arrow_back Flowkeeps Privacy Policy
dark_mode

Privacy Policy

Service: FlowKeeps  |  Controller: House of Comms s.r.o.  |  Version: 1.0  |  Effective date:  |  Last updated: 19 March 2026

Language notice: This Privacy Policy is also available in Slovak (Zásady ochrany osobných údajov) and Czech (Zásady ochrany osobních údajů). Slovak Consumers are entitled to receive this information in Slovak. Czech Consumers are entitled to receive it in Czech. The applicable national-language version is the binding version for Consumers in that jurisdiction.

At a glance — what we do with your data

  • Who we are: House of Comms s.r.o., IČO 50649833, Brectanova 3, Bratislava 831 01, Slovak Republic. Contact:
  • What data we collect: Your email, name, receipt images and metadata, bank account and transaction data (only if you connect a bank), company workspace data, and technical/device data.
  • Why we collect it: To provide the FlowKeeps service, authenticate your identity, process receipts via AI, and comply with legal obligations.
  • Who we share it with: Google (Firebase authentication, Gemini AI), Amazon Web Services (cloud storage), Tatrabanka (bank data, only if you connect), and the European Central Bank (exchange rate queries — no personal data sent).
  • How long we keep it: Account data is kept while your account is active. Receipts and financial data are kept until you delete them or close your account, with limited retention for legal compliance.
  • Your rights: You have the right to access, correct, delete, export, and object to processing of your data. Contact us at .
  • Supervisory authorities: Úrad na ochranu osobných údajov SR (Slovakia)  |  ÚOOÚ (Czech Republic).

The full policy below provides complete details required by GDPR Articles 13–14.

1. Controller Identity and Contact

Data Controller:
House of Comms s.r.o.
Registered office: Brectanova 3, Bratislava 831 01, Slovak Republic
IČO (Company ID): 50649833
DIČ (Tax ID):
IČ DPH (VAT):
Commercial Register: Municipal Court Bratislava III, Section Sro, Insert No. 116669/B

Privacy contact:
Email:
Phone:
Postal: House of Comms s.r.o., Brectanova 3, Bratislava 831 01, Slovak Republic

The Controller is responsible for determining the purposes and means of processing your personal data. Where Business Users use FlowKeeps to manage data of their own customers or employees, those Business Users act as independent controllers, and a Data Processing Agreement under GDPR Article 28 is required (see Terms & Conditions §12.1).

Slovak-law note: Personal data processing is governed by Act No. 18/2018 Coll. on the Protection of Personal Data, which implements the GDPR in the Slovak Republic. The Controller does not process the national identifier (rodné číslo) for the purposes of the FlowKeeps service. Processing of such identifiers would require a separate lawful basis under §78 of Act 18/2018 and is not carried out.

Czech-law note: Processing by Czech-resident users is additionally governed by Act No. 110/2019 Sb. on the Processing of Personal Data.

2. Data Protection Officer

The Controller has not appointed a Data Protection Officer (DPO) as the core activities of FlowKeeps do not require regular and systematic large-scale monitoring of data subjects, nor large-scale processing of special category data, under GDPR Article 37(1).

However, given the EDPB's 2026 coordinated enforcement focus on GDPR Articles 12–14 transparency obligations, voluntary DPO appointment is under review. Privacy-related enquiries may be directed to in the meantime.

Slovak-law note: Voluntary DPO appointments, when made, must be notified to the Úrad na ochranu osobných údajov SR via the DPA's online notification form (available at dataprotection.gov.sk), pursuant to Act 18/2018 §44(4).

3. Processing Activities

The following table maps each processing purpose to its legal basis under GDPR Article 6, the categories of personal data processed, the recipients, and the retention period. This tabular format reflects EDPB best-practice guidance for GDPR Article 13 transparency disclosures.

