Privacy Policy

From you directly, we may collect:

• Account information: name, email address, password (hashed), and the organization details you provide during signup or in settings.
• Business records you create: clients, invoices, quotes, recurring billing profiles, tax rates, payments, and any documents or logos you upload.
• Sign-in details: if you sign in with Google or GitHub, we receive your name, email address, and profile picture from that provider.

From your contacts (the recipients of invoices and quotes you send) we collect the recipient details you put on the documents you create (name, email address, billing address, tax ID); only as needed to render and deliver those documents on your behalf.

We also collect automatically, like most websites: IP address, browser and device type, referring and exit pages, the files viewed on our Service, operating system, and a date/time stamp. Used to analyze trends in the aggregate, secure the Service, and administer the site.

• To provide, secure, and operate the Service: rendering invoices, sending emails on your behalf, maintaining your account.
• To communicate with you about the Service: transactional messages, security notices, and (only with separate consent) product updates.
• To analyze how the Service is used, in aggregate, and to improve it (see Cookies below).
• To comply with legal obligations, resolve disputes, and enforce our agreements.

Our legal bases are: performing our contract with you (providing the Service), our legitimate interests (keeping the Service secure, and the account-level usage events described under Cookies), your consent (analytics in your browser), and legal obligations.

We do not sell your personal information.

The invoice generator at fluxfina.com/invoice needs no account. The invoice you make there is kept in your browser’s storage and its PDF is made in your browser, so we don’t receive it. The one exception is address suggestions: what you type into an address field is sent through our server to Radar to find matching addresses.

FluxFina uses cookies and similar technologies to keep you signed in (essential), to remember your preferences (functional), and to understand how the Service is used (analytics). Analytics in your browser (page views and feature use, via PostHog) runs on our website and in the app only after you accept it. If you accept before creating an account, the pages you viewed are linked to that account when you sign up. It never runs on the invoice and quote links sent to your contacts. You can turn it off on the Cookie settings page. On our website nothing is loaded from PostHog until you accept. Inside the app, your browser asks PostHog which features are switched on for your account whatever you choose; that check sets no cookie and records no page views. Web addresses we send are cut back to the page itself, so tokens, the private part of invitation and document links, and anything after a # never leave your browser; page titles, which can name your clients, are not sent at all.

Separately, our servers record a small set of account events (for example: an invoice was created, finalized, or sent; a client was added) with your account and organization IDs. They carry no document contents, amounts other than a payment’s total, or recipient details. These do not use cookies and are not affected by the cookie setting; we record them on the basis of our legitimate interest in understanding how the Service is used. You can turn them off at any time under Settings, Profile, Privacy (“Account usage events”), and they stop for your account on every device. Events that no one in your organization triggered (a client accepted a quote, a recurring schedule ran) stop as soon as any member of the organization turns them off. You can also object by emailing privacy@fluxfina.com.

We follow generally accepted standards to protect personal information, both in transit (TLS) and at rest. Data is stored in a PostgreSQL database in Germany with per-organization row-level security; PDFs, attachments, and uploaded files are kept in private storage that only FluxFina’s servers can read (logos are public, because they appear on the documents you send). Access to production systems is restricted to FluxFina personnel who need it to operate the Service.

No service can be guaranteed against compromise. If you believe your account has been accessed without authorization, contact us immediately at security@fluxfina.com.

Depending on where you live, you may have the right to access, correct, export, or delete personal information we hold about you, and to object to or restrict certain processing. In the app you can delete your account and your organization, download the PDF of any finalized invoice or quote, and export the invoices, clients, and quotes you select in a list as CSV (summary columns). The REST API returns complete records. For a full copy of your data, or any other request, contact us at privacy@fluxfina.com. We will respond within a reasonable time.

For personal information about your contacts (the recipients of invoices and quotes you create), FluxFina acts as a data processor on your behalf; you are the data controller. If one of your contacts asks us to remove their information, we will direct them to you.

We retain account data and business records (invoices, quotes, payments) for as long as your account is active, or as needed to comply with our legal obligations (for example, tax-record retention requirements that apply to invoices).

Deleting an organization removes its records (clients, invoices, quotes, payments, and the rest) and its stored files at once. Deleting your account removes your sign-in and personal details; an account can be deleted only after it has left or deleted every organization.

Deleted data stays in our database backups until they roll over, at most 14 days, and is then gone. Copies held by the services above (for example, email delivery logs and payment records at Stripe) follow those services’ own retention. Download or export anything you need to keep, such as invoices you must retain for tax purposes, before deleting.

FluxFina’s infrastructure and sub-processors operate in the regions noted in the sub-processor table. By using the Service you consent to the transfer of your personal information to those regions. Where required, we rely on standard contractual clauses or equivalent safeguards for cross-border transfers.

We may update this Privacy Policy to reflect changes to our practices. Material changes will be announced by email (to the address on your account) or by a prominent notice on the Service before the change takes effect. The Effective date in the header always reflects the most recent revision.

Questions about this policy can be sent to privacy@fluxfina.com.