of Record in order to process your payment We do not transfer or disclose your information to third parties for purposes other than the ones provided. You can delete your n8n cloud account via the product. You can learn more about the data we process on cloud in our Documentation.

We may derive de-identified data sets from your Customer Content and use such derived data to operate, enhance, improve, and develop n8n features and Cloud Services. The legal basis for this data processing is our legitimate interests in the technical development of our products, the optimization of functionality and the improvement of the user experience on the basis of Art. 6 (1) lit. f GDPR.

When you use your own n8n self-hosted deployment. If you install n8n on your own server, and unless you opt out per our Documentation instructions at https://docs.n8n.io/hosting/securing/telemetry-opt-out/, we process certain Usage Data (including user identifiers, truncated IP address, account settings, user events, workflow usage metrics, enabled integrations) to improve our product and your customer experience. If you chose to submit your email address, we may use it to contact you about your usage of the product. Learn more on our privacy page about data collection. The legal basis for this data processing is our legitimate interests in the technical development of our products, the optimization of functionality and stability, error analysis and correction, and the improvement of the user experience on the basis of Art. 6 (1) lit. f GDPR. Usage counts and your licence identifier continue to be reported where you hold a paid licence, as these are necessary to operate that licence. You can object to this data processing at any time with effect for the future by activating the opt-out, see our Docs page about telemetry data opt out.

If you sign up for a paid plan, we process your name, email address, company address, and the name and email address of others in your company (e.g. a billing contact). We process these details to put a contract in place between us. If you use our credit card billing feature, our Merchant of Record, Paddle, processes information including your address and credit card information, in order to process your payment. In addition, we process selected, anonymous information about how n8n is used. We use this information to improve your experience with our services and to protect from potential security attacks and abuse. On n8n Cloud we also record sessions in the n8n interface, meaning what happens on screen while you use the product. Credential values are never recorded. We do not use any personal data, including data received through any third-party services, for developing, improving, or training AI and/or ML models. We do not transfer or disclose your information to third parties for purposes other than the ones provided. Telemetry cannot be switched off on n8n Cloud. You can learn more about the data we process, and how to disable this information processing in our Docs at https://docs.n8n.io/privacy-and-security#data-collection.

When you sign up for the community forum. We process your email address or social media handle in order to assign you with an account to use our forum. You can delete your forum account by emailing us at [email protected].

When you attend one of our events. This section applies to events we organise, such as conferences, meetups and community days, and to events organised by third parties in which we take part.

Registration and attendance. When you register for one of our events we process your name, email address, company, job title, country and, where applicable, your attendee category and ticket type. For paid tickets we also process order and payment details as described in Section 5. We use this information to process your registration, to issue your ticket and badge, to admit you to the venue and to send you the information you need in order to attend, such as joining instructions, access to the event app, schedule changes and other practical updates. The legal basis is Art. 6 (1) (b) GDPR where you contract with us directly, and Art. 6 (1) (f) GDPR where you attend on behalf of an organisation that contracts with us. Registration is handled for us by an event registration provider acting as our processor, which may engage further providers as sub-processors, including the provider of our event app.

Accessibility and dietary information. If you tell us about accessibility requirements or dietary needs, we use that information only to make the arrangements you have asked for and we share it only with the suppliers who need it, such as the venue or the catering team. Where this information reveals data concerning health or religious beliefs, we process it on the basis of your explicit consent under Art. 9 (2) (a) GDPR. Providing it is voluntary and we ask you to give us only what we need in order to make the arrangement.

Your badge. Your badge shows your name, company, job title and attendee category. It is visible to other attendees, to our staff and to our partners while you are at the event. Your email address does not appear on your badge.

