Privacy Policy

1. Who we are

DataFlowr B.V. is the controller for the personal data described in this policy. We provide consultancy within the Exact Online ecosystem and Claire, the AI layer on top of Exact Online. Our company details are at the bottom of this page.

For questions about your data or about this policy, write to privacy@dataflowr.nl.

2. What we collect

We collect no more than the service needs. Which data that is depends on how you use DataFlowr.

• Contact details. Your name, email address, phone number, company name and the content of your message, when you email us or book an intro call.
• Account details. Your name, email address and the login account you sign in with at app.dataflowr.nl. Signing in runs through our identity provider. We hold no passwords.
• Connection data. The access tokens Claire uses to talk to Exact Online on your behalf, and which administrations you have connected.
• Administration data. What Claire fetches from your Exact Online administration for a given question, and the conversations you have with her. Those sit in your account so you can read them back.
• Usage and security logs. Which action ran when and under which account, plus technical data such as IP address and timestamp. We need those to spot misuse and to fix outages.
• Billing details. Company name, address, VAT number and invoice history. The payment itself is handled by our payment provider. Full card details never reach us.

3. What we use it for

We use your data for six things.

• Running the service. Your account, the connection to Exact Online and the answers Claire gives.
• Supporting you. Answering questions, investigating faults and looking along when you ask us to.
• Billing. Invoicing subscriptions and engagements, and keeping our own books.
• Security. Spotting misuse and unauthorised access, and being able to establish afterwards what happened.
• Improving the service. Seeing where Claire gets stuck or gets it wrong, so we can fix it.
• Staying in touch. Telling you about changes that affect you. You can opt out of anything non-essential at any time.

We do so to perform our agreement with you, to meet a legal obligation such as the statutory retention period for accounting records, or on the basis of a legitimate interest such as securing the platform. Where we need consent we ask for it up front, and you can withdraw it again.

4. Your administration in Exact Online

Claire works on your own Exact Online administration. Four rules apply there, and we do not stretch them.

• Access per user. You connect with your own Exact Online account. Claire can do exactly what you are allowed to do there, nothing more, and every action is logged under your own user.
• Fetched per question. Claire fetches what an answer needs, at the moment you ask. No copy of your administration ends up in an external platform.
• Reads freely, writes after approval. Claire reads and calculates on her own. A change to your administration is first put to you as a proposal and is only carried out once you approve it.
• Revoking takes effect at once. You revoke the connection from your account or from Exact Online. After that Claire fetches nothing.

If you use Claire from your own AI client, for instance Claude, ChatGPT or Microsoft Copilot, your questions and the answers also pass through that program. What that provider does with them falls under your agreement with that provider, not under this policy.

5. Who we share it with

We do not sell your data and we do not use it for advertising. To run the service we rely on a small number of processors, each under a data processing agreement.

• Sign-in and account management. Auth0 (Okta) handles authentication and account management.
• Payments. Stripe processes subscription payments and holds the payment details.
• AI models. OpenRouter routes your question to the language model that drafts the answer.
• Hosting and database. Our hosting provider runs the application and the database your account lives in.

Beyond that, we disclose data where the law obliges us to.

6. How long we keep it

We keep nothing longer than we need to. These are the periods we apply.

• Contact details. Up to 24 months after the last contact, unless an engagement follows from it.
• Account and conversations. For as long as your subscription runs. After you cancel, we delete the account and the stored conversations within 90 days.
• Connection data. Until you revoke the connection or cancel your account. The tokens then lapse and we delete them.
• Logs. Twelve months, so we can investigate an incident after the fact.
• Invoices and accounting records. Seven years, because Dutch tax law requires it.

7. Security

All traffic with our application and with Exact Online runs over an encrypted connection. The connection is made through OAuth, so you never hand us your Exact Online password. Access to production systems is limited to the staff who need it, and every action in Claire is logged under the user who performed it.

If you suspect a vulnerability or a data breach, report it as soon as you can to privacy@dataflowr.nl.

8. Your rights

You have the right to access your data, to have it corrected and to have it deleted. You can also have processing restricted, object to a particular processing and request your data in a common file format.

Send a request to privacy@dataflowr.nl.

We respond within a month. If you disagree with how we handle it, you can lodge a complaint with the Dutch Data Protection Authority.

9. Cookies

This website sets no tracking cookies and runs no analytics. Two elements do fetch from third parties: the typeface comes from Google Fonts, and the About us page carries a Calendly scheduler for booking a call. Both see your IP address in the process.

The application at app.dataflowr.nl uses one functional cookie to hold your session. It is needed to stay signed in and it does not track you.

10. Changes

When the service changes, we update this policy. The date at the top of the page shows when that last happened. If a change materially affects you, we say so before it takes effect.

The terms we deliver under are set out in our terms of service.