At FlexiFlow we process personal data in two different roles. It helps to tell them apart:
| Role | Which data | Who decides what it is used for |
|---|---|---|
| Controller | Your account, your access, your payments, use of the website and support | [OWNER NAME — PENDIENTE] |
| Processor | What you (or your accounting firm) store for your activity: invoices, customers, suppliers, expenses, bank movements, documents | You, or your firm: they are the controllers of that data and we process it only on their behalf |
Controller (and processor, where applicable): [OWNER NAME — PENDIENTE], tax ID (NIF) [OWNER TAX ID — PENDIENTE]. Address: [ADDRESS — PENDIENTE]. Privacy contact: [PRIVACY EMAIL — PENDIENTE]. The owner is self-employed (an individual). We have not appointed a data protection officer.
My money (personal or household finances) is a personal-use feature: what you record there you use yourself. For that data we act as the platform's controller, and you decide what you enter.
The "legal basis" is the reason that allows the processing under article 6 GDPR.
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Create and manage your account and access | Name, email, company and tax ID if given, password (stored irreversibly hashed), team role | Performance of the contract (art. 6.1.b) | While you have the account |
| Provide the service you bought | Account data and data of the modules you use | Performance of the contract (art. 6.1.b) | While you have the account |
| Charge subscriptions and top-ups | Plan, amounts, Stripe customer ID; we do not store your card number | Performance of the contract (art. 6.1.b) and legal obligation (art. 6.1.c) | The periods required by accounting and tax rules |
| Service email: verify email, recover password, security notices, receipts | Email, name, notice content | Performance of the contract (art. 6.1.b) | The outbox log is kept for 365 days |
| Security and abuse prevention | Sessions (date, IP and browser), failed sign-in attempts, log of sensitive actions | Legitimate interest in protecting the service (art. 6.1.f) | A session expires after 14 days; the rest, the minimum necessary |
| Showing which legal texts you accepted | Version, date, channel and truncated IP | Legitimate interest in proving acceptance (art. 6.1.f) | While you have the account |
| Answering your queries (help and contact) | Email, subject and message | Legitimate interest / pre-contractual steps (art. 6.1.f / 6.1.b) | As long as needed to resolve them |
| Waiting list and launch notices | Email, language, interest | Consent (art. 6.1.a), which you can withdraw | Until you withdraw it or the purpose is met |
| Commercial communications | — | Only with your express consent (unticked box). Today we do not send commercial communications to accounts | — |
| Your activity data (invoices, customers, expenses, banks, documents) | What you enter or your firm uploads, including third-party data | Processing on behalf: we follow your instructions (article 28 GDPR). You are the controller | While you have the account; afterwards, see "What happens when you delete the account" |
We do not use your data for automated decisions with legal effects on you. We do not sell your data.
The invoice reader ("Expenses with AI") first tries to read the invoice with its own program on our server. Only if the customer has "Allow AI" turned on, and the invoice is not resolved, a second pass may be sent to an external artificial intelligence provider.
We do not pass your data to other companies for their own purposes.
Most data stays in the European Union (our server). The following may leave the EU:
You can ask for deletion in "My account". There is a grace period of 14 days in which you can cancel it. After that, your users, sessions, customers, expenses, settings and other data are deleted. Kept: issued invoices and their records, payment receipts and the proof of deletion, for as long as the law requires, and blocked for other uses.
You can ask for access, rectification, erasure, objection, restriction of processing and portability of your data, and withdraw any consent you gave (articles 15 to 22 GDPR).
Complaints: if you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (AEPD): www.aepd.es.
We apply reasonable technical and organisational measures: encrypted connection (HTTPS), passwords stored with a salted hash, role-based access control, separation of each account's data, limits on sign-in attempts and encrypted backups. Details are in the security annex of the Data processing agreement. No system is infallible: if a breach affects you, we will tell you as the law requires.
The service is intended for adults and their professional activity.
Each version has a number and a date. For an important change, we will tell you inside the application and ask you to review it. You can see what you accepted in "My account → Legal documents".