Purpose Legal Basis (GDPR Art. 6) Data Categories Recipients Retention
Account creation and authentication Art. 6(1)(b) — contract performance
Necessary to enter into and perform the service contract		 Email, name, password hash, auth provider ID, email verification status, consent timestamps Google Firebase (authentication); Provider's PostgreSQL database (AWS) Until account deletion; max. 5 years after closure for audit/legal purposes
Receipt management and storage Art. 6(1)(b) — contract performance Receipt images, vendor, amount, currency, date, line items, VAT details (including ICO, DIC, ICDPH on receipts), OCR text, tags, currency conversion data AWS S3 (image storage); Google Gemini API (OCR, if user uploads image); Provider's database (AWS) Until User deletes receipts or account; images in S3 deleted upon receipt or account deletion
AI-assisted receipt data extraction (OCR) Art. 6(1)(b) — contract performance; Art. 6(1)(a) — consent for optional AI processing (disclosed at upload) Receipt images; extracted metadata Google LLC (Gemini API) Images transmitted for real-time processing; not retained by Google for model training under Google Cloud DPA
Bank account connection (Tatrabanka PSD2) Art. 6(1)(a) — explicit consent (user initiates OAuth flow) Encrypted OAuth access/refresh tokens, consent ID, IBAN, account name, balance, transaction history (amount, date, parties, reference) Tatrabanka a.s. (as data source); Provider's database (AWS, encrypted) Until user disconnects bank (tokens immediately deleted upon revocation); cached transaction data retained until account deletion
Automated receipt-to-transaction reconciliation Art. 6(1)(b) — contract performance Receipt metadata, bank transaction data Google LLC (Gemini API, for AI-assisted matching); Provider's internal processing Reconciliation results stored with receipt/transaction; deleted with account
Company Workspace management Art. 6(1)(b) — contract performance Company name, member email addresses and names, role assignments, invite codes, join timestamps Provider's database (AWS); Company Workspace members (read access per role) Until Company Workspace is deleted; member data deleted upon removal from workspace
Audit logging (Company Workspace) Art. 6(1)(b) — contract performance; Art. 6(1)(f) — legitimate interests (accountability within team) Actor User ID and display name, action type, resource ID, timestamp, action metadata Provider's database (AWS); accessible to Company Owner and Accountant role 12 months from event, then deleted; or until Company Workspace deletion if sooner
Data export (CSV/XLSX/YAML) Art. 6(1)(b) — contract performance Receipt data as above; user identity (for export rate-limiting) User's own device (file download); no third-party recipients Generated files not retained server-side after download
Security, fraud prevention, and rate limiting Art. 6(1)(f) — legitimate interests (preventing abuse, protecting the service and users) IP address, User ID, timestamp, request metadata; JWT session tokens Provider's infrastructure; no third-party sharing for this purpose Rate-limit state: 10 minutes; security logs: 90 days
Service communication (transactional emails) Art. 6(1)(b) — contract performance Email address, name Google Firebase (email verification, password reset templates) Until account deletion
Legal and regulatory compliance Art. 6(1)(c) — legal obligation (tax, accounting, AML legislation) Transaction records, account records, consent logs Competent authorities upon lawful request As required by applicable law (Slovakia: 10 years for accounting records per Act 431/2002 Coll.; Czech Republic: 10 years per Act 563/1991 Sb.)
Terms and Privacy Policy acceptance logging Art. 6(1)(c) — legal obligation (demonstrating lawful basis for processing); Art. 6(1)(f) — legitimate interests (compliance demonstration) User ID, version of Terms/PP accepted, acceptance timestamp Provider's database (AWS) Until account deletion + 3 years for compliance evidence
Currency conversion Art. 6(1)(b) — contract performance Receipt amount and currency (no personal data sent to ECB API) European Central Bank Statistical Data API (no personal data transmitted) Conversion rates cached in memory per session; not stored as personal data
Legitimate interests assessment: Where the Controller relies on Art. 6(1)(f) (legitimate interests), we have assessed that these interests are not overridden by the data subjects' rights and freedoms. In all such cases, the processing is limited to what is strictly necessary, the data subjects can reasonably expect such processing, and appropriate safeguards are in place. You may object to legitimate-interest processing at any time (see Section 8.6).