Our event app. For some events we provide an event app, and for some events the app is required in order to collect your badge. We use it to give you access to the agenda, your own schedule, the venue map and event notifications. You log in with the email address you registered with. You may add further details to your profile, such as a photograph, pronouns, phone number, location, industry, areas of expertise, a short biography and links to your LinkedIn or GitHub profile. Those additional details are optional. The legal basis is Art. 6 (1) (b) GDPR for making the app available to you and Art. 6 (1) (f) GDPR for keeping it secure and working properly. The app is provided for us by an event app provider acting as our processor.

Networking in the event app. Networking is optional and is switched off unless you turn it on. If you turn it on you can publish times when you are free to meet, send and receive meeting requests, and exchange your contact details with another attendee by choosing to show your personal QR code. When you show your QR code, the other attendee can save and later download your name, job title, company, email address, location, areas of expertise, biography and LinkedIn profile. A second, separate setting controls whether your profile appears in the attendee directory, where other attendees can search for you and see your profile details and your answers to the profile questions. Your email address and phone number are not shown in the directory. The legal basis for both settings is your consent under Art. 6 (1) (a) GDPR. You can withdraw either consent at any time in the app, and your profile is then removed from the directory. Withdrawal does not affect details you have already exchanged with another attendee.

Photography, video and audio. We take photographs and make video and audio recordings at our events. General shots of the venue, sessions and the audience are made on the basis of our legitimate interest in documenting and promoting our events and our business, Art. 6 (1) (f) GDPR. You can object at any time, on site by speaking to a member of our team or by taking the marker we provide at the registration desk, and afterwards by contacting us at [email protected]. Close-up photographs, individual portraits and interviews are made only on the basis of your consent under Art. 6 (1) (a) GDPR, which you can give at registration or on site. Where you have consented, we may use this material for marketing purposes such as social media, our website and event recaps, share it with attendees after the event, and share it with our partners so that they can refer to their own participation. We do not permit standalone commercial or advertising use of your image. You can withdraw your consent at any time with effect for the future by contacting us at [email protected].

Event marketing. If you consent, we use your registration details to send you marketing about the event and to follow up with you after it, on the basis of Art. 6 (1) (a) GDPR. This is separate from the information we have to send you so that you can attend, which you receive whether or not you consent to marketing. You can withdraw your consent at any time using the unsubscribe link in our emails or by contacting us at [email protected].

Who we share event data with. In addition to our processors, we share limited information with the venue and with suppliers where this is needed for access, catering or safety, with partners and sponsors where you have chosen to share your details with them, and with speakers or session hosts where you sign up for their session.

Events organised by third parties. Where we take part in an event organised by someone else, we process the contact and professional details you give us at our stand or that the organiser passes to us, so that we can follow up with you. The legal basis is our legitimate interest in developing our business, Art. 6 (1) (f) GDPR, or your consent where you have given it.

How long we keep event data. We keep registration records and records of the consents you have given for the period we need them for the event and afterwards to demonstrate that we met our obligations, and for longer where a statutory retention period applies. Profiles, connection lists and other data held in the event app are deleted a short period after the event ends.

When you contact us. When you contact us either by email or via our website or product with general queries, we will usually process your name and contact details, because it’s in our legitimate interest to make sure we can properly respond to your query.

On social media. When you connect with us on social media including on Facebook, Twitter, YouTube and LinkedIn we will process your handle, name and email address under our legitimate interest to respond to your comments and queries promptly.

When you receive our news updates. We will handle your personal information (such as your name and email address) to provide you with our news updates in line with any preferences you have told us about.

When we send you our news updates because you have opted-in to receive them, we rely on your consent to contact you. If you have not opted-in and we send you our news updates emails, we do this because of our legitimate interest to promote our business.

You can unsubscribe from our updates at any time by clicking the unsubscribe link at the bottom of any of our emails, or by emailing [email protected].

When you register as an expert. We process your name, email address, and details about your company in order to communicate with you about the n8n expert program

When you register as an affiliate. We process your name and email address in order to communicate with you about the n8n affiliate program.

