Privacy Policy

Last updated: May 7, 2026

Introduction

Flinvo ("we", "the Service") is committed to protecting the privacy of its users. This Privacy Policy describes how we collect, use, and protect personal data when you use our service.

Data we collect

We collect the following types of personal data:

  • Registration data: name, email address, password (encrypted)
  • Billing data: information required for payment processing via Stripe
  • Usage data: information about how you use the service, preferences, and settings
  • User content: clients, invoices, tasks, and other content created within the platform
  • AI prompts and data: when you use the artificial-intelligence features after granting explicit consent, we collect and forward to OpenAI the prompt text and the context metadata required to fulfil the request (client name, amounts, descriptions, categories), only for as long as needed to process the request

How we use your data

We use your data to:

  • Provide and maintain the service
  • Manage your account and subscription
  • Send you service-related communications
  • Improve and personalize your experience

Cookies

We use essential cookies required for the service to function and analytics cookies to understand how the platform is used. You can manage your cookie preferences through the dedicated banner.

Third parties

We share data with the following service providers, solely for the stated purposes:

  • Stripe — payment processing and subscription management
  • Email service providers — sending transactional communications and notifications
  • OpenAI — processing the artificial-intelligence features (see dedicated section below)

Third-party artificial-intelligence services

Flinvo's artificial-intelligence features (drafting invoices and tasks from a textual prompt, dashboard insights and revenue forecasts) are powered by OpenAI, Inc., which acts as a sub-processor on our behalf. AI features are disabled by default: no data is sent until you grant your explicit consent directly within the app.

Who receives your data

OpenAI, Inc. — 3180 18th Street, San Francisco, CA 94110, United States. Data flows through Flinvo's servers to OpenAI, which processes it and returns the result.

What data is sent to OpenAI

  • The prompt text you type in the "Generate with AI" field (invoice or task descriptions)
  • Context information needed to fulfil the request: client name, amounts, line descriptions, expense categories, task descriptions
  • For dashboard insights only: anonymous aggregates of your revenue, due dates, recurring tasks and high-level financial indicators

What data is NOT sent to OpenAI

  • Login credentials, tokens, two-factor authentication codes
  • Credit-card numbers, IBANs or full banking details
  • Contents of documents uploaded as attachments (e.g. PDFs, receipt images)
  • Biometric data

Purpose and legal basis

Data is processed solely to return the output you requested (e.g. drafting an invoice) or to compute the personalised insights shown on the dashboard. The legal basis is the user's explicit consent (Art. 6(1)(a) GDPR), collected in-app before the first transmission of data. You may revoke your consent at any time from the app's "Settings → AI Privacy" screen or by writing to security@flinvo.app. Without your consent, AI features remain disabled and no data is transmitted to OpenAI.

Transfer outside the EU

OpenAI is based in the United States. Transfers rely on the Standard Contractual Clauses approved by the European Commission (decision 2021/914) and on OpenAI's adherence to the EU-U.S. Data Privacy Framework. OpenAI states that data received via its APIs is not used to train its models and is retained for at most 30 days for abuse-monitoring purposes, save for legal exceptions.

Level of protection

OpenAI guarantees a level of data protection equivalent to or higher than the one applied across the rest of Flinvo's infrastructure, in line with GDPR requirements.

Data retention

We retain your personal data for as long as necessary to provide the service. Upon account deletion, your data will be removed within 30 days, unless we are required by law to retain it.

Your rights

In accordance with applicable regulations, you have the right to:

  • Access your personal data
  • Request correction of inaccurate data
  • Request deletion of your data
  • Export your data in a readable format
  • Withdraw consent to share data with the AI service provider at any time (Settings → AI Privacy in the app, or by emailing security@flinvo.app). Withdrawal does not affect the lawfulness of processing performed before the withdrawal

Contact

For any privacy-related questions, you can contact us at security@flinvo.app.

← Back to home