4. Categories of Personal Data

4.1 Registration and identity data

  • Email address (required)
  • Display name (required; may be auto-populated from authentication provider)
  • Password (stored as a secure hash; never transmitted or stored in plain text)
  • Authentication provider and provider-specific identifier (where Google or Apple Sign-In is used)
  • Email verification status
  • Timestamps: account creation, last update, Terms & Privacy Policy acceptance

4.2 Financial and receipt data

  • Receipt images (photographs or scanned files of receipts and invoices)
  • Vendor/merchant name
  • Total amount, currency (ISO 4217), and ECB-converted EUR equivalent
  • Receipt date
  • Line items (product name, quantity, unit, price)
  • VAT summary (rate, base amount, VAT amount)
  • Slovak/Czech fiscal identifiers appearing on receipts: IČO, DIČ, IČ DPH, OKP (security code), receipt ID
  • Selling place / place of issue
  • OCR text (raw text extracted from receipt image)
  • User-defined tags

4.3 Bank and payment data

  • OAuth access and refresh tokens (AES-256 encrypted at rest)
  • Consent ID issued by Tatrabanka
  • IBAN, account currency, account name, product type, balance
  • Bank transactions: amount, currency, booking/value date, creditor/debtor name and IBAN, remittance information, variable/constant/specific symbols, transaction type, direction
  • Reconciliation status (linked receipt IDs)

4.4 Company and team data

  • Company name
  • Member names and email addresses
  • Role assignments (Owner, Worker, Accountant)
  • Invite codes (temporary, single-use, time-limited; expire after 24 hours)
  • Audit log entries: actor identity, action type, resource IDs, timestamps, metadata

4.5 Device and technical data

  • IP address (used for rate limiting; not stored long-term in identifiable form)
  • User-Agent string
  • JWT session token (server-issued; stored in device secure storage)
  • App version (via Flutter package_info_plus)
  • Platform (Android / iOS / Web)
  • User language preference (en/sk/cs)
  • User theme preference (light/dark/system)

4.6 Special category data

The Service is not designed to process special-category personal data (GDPR Article 9) such as health data, biometric data, racial or ethnic origin, political opinions, religious beliefs, or sexual orientation. Users should not upload receipt images or other Content containing special-category data. If special-category data is inadvertently included in uploaded receipts, the Controller will treat it in accordance with applicable law.

5. Recipients and Sub-processors

The Controller engages the following categories of third parties as data processors (Art. 28 GDPR), each bound by a Data Processing Agreement or equivalent contractual safeguard:

Sub-processor / Recipient Entity / Location Purpose Data Transferred
Google Firebase Authentication Google LLC, USA (EU data residency options available) User authentication (email/password, Google Sign-In, Apple Sign-In), email verification, password reset Email address, name, authentication provider data, Firebase UID
Google Gemini API Google LLC, USA AI-powered receipt image analysis and OCR extraction Receipt images (sent for real-time processing); extracted text metadata returned
Amazon Web Services (AWS) S3 Amazon.com Inc., USA (region configurable; EU region required for GDPR compliance) Receipt image cloud storage Receipt images; S3 object keys
Amazon Web Services (AWS) RDS / PostgreSQL Amazon.com Inc., USA (region configurable; EU region required) Primary application database (users, receipts, bank data, company data) All personal data categories (Sections 4.1–4.5)
Tatrabanka a.s. Tatrabanka a.s., Hodžovo námestie 3, 811 06 Bratislava, Slovak Republic PSD2-compliant bank data access (account info, transactions) — only when User initiates bank connection OAuth tokens (issued by Tatrabanka); account and transaction data provided by Tatrabanka
European Central Bank (ECB) European Central Bank, Frankfurt, Germany Exchange rate data retrieval (public API) No personal data transmitted to ECB. Query contains only currency codes and dates.

The Controller maintains an up-to-date sub-processor list. Users may request the current list by contacting .

The Controller does not sell personal data to third parties. Personal data is not shared with third parties for their own marketing or advertising purposes.