When you apply for a job with us. When you enter into the recruitment process with us we may process your personal data as set forth in our n8n Privacy Policy for Recruiting https://n8n.io/legal/recruiting-privacy-policy/.

If our business is sold. We process your personal information for this purpose because we have a legitimate interest to ensure our business can be continued by the buyer. If you object to our use of your personal information in this way, the buyer of our business may not be able to provide services to you.

5. Data processing for payment processing

We use an external payment service provider for the processing of online payments and, where applicable, invoicing and tax handling for digital products. The legal basis for the processing of personal data is Art. 6 (1) b) GDPR, as the processing is necessary for the implementation of pre-contractual measures and for the performance of a contract.

This includes, in particular, name, email address, billing address, payment information (e.g., credit card details or other payment details), IP address, transaction data, and, where applicable, company-related information. The processing is carried out for the purpose of payment processing, fraud prevention, invoicing and tax compliance (e.g., VAT determination)

The payment service provider may act as an independent controller within the meaning of Art. 4 No. 7 GDPR, in particular where it processes payment data in its own name as a so-called “merchant of record.”

The payment service provider may also process personal data in order to comply with legal obligations (e.g., commercial and tax law retention requirements) and for fraud prevention or the assertion and defense of legal claims. Personal data will only be disclosed to third parties if this is necessary for contract processing, required by law, or carried out within the framework of commissioned data processing. The storage period for personal data is determined by statutory retention obligations and contractual requirements. Data relevant under commercial and tax law is generally stored for the duration of the applicable statutory retention periods.

6. Email and contact form

Due to legal requirements, our website provides information that enables you to contact us quickly and communicate with us directly. This includes both our email address and our contact form. If you contact us by email or via our contact form, the personal data you provide will be stored automatically. The other personal data processed during the contact process serves to prevent misuse of the contact form and to ensure the security of our information technology systems.

The legal basis for the processing of data transmitted in the course of sending an email is Art. 6 (1) lit. b GDPR. We use the personal data you provide exclusively for the purpose of processing your specific inquiry. The data provided will always be treated confidentially.

The data will be deleted as soon as it is no longer necessary for the purpose for which it was processed. For personal data from the input mask of the contact form and that sent by email, this is the case when the respective conversation with you has ended. The conversation is ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified.

7. Data processing via our website

• Access data in server log files

  Every time you visit our website, we automatically store access data in so-called server log files.The legal basis for the temporary storage of your data and the log files is Art. 6 (1) lit. f GDPR.

  This includes the date and time of the visit, the amount of data transferred and, if applicable, the name of the requested file, the browser used and its version, the operating system used, the IP address and the referrer URL (the URL you visited immediately before). The temporary storage of the IP address by the system is necessary to enable the website to be delivered to your end device. For this purpose, your IP address must remain stored for the duration of the session.

  Our website uses a content delivery network (CDN) and security service provider (category of recipient: IT infrastructure and security service provider). For this purpose, incoming requests are routed via the provider’s globally distributed edge servers (reverse proxy). In this context, access data - in particular IP address, request header information, and browser data - may already be processed by the provider before being forwarded to our web server.

  The temporary storage of the IP address by the system is necessary to enable the website to be delivered to your end device. This also applies where the delivery takes place via edge servers of the CDN provider. For this purpose, your IP address must remain stored for the duration of the session.

  This data is evaluated exclusively to ensure the permanent and trouble-free operation of the website and to improve the content of our website, as well as to transmit it to law enforcement authorities in the event of a cyber attack and to ensure the security of our information technology systems, which also constitute our legitimate interest in data processing. The processing of data for the provision of the website and the storage of data in log files is essential for the operation of our website. Consequently, there is no possibility of objection.

