Privacy policy
Last updated: 8 June 2026
Who we are
Coflow is operated by Workivio Ltd. We are the data controller for personal data you provide while using the app. Contact: privacy@coflow.be.
What we collect
Account data (email, display name, language, region), financial data you enter or import (invoices, expenses, transactions, receipts), authentication metadata, and basic device/usage logs needed to operate the service.
Lawful basis (GDPR art. 6)
Performance of a contract (providing the dashboard you signed up for) and legitimate interest (security, fraud prevention, improving the service). Marketing communications require your explicit consent.
Where data is stored
Data is hosted in the EU on Supabase (PostgreSQL) and encrypted at rest and in transit (TLS 1.2+). Stripe processes payment information directly; we never see your full card number.
Sub-processors
Supabase (database, auth, storage), Stripe (payments), Google (AI processing for receipt OCR via Gemini), Resend (transactional email). All are GDPR-compliant and bound by data-processing agreements.
Your rights
You can access, export, correct, restrict, or delete your data at any time from Settings → Account, or by emailing privacy@coflow.be. We respond within 30 days. You can also lodge a complaint with the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be / autoriteprotectiondonnees.be).
Retention
Account and financial data are retained while your account is active and for up to 7 years after closure to meet Belgian bookkeeping obligations, then permanently deleted. Logs are kept 90 days.
Cookies
We use strictly-necessary cookies for authentication and language preference. We do not use advertising or cross-site tracking cookies.