Who is the controller and who is the processor
At FlexiFlow we process personal data in two different roles. It helps to tell them apart:
| Role | Which data | Who decides what it is used for |
|---|---|---|
| Controller | Your account, your access, your payments, use of the website and support | [OWNER NAME — PENDIENTE] |
| Processor | What you (or your accounting firm) store for your activity: invoices, customers, suppliers, expenses, bank movements, documents | You, or your firm: they are the controllers of that data and we process it only on their behalf |
Controller (and processor, where applicable): [OWNER NAME — PENDIENTE], tax ID (NIF) [OWNER TAX ID — PENDIENTE]. Address: [ADDRESS — PENDIENTE]. Privacy contact: [PRIVACY EMAIL — PENDIENTE]. The owner is self-employed (an individual). We have not appointed a data protection officer.
My money (personal or household finances) is a personal-use feature: what you record there you use yourself. For that data we act as the platform's controller, and you decide what you enter.
What data we process, why and on what basis
The "legal basis" is the reason that allows the processing under article 6 GDPR.
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Create and manage your account and access | Name, email, company and tax ID if given, password (stored irreversibly hashed), team role | Performance of the contract (art. 6.1.b) | While you have the account |
| Provide the service you bought | Account data and data of the modules you use | Performance of the contract (art. 6.1.b) | While you have the account |
| Charge subscriptions and top-ups | Plan, amounts, Stripe customer ID; we do not store your card number | Performance of the contract (art. 6.1.b) and legal obligation (art. 6.1.c) | The periods required by accounting and tax rules |
| Service email: verify email, recover password, security notices, receipts | Email, name, notice content | Performance of the contract (art. 6.1.b) | The outbox log is kept for 365 days |
| Security and abuse prevention | Sessions (date, IP and browser), failed sign-in attempts, log of sensitive actions | Legitimate interest in protecting the service (art. 6.1.f) | A session expires after 14 days; the rest, the minimum necessary |
| Showing which legal texts you accepted | Version, date, channel and truncated IP | Legitimate interest in proving acceptance (art. 6.1.f) | While you have the account |
| Answering your queries (help and contact) | Email, subject and message | Legitimate interest / pre-contractual steps (art. 6.1.f / 6.1.b) | As long as needed to resolve them |
| Waiting list and launch notices | Email, language, interest | Consent (art. 6.1.a), which you can withdraw | Until you withdraw it or the purpose is met |
| Commercial communications | — | Only with your express consent (unticked box). Today we do not send commercial communications to accounts | — |
| Your activity data (invoices, customers, expenses, banks, documents) | What you enter or your firm uploads, including third-party data | Processing on behalf: we follow your instructions (article 28 GDPR). You are the controller | While you have the account; afterwards, see "What happens when you delete the account" |
We do not use your data for automated decisions with legal effects on you. We do not sell your data.
Invoice reading with artificial intelligence (optional)
The invoice reader ("Expenses with AI") first tries to read the invoice with its own program on our server. Only if the customer has "Allow AI" turned on, and the invoice is not resolved, a second pass may be sent to an external artificial intelligence provider.
- What is sent: the images of that invoice's pages, which may include names, tax IDs, addresses and amounts.
- Who receives it: the provider named in Sub-processors (today, Anthropic, in the United States).
- How it is turned on: you do not need it to use the service. It is turned on and off customer by customer in the reader. If you leave it off, your invoices do not leave our server for this purpose.
- Who decides: the firm or business that turns on "Allow AI" is the one who must take it into account towards its customers.
- What is logged: each sending is recorded with the tokens used.
Who we share your data with
- Sub-processors that help us provide the service (hosting, payments, email, backups and, if turned on, artificial intelligence): full list in Sub-processors.
- Your accounting firm, if you linked it by accepting its invitation. It can see what you share with it; you can end the link at any time.
- Authorities, when the law requires it.
We do not pass your data to other companies for their own purposes.
International transfers
Most data stays in the European Union (our server). The following may leave the EU:
- AI reading (optional, only if you turn it on): United States. Safeguard:.
- Payments with Stripe: Stripe may process data from outside the EU with the safeguards it states in its terms.
How long we keep data
- Session: 14 days or until you sign out.
- System email (outbox): 365 days.
- Reader page images: deleted after 90 days and regenerated when the invoice is opened.
- Original documents and activity data: while you have the account.
- Backups: rotated; deleted data may remain in encrypted backups during the rotation cycle.
What happens when you delete the account
You can ask for deletion in "My account". There is a grace period of 14 days in which you can cancel it. After that, your users, sessions, customers, expenses, settings and other data are deleted. Kept: issued invoices and their records, payment receipts and the proof of deletion, for as long as the law requires, and blocked for other uses.
Your rights and how to exercise them
You can ask for access, rectification, erasure, objection, restriction of processing and portability of your data, and withdraw any consent you gave (articles 15 to 22 GDPR).
- Yourself, in the app: in "My account" you can export your data and ask for your account to be deleted.
- By email: write to [PRIVACY EMAIL — PENDIENTE] saying which right you want to exercise. We may ask you to prove who you are.
- Deadline: we reply within one month at most; if the request is complex or there are many, it can be extended by two more months, and we will tell you.
- If your firm or business processes your data (for example, you are a customer of an accounting firm), send your request to it, as it is the controller; we will help it to handle it.
Complaints: if you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (AEPD): www.aepd.es.
Security
We apply reasonable technical and organisational measures: encrypted connection (HTTPS), passwords stored with a salted hash, role-based access control, separation of each account's data, limits on sign-in attempts and encrypted backups. Details are in the security annex of the Data processing agreement. No system is infallible: if a breach affects you, we will tell you as the law requires.
Minors
The service is intended for adults and their professional activity.
Changes to this policy
Each version has a number and a date. For an important change, we will tell you inside the application and ask you to review it. You can see what you accepted in "My account → Legal documents".