FLEXFLOWAPP LTD is the data controller responsible for your personal data.
FlexFlow is not a bank and does not hold your money. We are a read-only financial information service that uses open banking technology to help self-employed people and limited company directors understand their income, tax position, and financial runway.
We collect personal data in the following categories:
| Data | Why we collect it | Lawful basis |
|---|---|---|
| Full name | To identify your account | Performance of a contract |
| Email address | Account login, verification emails, transactional notifications | Performance of a contract |
| Password (hashed) | Account security — we never store your password in plain text | Performance of a contract |
| Income structure (sole trader / Ltd director) | To apply the correct tax calculations | Performance of a contract |
| Tax code and Scottish taxpayer status | To apply the correct HMRC tax rates | Performance of a contract |
| Data | Why we collect it | Lawful basis |
|---|---|---|
| Bank account names and types | To display your connected accounts | Performance of a contract |
| Account balances | To calculate your available balance and runway | Performance of a contract |
| Transaction history (date, description, amount) | To allow you to confirm income and expense transactions | Performance of a contract |
| TrueLayer access tokens (encrypted) | To refresh your transaction data automatically | Performance of a contract |
We do not store your bank account number, sort code, card number, or any payment credentials. These are never transmitted to FlexFlow.
Bank data is accessed via TrueLayer Limited, an authorised Payment Institution regulated by the Financial Conduct Authority (FRN: 793265). TrueLayer acts as a data processor on our behalf. You will be directed to authenticate directly with your bank via TrueLayer's secure OAuth flow — FlexFlow never sees your banking credentials.
| Data | Why we collect it | Lawful basis |
|---|---|---|
| Confirmed income and expense transactions | To calculate your pre-tax income figure | Performance of a contract |
| Estimated tax calculations | To show your estimated tax liability and post-tax earnings | Performance of a contract |
| Committed bills (name, amount, frequency) | To calculate your financial runway | Performance of a contract |
| Mileage log entries | To calculate allowable mileage deductions | Performance of a contract |
| Home office configuration | To calculate allowable home office deductions | Performance of a contract |
| Pension contribution preferences | To factor pension contributions into tax calculations | Performance of a contract |
Subscription payments are processed by Stripe, Inc. We do not store your card details. Stripe retains payment records in accordance with their own privacy policy and applicable financial regulations. We retain a record of your subscription status and payment history for our own accounting purposes.
| Data | Why we collect it | Lawful basis |
|---|---|---|
| Two-factor authentication (TOTP) secret | To provide enhanced account security if you enable 2FA | Legitimate interests (account security) |
| Session tokens (JWT) | To keep you logged in securely | Legitimate interests (account security) |
| Login timestamps | To detect unusual account activity | Legitimate interests (security) |
Transactional emails (account verification, deletion confirmations, security alerts) are sent via SendGrid (Twilio Inc.). We do not use your email address for marketing without your explicit consent.
FlexFlow's Tax Engine performs automated calculations based on the transaction data you confirm and the income structure and tax code you provide. These calculations produce:
These figures are estimates only and do not constitute tax advice or financial advice. They are produced automatically using HMRC's published tax rates and thresholds for the current tax year. You should always consult a qualified accountant or tax adviser before making financial decisions based on these figures.
These automated calculations do not produce legal or similarly significant effects on you — they are informational tools to help you understand your financial position. You retain full control and can override or ignore any figure produced by FlexFlow.
We share your personal data only with the following third-party processors, all of whom are bound by data processing agreements:
| Processor | Purpose | Location |
|---|---|---|
| TrueLayer Limited | Open banking connectivity — reading your bank transactions and balances with your consent | United Kingdom |
| Amazon Web Services (AWS) | Cloud hosting and database storage (EC2, RDS) | United States (see Section 5) |
| Stripe, Inc. | Subscription payment processing | United States (see Section 5) |
| SendGrid (Twilio Inc.) | Transactional email delivery | United States (see Section 5) |
We do not sell your personal data to any third party. We do not share your data with advertisers, data brokers, or any other commercial third parties.
Some of our third-party processors are based in the United States. When we transfer your personal data outside the UK, we ensure appropriate safeguards are in place:
You can request a copy of the relevant safeguards by contacting us at jamie@flexflowapp.co.uk.
| Data type | Retention period |
|---|---|
| Active account data | For the lifetime of your account |
| Personal identifiers (name, email, password) on account deletion | Anonymised immediately on account deletion |
| Bank connection tokens and session data | Deleted immediately on account deletion |
| Anonymised financial records (transactions, tax calculations, runway data) | 6 years from date of account deletion, then permanently deleted — in accordance with the Limitation Act 1980 |
| Unverified accounts (email not confirmed) | Deleted after 24 hours |
When you delete your account, your name, email address, password, bank connection tokens and all security credentials are anonymised immediately. Anonymised financial records (with no personal identifiers attached) are retained for 6 years solely to protect both you and FlexFlow in the event of any future legal dispute, after which they are permanently and irreversibly deleted.
Under UK GDPR, you have the following rights in relation to your personal data:
| Right | What it means | How to exercise it |
|---|---|---|
| Right of access | Receive a copy of all personal data we hold about you | Use "Download My Data" in Settings, or email us |
| Right to rectification | Correct inaccurate personal data | Update in app Settings or email us |
| Right to erasure | Delete your account and personal data | Use "Delete Account" in Settings |
| Right to restriction | Restrict how we process your data in certain circumstances | Email us |
| Right to data portability | Receive your data in a machine-readable format | Use "Download My Data" in Settings |
| Right to object | Object to processing based on legitimate interests | Email us |
| Right not to be subject to automated decision-making | Request human review of automated calculations | Email us |
We will respond to all data subject requests within one calendar month of receipt. There is no charge for exercising your rights.
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
We take the security of your personal data seriously. Our security measures include:
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform affected users without undue delay, as required by UK GDPR Article 33.
The FlexFlow mobile application does not use cookies.
The FlexFlow website (flexflowapp.co.uk) uses only strictly necessary cookies required for the website to function. No analytics cookies, tracking cookies, or advertising cookies are used. No third-party cookies are set by this website.
FlexFlow is intended solely for adults aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us immediately at jamie@flexflowapp.co.uk and we will delete the data promptly.
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and update the "Last updated" date at the top of this page. Your continued use of FlexFlow after notification of changes constitutes your acceptance of the updated policy.
Previous versions of this policy are available on request by emailing jamie@flexflowapp.co.uk.
For any questions about this Privacy Policy, to exercise your data rights, or to raise a data protection concern:
FLEXFLOWAPP LTD
Data Controller
Email: jamie@flexflowapp.co.uk
ICO Registration: C1937893
We aim to respond to all data requests within one calendar month. If you are not satisfied with our response, you may escalate to the ICO at ico.org.uk.