Privacy Policy

1. Who we are

DataFlowr B.V. is the controller for the personal data described in this policy, with one exception: for the personal data inside your Exact Online administration we act as a processor on your instructions. Section 4 explains how that works. We provide consultancy within the Exact Online ecosystem and Claire, the AI layer on top of Exact Online. Our company details are at the bottom of this page.

For questions about your data or about this policy, write to privacy@dataflowr.nl.

2. What we collect

We collect no more than the service needs. Which data that is depends on how you use DataFlowr.

• Contact details. Your name, email address, phone number, company name and the content of your message, when you email us or book an intro call.
• Newsletter and download data. Your name and email address, the signup moment and the page you signed up from, when you subscribe to the newsletter or download the whitepaper. If you also fill in your company name or phone number, we store those alongside.
• Account details. Your name, email address and the login account you sign in with at app.dataflowr.nl. Signing in runs through our identity provider. We hold no passwords.
• Connection data. The access tokens Claire uses to talk to Exact Online on your behalf, and which administrations you have connected.
• Administration data. What Claire fetches from your Exact Online administration for a given question, and the conversations you have with her. Those sit in your account so you can read them back.
• Usage and security logs. Which action ran when and under which account, plus technical data such as IP address and timestamp. We need those to spot misuse and to fix outages.
• Billing details. Company name, address, VAT number and invoice history. The payment itself is handled by our payment provider. Full card details never reach us.

You are under no legal obligation to give us this data. But without contact details we cannot respond, and without account and connection data Claire cannot work for you.

3. What we use it for

We use your data for six things.

• Running the service. Your account, the connection to Exact Online and the answers Claire gives.
• Supporting you. Answering questions, investigating faults and looking along when you ask us to.
• Billing. Invoicing subscriptions and engagements, and keeping our own books.
• Security. Spotting misuse and unauthorised access, and being able to establish afterwards what happened.
• Improving the service. Seeing where Claire gets stuck or gets it wrong, so we can fix it.
• Staying in touch. Telling you about changes that affect you. You can opt out of anything non-essential at any time.

Each purpose rests on a legal basis under the GDPR. We run the service, support you and bill you to perform our agreement with you. We keep invoices and accounting records to meet a legal obligation: the statutory retention period for accounting records. Security, improving the service and staying in touch rest on our legitimate interest in a safe and working platform. Where we need consent we ask for it up front, and you can always withdraw it again.

4. Your administration in Exact Online

Claire works on your own Exact Online administration. Four rules apply there, and we do not stretch them.

• Access per user. You connect with your own Exact Online account. Claire can do exactly what you are allowed to do there, nothing more, and every action is logged under your own user.
• Fetched per question. Claire fetches what an answer needs, at the moment you ask. No continuous copy or synchronisation of your administration builds up outside Exact Online.
• Reads freely, writes after approval. Claire reads and calculates on her own. A change to your administration is first put to you as a proposal and is only carried out once you approve it.
• Revoking takes effect at once. You revoke the connection from your account or from Exact Online. After that Claire fetches nothing.

Your administration also holds personal data about others, such as names and bank account numbers of your customers and suppliers. For that data you remain the controller and we act as processor: we process it only on your instructions. If someone’s data sits in your administration, they exercise their privacy rights with you.

The data processing addendum that governs this is a standard part of every Claire subscription and sits at the bottom of this page, with the list of subprocessors as an annex, as a pdf attachment.

If you use Claire from your own AI client, for instance Claude, ChatGPT or Microsoft Copilot, your questions and the answers also pass through that program. What that provider does with them falls under your agreement with that provider, not under this policy.

5. No automated decision-making

We make no decisions about you based solely on automated processing, and we do not profile you. Claire drafts answers and proposals, but a change to your administration is only carried out after you have reviewed and approved it.

6. Who we share it with

We do not sell your data and we do not use it for advertising. To run the service we rely on a small number of processors, each under a data processing agreement.

• Sign-in and account management. Auth0 (Okta) handles authentication and the management of your account.
• Payments. Stripe processes your subscription payments and holds the payment details.
• AI models. OpenRouter routes your question to the language model that drafts the answer. Our model providers process prompts only to answer them; training on customer data is contractually excluded. Email addresses, phone numbers and credit card numbers are redacted before a question reaches the language model; in the month-end close checks IBANs are masked as well.
• Email notifications. Resend delivers the email the application sends you, such as the alert when a schedule finds something that needs attention.
• Hosting and database. Replit hosts the application and the database your account lives in. The application runs on Google Cloud infrastructure.
• Newsletter and whitepaper. Resend also stores the signups for the newsletter and the whitepaper, and handles sending and unsubscribing.

Beyond that, we disclose data where the law obliges us to.

7. Transfers outside the EEA

Some of these processors process data outside the European Economic Area, mostly in the United States. That happens under the safeguards the GDPR provides for it. Okta (Auth0), Stripe, Google and Resend are certified under the EU-US Data Privacy Framework; for the remaining processors we use the standard contractual clauses of the European Commission. Google Fonts and the Calendly scheduler on this website also see your IP address on American servers.

For your administration data, the safeguard per subprocessor is set out in the annex of our data processing addendum (pdf).

8. How long we keep it

We keep nothing longer than we need to. These are the periods we apply.

• Contact details. Up to 24 months after the last contact, unless an engagement follows from it.
• Newsletter signups. Until you unsubscribe. You can unsubscribe at the bottom of every email; after that your address disappears from the mailing list.
• Account and conversations. For as long as your subscription runs. After you cancel, we delete the account and the stored conversations within 90 days.
• Connection data. Until you revoke the connection or cancel your account. The tokens then lapse and we delete them.
• Logs. Twelve months, so we can investigate an incident after the fact.
• Invoices and accounting records. Seven years, because Dutch tax law requires it.

9. Security

All traffic with our application and with Exact Online runs over an encrypted connection. The connection is made through OAuth, so you never hand us your Exact Online password. Access to production systems is limited to the staff who need it, and every action in Claire is logged under the user who performed it.

If you suspect a vulnerability or a data breach, report it as soon as you can to privacy@dataflowr.nl.

10. Your rights

You have the right to access your data, to have it corrected and to have it deleted. You can also have processing restricted, object to a particular processing and request your data in a common file format. Consent you have given, you can always withdraw again.

Send a request to privacy@dataflowr.nl.

We respond within a month. If you disagree with how we handle it, you can lodge a complaint with the Dutch Data Protection Authority.

11. Cookies

This website sets no tracking cookies and runs no analytics. Two elements do fetch from third parties: the typeface comes from Google Fonts, and the About us page carries a Calendly scheduler for booking a call. Both see your IP address in the process.

The application at app.dataflowr.nl uses one functional cookie to hold your session. It is needed to stay signed in and it does not track you.

12. Changes

When the service changes, we update this policy. The date at the top of the page shows when that last happened. If a change materially affects you, we say so before it takes effect.

The terms we deliver under are set out in our terms of service.