6. International Data Transfers

Several sub-processors are located outside the European Economic Area (EEA). The Controller ensures that such transfers comply with GDPR Chapter V:

Recipient Transfer destination Safeguard
Google LLC (Firebase, Gemini) United States EU Standard Contractual Clauses (SCCs) — Google Cloud Data Processing Addendum; EU-US Data Privacy Framework (where applicable). The EU General Court upheld the EU-US DPF in September 2025, but SCCs are maintained as a parallel safeguard given residual uncertainty.
Amazon Web Services (S3, RDS) United States (corporate); EU regions available and required for production data EU SCCs — AWS GDPR Data Processing Addendum; production AWS resources must be deployed in an EEA region (e.g., eu-central-1 Frankfurt or eu-west-1 Dublin) to minimise transfers. Where data is processed in US AWS regions (e.g., for global infrastructure), EU SCCs apply.

Tatrabanka a.s. is a Slovak entity. The ECB is an EU institution. No personal data transfers outside the EEA occur through these services.

You may obtain a copy of the applicable transfer safeguards (SCCs) by contacting .

AWS region requirement: For GDPR compliance, the Controller must deploy all AWS resources storing personal data in an EEA region. This is a compliance action item (see compliance.md).

7. Retention Periods

Data Category Retention Period Legal Basis / Justification
Account registration data (email, name, auth data) Active account lifetime + 12 months after account deletion Contract performance; fraud prevention; dispute resolution
Receipt images (AWS S3) Until deleted by User, or until account deletion (whichever is sooner) + 30-day export window Contract performance
Receipt metadata (database) Until deleted by User or account deletion + 30-day export window Contract performance
Bank OAuth tokens Until User disconnects bank connection (immediately revoked and deleted) Consent; deleted upon revocation
Bank account and transaction data (cached) Until account deletion or bank disconnection Contract performance
Company Workspace data Until Workspace deletion by Owner + 30-day export window for members Contract performance
Audit logs (Company Workspace) 12 months from event creation; or until Workspace deletion Legitimate interests (team accountability)
Consent/acceptance timestamps (T&C, PP) Account lifetime + 3 years after account deletion Legal obligation (demonstrating lawful processing basis)
IP addresses and request metadata (rate limiting) 10 minutes (rate-limit state); security logs: 90 days Legitimate interests (security, abuse prevention)
JWT session tokens Session duration; expire per configured JWT TTL; revoked on logout/account deletion Contract performance
Accounting and transaction records (legal retention) 10 years from end of financial year in which the record was created Legal obligation — Act 431/2002 Coll. on Accounting (Slovakia); Act 563/1991 Sb. on Accounting (Czech Republic)
Invite codes 24 hours from creation (automatic expiry); deleted on use Contract performance

After the applicable retention period, personal data is securely deleted from production and backup systems. Backup deletion may lag by up to 90 days due to backup rotation schedules.

8. Your Data Subject Rights

Under GDPR and applicable national law, you have the following rights regarding your personal data. To exercise any right, contact . The Controller will respond within one month of receiving your request (extendable by a further two months for complex or numerous requests, with notification).

8.1 Right of access (GDPR Art. 15)

You have the right to obtain confirmation of whether we process your personal data and, if so, a copy of that data together with information about the processing (purposes, categories, recipients, retention, safeguards).

8.2 Right to rectification (GDPR Art. 16)

You have the right to correct inaccurate personal data or complete incomplete data. You may update most of your data directly within the Service settings.

8.3 Right to erasure ("right to be forgotten") (GDPR Art. 17)

You have the right to request deletion of your personal data where: the data is no longer necessary for its original purpose; you withdraw consent (where consent was the legal basis); you object and there are no overriding legitimate grounds; the data was processed unlawfully; or deletion is required by law.

This right is subject to exceptions, including legal retention obligations. Receipts containing accounting records may be retained for the legally mandated period even after a deletion request.

8.4 Right to restriction of processing (GDPR Art. 18)

You may request that we restrict processing of your data in certain circumstances (e.g., while accuracy is contested, while an objection is considered, or when you prefer restriction to erasure of unlawfully processed data).

8.5 Right to data portability (GDPR Art. 20)

Where processing is based on contract or consent and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (CSV, XLSX) and to transmit it to another controller. The Service's export function (CSV/XLSX/YAML) directly supports this right. You may also request a full data export by contacting privacy support.

8.6 Right to object (GDPR Art. 21)

Where processing is based on legitimate interests (Art. 6(1)(f)), you have the right to object at any time. The Controller will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, or for the establishment, exercise, or defence of legal claims.