  The use of the CDN and security service provider also serves the purposes of load balancing, protection against distributed denial-of-service (DDoS) attacks, bot detection, and safeguarding the integrity and confidentiality of our information technology systems.
  Insofar as personal data is processed by the CDN provider in its own responsibility (e.g., for network security purposes), the provider acts as an independent controller within the meaning of Art. 4 No. 7 GDPR. Where processing is carried out on our behalf, this is based on a data processing agreement pursuant to Art. 28 GDPR.

• Use of third-party tools for marketing, analysis and optimization purposes

  When you visit our websites, we process data for marketing purposes, statistics, optimization, and to ensure IT security, in some cases with the support of service providers (so-called third-party tools). We ask for your consent for this processing. Detailed information on the cookies and services used can be found in the settings options of the cookie banner, via the cookie button, which you will find at the bottom left, by clicking on the “Show Details” button. The legal basis for this data processing is §25 (1) TDDDG in conjunction with Art. 6 (1) a) GDPR.

  In particular, IP address, browser type and version, time zone setting, browser plugin types, geolocation, operating system and version, click behavior, return visits, transaction data, and use of third-party services are processed. The recipients of the data are the providers of the respective third-party tools used, our IT and hosting service providers, and marketing and analysis service providers.

  We use third-party services that recognise returning visitors to our websites and correlate activity across visits. These services may match identifiers and usage data against third-party services or publicly available sources to identify the company, and where lawfully possible the individual, associated with a visit. We use this information to understand interest in our products and to tailor our sales and marketing outreach. The legal basis is your consent (Art. 6 (1) (a) GDPR; §25 (1) TDDDG). You can withdraw consent at any time via the Cookie Settings button.

  The data processed in this way is stored for the duration specified in the cookie banner and then irretrievably deleted. You can revoke your consent to this data processing at any time by adjusting the cookie settings accordingly by clicking the “Cookie Settings” button at the bottom left.

8. Disclosure of Personal Data; International Transfers

We may share personal data with carefully selected service providers that support our business operations. These include, in particular, providers of IT hosting and infrastructure services (e.g. cloud hosting and content delivery networks), cybersecurity and fraud prevention solutions, data storage and backup services, website analytics and performance monitoring tools, marketing and advertising platforms, subscription management, billing and revenue analytics systems, payment processing services, as well as customer relationship management software, internal collaboration and productivity tools, document management systems, and customer support and communication services (e.g. ticketing systems, live chat and email services). Where such service providers process personal data on our behalf, we conclude data processing agreements pursuant to Article 28 GDPR, ensuring that personal data is processed solely in accordance with our instructions and in compliance with applicable data protection standards. In some cases, third parties process personal data as independent controllers or joint controllers, in particular in the context of advertising and social media services.

We may disclose personal data where required by law or where such disclosure is necessary to comply with legal obligations or lawful requests by public authorities, courts, or law enforcement agencies, enforce our commercial contracts or other agreements, investigate potential violations, prevent or address fraud, security, or technical issues, or protect our rights, property, users, or the public. Such disclosures are carried out strictly in accordance with applicable legal provisions. Where legally permissible, we aim to ensure transparency towards data subjects.

Some of the recipients listed above may be located outside the European Union (EU) or the European Economic Area (EEA), in particular in the United States. Where personal data is transferred to third countries, such transfers are carried out only where permitted under Articles 44 et seq. GDPR and are subject to appropriate safeguards. These safeguards include in particular reliance on adequacy decisions, such as the EU–U.S. Data Privacy Framework, where applicable, the use of Standard Contractual Clauses (SCCs) approved by the European Commission, and additional technical and organizational measures to ensure an adequate level of data protection. We assess the data protection and security posture of each recipient together with our Privacy Office and ensure that appropriate technical safeguards (such as encryption and access controls) are implemented. These safeguards are reviewed on an ongoing basis and updated as necessary to reflect legal or regulatory developments.

9. Use of Cookies

If you browse our Website, we may collect Traffic and Device Data that your browser sends to us. As a protective measure in favor of privacy, we delete or anonymize the IP address after your visit to our Website. This means that Traffic and Device Data can no longer be traced back to you and is only used for anonymous, statistical purposes to optimize our Website or Services. 

