1. Who represents the service
The representative of Accounting Flow is identified below. This policy covers accountingflow.app and the same application when reached through its original hosting address.
- Service representative
- Neuralis.ia · Accounting Flow
- Privacy and service contact
- support@accountingflow.app
2. Information we process
Public samples can be explored without an account. An account is required to analyze your own files, including on the Free plan. Registering, saving work or purchasing a subscription adds the information needed for those features. Saved settings may include account or document identifiers, groups, positions, filters, search terms and notes you enter; they are not anonymous merely because the workbook stays local.
| Information | Where it is processed | Purpose |
|---|---|---|
| Excel / CSV files and journal lines | Your browser | Import, reconstruction, evidence and local exports. |
| Account identifiers, email, name and sign-in method | Authentication provider and application | Sign-in, account management and workspace permissions. |
| Optional company, professional role, company size and country | Private application storage | Understand the professional audience and improve the service. Editable or removable in your profile; no marketing subscription is created. |
| Project names, dataset fingerprints, row counts, saved views and notes | Private application storage | Save the configuration you choose to retain; reopen with the source workbook. |
| Feature events, counts, timestamps and security records | Private application storage | Understand usage, apply plan limits, prevent abuse and diagnose errors. |
| Payment details, invoices and subscription status | Payment provider, when enabled | Process subscriptions; the application receives payment references and status. |
3. Google and other sign-in methods
If you choose Google, Google and Supabase authenticate you. We receive a stable user identifier, email address, name, sign-in method and, when available, a profile image URL. We use these to create or locate your account, display your profile and protect your personal workspace. We request only openid, email and profile permissions.
Google profile data is not sold, used for advertising or used to train AI models. Google sign-in does not authorize access to your mailbox or accounting files. You can revoke the connection in your Google Account. Revoking it does not itself cancel a subscription or delete application records.
Email accounts use Supabase authentication. Passwords submitted to sign in are sent securely for verification and are not stored as readable passwords in the application database. Administrator-issued trial credentials use password hashes. Optional ChatGPT sign-in uses the verified identity supplied by the hosting platform.
4. Why we use information
We process information to provide the features you request, manage accounts and plan entitlements, save selected work, maintain security and understand feature usage. Usage records contain feature names, quantities, identifiers and timestamps rather than journal contents. Hosting and authentication providers may process IP addresses, device details and technical logs to operate and protect their services.
Where applicable, these purposes rely on providing the requested service, our legitimate interests in security and service operation, your consent when required, and legal recordkeeping obligations. We do not sell personal information or use imported journals to train AI models.
5. Cookies and browser storage
Files dropped before sign-in may be kept temporarily in this browser to continue the import, including across a sign-in redirect. They are not uploaded. The selection is removed when handed to the importer, removed by you or after sign-out. It expires after 30 minutes; expired browser copies are deleted on the next use.
Essential cookies support sign-in, session renewal, visitor preferences and protection against forged requests. Language preferences are stored on your device. If you choose to remember import mappings, their configuration is retained in the current browser tab, without copying source records into cloud storage.
Before a sign-in or billing redirect, the application can keep a temporary snapshot of journal rows and the current analysis in the same tab’s session storage. It is eligible for restoration for up to one hour and is removed when restored or signed out; closing the tab clears its session storage. This local snapshot is not a cloud backup. Downloaded exports remain wherever you save them.
Blocking cookies or clearing site storage can sign you out and remove local preferences or unfinished analysis. The application does not currently use advertising cookies.
6. Service providers and transfers
We use the providers below for the stated functions. They receive the information needed to operate those functions, not automatic copies of imported workbooks. Authorized operational access may be necessary for support, security and legal requests. Processing can occur outside your country under the providers’ applicable arrangements and policies.
When payments are enabled, the checkout identifies the payment provider and merchant of record. The application keeps payment references, amounts, currency, invoice links and subscription status. Full card numbers and card security codes are handled by the payment provider, not stored in the application database.
| Provider | Role | Provider policy |
|---|---|---|
| Supabase | Google and email authentication, verification and session management. | Provider policy · Supabase |
| Optional Google sign-in and basic profile information. | Provider policy · Google | |
| OpenAI / Sites | Website hosting platform and optional ChatGPT sign-in. | Provider policy · OpenAI / Sites |
| Cloudflare | Website delivery, HTTPS, application execution and private database infrastructure. | Provider policy · Cloudflare |
| Lemon Squeezy | Planned payment provider. Receives billing data only when you use its checkout or portal. | Provider policy · Lemon Squeezy |
7. Retention and deletion
Account and saved-work records are retained while your account is active, unless you delete individual projects or request account deletion. Canceling a subscription does not delete projects: items above the new plan limit may become read-only. Reopening a saved investigation requires the original workbook.
Completed account deletion removes your application profile, projects, saved views and notes and cancels any linked subscription. Limited billing references, security and administration records, and a hashed identity marker may remain where necessary for legal obligations, dispute handling or preventing unintended recreation. These records are not necessarily anonymous. Provider records and backups follow their own applicable retention rules; we do not promise immediate deletion from every backup.
8. Your choices and rights
You can edit your profile, manage or delete saved projects, sign out, clear device storage and revoke Google access. Account settings → Data & Privacy includes the account-deletion control. Provider configuration is still being completed, so deletion may return an unavailable message rather than a false confirmation; an unsuccessful attempt does not mean your data was deleted.
Depending on applicable law, you may have rights to access, correct, delete or obtain a copy of personal information, restrict or object to processing, withdraw consent and complain to the relevant authority. Identity verification may be necessary for requests. The direct contact channel is identified below when published. This policy does not limit mandatory legal rights.
9. Security and policy changes
We use HTTPS, protected session cookies and server-side workspace permissions. You are responsible for safeguarding your device, access credentials and exported files. No service can guarantee absolute security. Accounting Flow is intended for professional use, not for children.
Updates are published here with a revised date. Material changes to the way Google data is used will be disclosed and consent requested where required before that new use begins.