8.7 Right to withdraw consent (GDPR Art. 7(3))

Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Specifically:

  • Bank connection: Revoke at any time from the bank settings screen within the app. OAuth tokens are immediately deleted.
  • AI receipt processing: You may opt out of Gemini AI processing in app settings; OCR features will be limited to on-device processing only.

8.8 Rights related to automated decision-making

See Section 10.

8.9 Identity verification

To protect your data, we may ask you to verify your identity before fulfilling a data subject request. We will not fulfil requests where we cannot reasonably verify the requester's identity.

Slovak-law note: Data subjects in the Slovak Republic may exercise rights under Act 18/2018 §§19–30 in addition to GDPR rights. There is no requirement to pay a fee for exercising these rights under normal circumstances.

9. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe we have processed your personal data unlawfully. You may contact:

Authority Jurisdiction Contact
Úrad na ochranu osobných údajov SR
Office for Personal Data Protection of the Slovak Republic		 Slovak Republic
(lead supervisory authority for the Controller)		 Námestie 1. mája 18, 811 06 Bratislava, Slovak Republic
Tel: +421 2 3231 3214
Email: statny.dozor@pdp.gov.sk
Web: dataprotection.gov.sk
Úřad pro ochranu osobních údajů (ÚOOÚ)
Office for Personal Data Protection, Czech Republic		 Czech Republic
(for Czech-resident data subjects)		 Pplk. Sochora 27, 170 00 Praha 7, Czech Republic
Tel: +420 234 665 111
Email: posta@uoou.gov.cz
Web: uoou.cz

We ask that you contact us first at so we can try to resolve any concerns directly before escalating to a supervisory authority.

Slovak-law note: Unauthorised processing of personal data constitutes a criminal offence under §374 of the Slovak Criminal Code (Act No. 300/2005 Coll.), enforceable by criminal prosecution authorities.

Czech-law note: The ÚOOÚ specifically enforces equal visual prominence of cookie consent buttons (Accept / Refuse all must have similar prominence and colour). See Section 13.

10. Automated Decision-Making and Profiling

10.1 AI-assisted receipt data extraction

The Service uses Google Gemini AI to automatically extract data from uploaded receipt images (vendor name, total amount, date, line items, VAT details). This is an automated processing operation. However, it does not constitute automated decision-making that produces legal or similarly significant effects within the meaning of GDPR Article 22(1): the User retains full control to review, edit, or discard all AI-extracted data before it is saved. No decisions are made automatically without human review.

10.2 AI-assisted bank reconciliation

The Service uses Google Gemini AI to suggest matches between uploaded receipts and bank transactions ("auto-reconciliation"). These are suggestions only — they are flagged for User confirmation and do not take effect until the User manually confirms or accepts the suggested link. This does not constitute automated decision-making with legal effects under Art. 22.

10.3 Rate limiting

Automated IP-based rate limiting is applied to prevent abuse. Where an IP address exceeds the configured request threshold, requests are temporarily blocked. This is a security measure and does not constitute profiling for commercial or discriminatory purposes.

10.4 No profiling for marketing

The Controller does not engage in behavioural profiling, targeted advertising, or automated credit scoring based on User data.

11. Obligation to Provide Data

Data Mandatory / Optional Consequence of not providing
Email address Mandatory Cannot create an account or use the Service
Display name Mandatory (may be auto-populated) Cannot complete registration; required for Company Workspace identification
Receipt images and metadata Optional (core use case, but no obligation) Receipt management features unavailable
Bank connection (Tatrabanka OAuth) Optional Bank integration and auto-reconciliation features unavailable; all other features function normally
AI receipt processing (Gemini) Optional (on-device OCR available as alternative) Automatic data extraction from receipts unavailable; manual entry required
Company Workspace data (company name, member details) Optional Company collaboration features unavailable; personal-use features unaffected

12. Children's Data

The Service is not directed at children. Minimum age requirements:

  • 16 years — Slovak Republic (Act 18/2018 §15, GDPR Art. 8)
  • 15 years — Czech Republic (Act 110/2019 Sb., §7)
  • 16 years — all other jurisdictions (GDPR Art. 8 default)

The Controller does not knowingly collect personal data from persons below the applicable age threshold without verifiable parental or guardian consent. If the Controller becomes aware that personal data has been collected from an underage user without parental consent, that data will be deleted promptly.