Our Website may use so-called cookies (i.e. small text files stored in your browser or on your device) and similar tracking technologies such as pixels or scripts, which are used to collect information about how our Website is used ("Cookies"). This information may be processed by us or transmitted to the relevant provider and may include a unique device identifier. Cookies contain information about the current or last visit to our Website (e.g., name of the Website, expiration date of the Cookie, other values). If Cookies do not contain an exact expiration date, they are stored only temporarily and are automatically deleted as soon as you close your browser or restart your device. Cookies with an expiration date will still be stored even when you close your browser or restart your device. Such Cookies will not be deleted until the specified date or if you delete them manually. 

We may use the following three types of Cookies: (a) Essential Cookies that are required for the functionality of our Website; (b) functional and performance-related Cookies that help us improve your experience; and (c) advertising and analytics Cookies that enable personalized ads and analytics. 

Where Cookies collect information that constitutes personal data, this Privacy Policy applies. In this case, you can update or withdraw your Cookie preferences at any time via our Consent Management Platform (via the “Cookie Settings” button). You can further configure, block and delete Cookies in your browser settings. If you delete all Cookies, some functions of our Website or Services may not be displayed correctly. Helpful information and instructions for the most common browsers can be found online.

10. Automated Decision-Making and Profiling; Use of AI

Where you have consented, we may create usage profiles for marketing purposes, for example to recognise returning visitors and assess interest in our products (see Section 7). We do not make decisions about you that are based solely on automated processing (including profiling) and that produce legal effects concerning you or similarly significantly affect you, within the meaning of Article 22 GDPR. If we were to introduce such automated decision-making in exceptional cases in the future, we inform you in advance where required by law and ensure appropriate safeguards are in place. These safeguards would include, at a minimum, your right to obtain human intervention, to express your point of view and to contest the decision.

We may use AI-supported or automated tools to assist with internal processes or to support our Services. However, these tools do not replace human decision-making where a decision could have legal or similarly significant effects on you. We further do not use personal data for the development, training or improvement of any artificial intelligence or machine-learning models.

11. How long do we keep your data for?

We store your personal information for no longer than necessary for the purposes for which it was processed, including for the purposes of satisfying any legal or reporting requirements, and in accordance with our legal obligations and legitimate business interests. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data; the potential risk of harm from unauthorized use or disclosure of your personal data; the purposes for which we process your personal data; and the applicable legal requirements.

In some circumstances we may carefully anonymise your personal data so that it can no longer be associated with you, and we may use this anonymised information indefinitely without notifying you. We use this anonymised information to analyse our programmes and support other similar programmes around the world.

We maintain an internal retention schedule which sets the retention period for each category of personal data and each processing purpose, including for our events, and which we review regularly. If you would like to know the period that applies to a particular processing activity, please contact us at [email protected].

12. What are my rights under data protection laws?

You can contact us at any time if you have any questions about your rights regarding data protection or if you wish to exercise any of the following rights:

• Right to withdraw your consent (Art. 7 (3) GDPR);
• Right to access your data (Art. 15 GDPR);
• Right to correct your data (Art. 16 GDPR);
• Right to have your data deleted (Art. 17 GDPR);
• Right to limit data collection (Art. 18 GDPR);
• Right to data portability (Art. 20 GDPR);
• Right to object how your data is handled (Art. 21 GDPR);
• Right to send complaints to the supervisory authority (Art. 77 GDPR).

To exercise your rights, please contact us at: [email protected].

13. Questions, comments and more details

Your feedback and suggestions on this notice are welcome at [email protected]. For confidential inquiries, you can also contact our external Data Protection Officer at [email protected].

More information about n8n's data privacy practices, including GDPR compliance is available here.

Last updated: 28 September 2026