Privacy Policy

Last updated: June 2025

Your financial data is private. FlowFund does not sell, share, or monetize your personal data. We do not run ads. We do not share data with third parties for marketing. Your finances are your business.

1. Who We Are

FlowFund ("we", "us", "our") is a personal finance platform operated at flowfund.finance. For GDPR purposes, we act as the Data Controller for personal data you provide when using the Service.

Contact: privacy@flowfund.finance

2. What Data We Collect

• Account data: Email address and password (hashed with bcrypt, never stored in plain text)
• Financial data you enter: Transactions, goals, debts, income, bills, assets — entered by you and stored in your account
• Usage analytics: Anonymous page views and feature usage to improve the product — no personal identifiers attached
• Profile preferences: Currency, language, notification settings
• Uploaded files: Documents stored in your Vault, videos uploaded to Reels

3. What We Never Collect

• We never collect bank login credentials or bank access tokens
• We never require KYC — no government ID, no address verification, no identity documents
• We never sell your data to advertisers, data brokers, or third parties
• We never use your financial data to train AI models outside of generating your personal insights
• We do not use advertising cookies or tracking pixels

4. Legal Basis for Processing (GDPR)

• Contract performance: We process your data to provide the service you signed up for
• Legitimate interest: Anonymous usage analytics to improve product quality
• Consent: AI features that process your financial data for insights (you can disable this)

5. How We Store Your Data

All data is stored on Supabase infrastructure with AES-256 encryption at rest. All data transmission uses TLS 1.3. Supabase operates EU-region servers (Frankfurt, Germany) ensuring GDPR-compliant data residency. Authentication uses JWT tokens. Passwords are never stored in plain text — only bcrypt hashes.

6. AI Features and Your Data

When you use the AI Financial Advisor, your financial summary (transaction totals, categories, goal progress) is sent to an AI API to generate insights. We do not send personally identifying information (name, email address) to the AI API. We use Anthropic's Claude API, which processes data under Anthropic's enterprise data processing terms. AI-generated responses are not permanently stored in any external AI training systems.

7. Third-Party Services

• Supabase: Database and authentication — EU data storage
• Vercel: Hosting and CDN — ISO 27001 certified
• Anthropic (Claude API): AI financial advisor features
• Stripe: Payment processing for Pro subscriptions — we never see full card numbers

8. Your Rights Under GDPR

If you are in the EU or EEA, you have the following rights:

• Right of access: Request a copy of all data we hold about you
• Right to rectification: Correct inaccurate personal data
• Right to erasure: Request deletion of your account and all associated data
• Right to data portability: Export your data in CSV or JSON format
• Right to object: Opt out of analytics processing

Exercise these rights from your Settings → Data & Privacy page, or by emailing privacy@flowfund.finance. We respond within 30 days.

9. Data Retention

Account data is retained until you delete your account. Analytics data (anonymous) is retained for 12 months. When you delete your account, all personal data is permanently deleted within 30 days from all systems.

10. Cookies

We use only essential session cookies required for authentication. We do not use advertising cookies, tracking pixels, or third-party analytics cookies. No cookie consent banner is required because we only use strictly necessary cookies.

11. Changes to This Policy

We will notify registered users by email of any material changes to this policy. The "Last updated" date at the top of this page will always reflect the current version.

12. Contact

For privacy questions: privacy@flowfund.finance

For general support: support@flowfund.finance