If you are a parent or guardian and believe your child has registered for FlowKeeps without your consent, please contact .

Slovak-law note: The national identifier (rodné číslo) is never collected by the Service. Its use for age verification purposes is restricted under Act 18/2018 §78.

Czech-law note: The lower age threshold of 15 (Czech Republic) must be reflected in consent mechanisms for Czech-resident users. This requires a mechanism to determine the user's country of residence at registration.

13. Cookie Policy

13.1 Applicable context

Cookie rules under the ePrivacy Directive (2002/58/EC, as transposed in Slovakia by Act No. 351/2011 Coll. and in the Czech Republic by Act No. 127/2005 Sb. and Act No. 110/2019 Sb.) apply primarily to the website (flowkeeps.com) and any web-based version of FlowKeeps. The mobile apps (Android, iOS) do not use cookies; they use device-local secure token storage.

The EU ePrivacy Regulation proposal was officially withdrawn on 11 February 2025. The ePrivacy Directive and its national transpositions remain the governing law for cookie consent.

13.2 Cookie categories

Category Consent required? Description Examples (current)
Strictly necessary No (exempt) Essential for the website to function. Cannot be disabled without breaking core functionality. Authentication session cookies fall here. Session management, authentication tokens (Flutter web), CSRF protection
Functional / preference Yes — prior opt-in Remember user preferences (language, theme) to improve experience. Language selection, theme preference (currently stored in app, not cookies)
Analytics / performance Yes — prior opt-in
(legitimate interest is NOT a valid basis for analytics cookies)		 Measure usage and performance to improve the Service. No analytics cookies currently deployed.
Marketing / advertising Yes — prior opt-in Track Users across sites for targeted advertising. No marketing cookies currently deployed.

13.3 Cookie consent requirements

When the website is launched, the Controller will implement a GDPR-compliant Consent Management Platform (CMP) — such as Cookiebot or Usercentrics — which must:

  • Block all non-essential cookies and scripts before consent is given;
  • Present "Accept all" and "Reject all" (or "Accept necessary only") buttons with equal visual prominence and colour (required by Czech DPA enforcement practice and EDPB guidelines);
  • Offer granular category-level opt-in;
  • Not use pre-ticked checkboxes (Planet49 CJEU ruling, C-673/17);
  • Not bundle cookie consent with acceptance of these Terms or the Privacy Policy;
  • Disclose cookie lifespan and third-party access for each cookie;
  • Record consent with a timestamp and the specific choices made;
  • Allow easy withdrawal of consent at any time (via a persistent "Manage cookies" link);
  • Refresh consent approximately every 12 months.

13.4 Current status

The Service is in pre-launch. No non-essential cookies are currently deployed. Firebase Authentication, when used on the web platform, may set strictly necessary session cookies. These are disclosed here as required by Art. 5(3) of the ePrivacy Directive regardless of consent exemption.

13.5 Cookie audit

A full automated cookie audit will be conducted prior to public launch to identify all trackers loaded on flowkeeps.com. The results will be used to populate a comprehensive cookie register and update this policy.

14. Policy Updates

The Controller may update this Privacy Policy from time to time to reflect changes in processing activities, legal requirements, or business operations.

For material changes (new processing purposes, new data categories, new third-party recipients, or changes to data subject rights procedures):

  • Affected Users will be notified via email and in-app notification at least 30 days before the change takes effect;
  • Where a material change requires fresh consent, this will be sought before the change takes effect;
  • Users who do not agree with the changes may delete their account prior to the effective date.

For non-material changes (corrections, updated contact information, clarifications that do not affect rights), an updated version will be published with a new "last updated" date, without prior notification.

The current version of this Privacy Policy is always accessible at flowkeeps.com/privacy. The effective date and version number appear at the top of this document.

© 2026 House of Comms s.r.o.  |  IČO: 50649833  |  Privacy Policy version 1.0 — last updated 19 March 2026, effective from .