Privacy Policy
Last updated: September 24, 2026
1. Who We Are
CodeSaaS AI ("we", "us", "our"), Dublin, Ireland, operates the EasyFlowData platform, a deterministic financial data processing service. For the payment data you upload we act as your processor; the terms of that are the Data Processing Agreement.
Data Protection Contact: [email protected]
2. Our Core Principle: We Do Not See Your Data
EasyFlowData is architected on the principle of minimal data exposure:
- No Human Access: Your financial data is processed entirely by automated systems. No EasyFlowData employee, contractor, or team member views, accesses, or manually reviews your uploaded financial data.
- Automated Pipeline: Files are ingested, parsed, and analyzed by deterministic algorithms without human intervention.
- Workspace Isolation: Each user's data exists in a logically isolated workspace. There is no cross-tenant data access.
3. What Data We Collect
3.1 Account Information
- Email address, name (provided during registration)
- Authentication tokens (JWT, session cookies)
- Purchase and billing information (processed by Lemon Squeezy, our merchant of record, and Stripe)
3.2 Financial Data You Upload
- Transaction files (CSV, Excel) uploaded by you
- This data is processed to extract: dates, amounts, descriptions, categories, vendors
- Raw files are automatically deleted within 24 hours via S3 Lifecycle Rules
3.3 Computed Metrics (Derived Data)
- Normalized transactions, revenue/expense aggregations, profit margins
- Anomaly detection results, risk scores, financial health metrics
- You can delete this data at any time
3.4 Usage Data
- Pages visited, features used, session duration (anonymized)
- Error logs for service reliability
4. How We Use Your Data
| Purpose | Legal Basis (GDPR) |
|---|---|
| Providing the financial analysis service | Contract performance |
| Processing payments | Contract performance |
| Sending service-critical notifications | Legitimate interest |
| Improving service reliability | Legitimate interest |
| Complying with legal obligations | Legal obligation |
5. AI & Third-Party Processing
- No individual transactions are sent to AI providers. The AI receives totals, category names and amounts, and the names and column headings of your tables — never the rows themselves. This is enforced in code and held by an automated test.
- No PII is included in AI prompts.
- We do not send your data for training, and we have not agreed to any use of it for that purpose.
- Retention by the providers is governed by their own terms, not by ours. We have not negotiated a zero-retention agreement with any of them, so we do not claim one. If that matters to you, ask us before you upload and we will tell you exactly which provider is configured.
6. Data Retention & Deletion
| Data Type | Retention | Deletion |
|---|---|---|
| Uploaded files | Until their rows have been read; a file never finished stays until you delete it | Automatic after reading, or user-initiated |
| Normalized transactions | Until deletion | User-initiated |
| Account info | Until closure | On request, by email |
| Billing records | 7 years | Legal requirement |
7. Your Rights (GDPR)
You have the right to: Access, Rectify, Erase, Port, Restrict, Object to processing of your data, and Withdraw consent at any time.
Contact: [email protected] | Response within 30 days.
8. Security
- Stored uploads encrypted at rest (SSE-S3, AES-256); TLS in transit
- Workspace-level data isolation
- CSRF protection, rate limiting
9. Cookies
We use only essential cookies: authentication (access_token, refresh_token) and security (csrf_token). No advertising or tracking cookies.
10. Contact & Supervisory Authority
CodeSaaS AI, Dublin, Ireland | [email protected]
Irish Data Protection Commission (DPC): 21 Fitzwilliam Square South, Dublin 2, D02 RD28 | www.dataprotection.ie