Privacy Policy

Welcome to PayFlowAI. This Privacy Policy explains how PayFlowAI FlexKapG, trading as PayFlowAI (“PayFlowAI”, “we”, “our”, or “us”) collects, uses, stores, shares, and protects your information when you use our website, platform, products, applications, and services (collectively, the “Services”).

By accessing or using the Services, you agree to the terms of this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Services.

1. Introduction

PayFlowAI provides AI-powered accounts receivable, invoice tracking, payment reminder, collections workflow, and financial operations assistance software for businesses and professionals.

This Privacy Policy applies to:

• Our websites, including www.payflowai.io and related subdomains
• Our SaaS application and platform
• Customer support interactions
• Sales and marketing communications
• Events, webinars, and promotional activities
• Any other interactions with PayFlowAI

This Privacy Policy does not apply where PayFlowAI processes personal data solely on behalf of a customer as a data processor under a separate agreement. In those cases, our processing is governed by the Data Processing Addendum (Schedule 1 to the Terms of Service) and the customer’s own privacy obligations.

2. Who We Are

PayFlowAI FlexKapG is the data controller for the personal information described in this Privacy Policy unless otherwise stated.

Contact Information

PayFlowAI FlexKapG, Doeblinger Haupstrasse 33/14, 1190 Vienna, Austria

Email: privacy(at)payflowai.io Website: https://www.payflowai.io

If you have questions regarding this Privacy Policy or your personal data, please contact us at privacy(at)payflowai.io.

3. Information We Collect

We collect information you provide directly to us, information collected automatically through your use of the Services, and information from third parties.

3.1 Information You Provide

Account Information

When you register or create an account, we may collect:

• Full name
• Business name
• Email address
• Phone number
• Billing address
• Password and authentication credentials
• Profile information
• Company information

Financial and Invoice Data

When using the Services, you may upload or input:

• Invoice details
• Customer and client information
• Payment records
• Outstanding balances
• Financial notes
• Payment history
• Communication history
• Bank or payment-related references

Communications

When contacting us, we may collect:

• Support requests
• Emails and correspondence
• Chat messages
• Feedback and survey responses
• Meeting notes or recordings

Marketing Information

If you subscribe to newsletters, events, or marketing communications, we may collect:

• Marketing preferences
• Event registrations
• Download history
• Website interactions

3.2 Information Collected Automatically

When you use the Services, we automatically collect certain information.

Usage Information

This may include:

• Pages visited
• Features used
• User activity
• Session duration
• Clickstream data
• Search queries
• Interactions with emails and reminders

Device and Technical Information

This may include:

• IP address
• Browser type and version
• Device identifiers
• Operating system
• Time zone settings
• Crash logs
• Connection type

3.3 Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Maintain sessions and authentication
• Improve user experience
• Analyse usage and performance
• Personalise content
• Measure marketing effectiveness
• Prevent fraud and abuse

Types of cookies we use:

• Essential cookies, required for the Service to function
• Analytics cookies, used to understand how the Service is used
• Functional cookies, used to remember your preferences
• Marketing cookies, used to measure the effectiveness of marketing campaigns

You may control cookies through your browser settings. Some Services may not function correctly if essential cookies are disabled. You may opt out of analytics and marketing cookies at any time through your account settings or by contacting us.

4. AI Processing and Data Usage

4.1 AI Features

PayFlowAI uses artificial intelligence and machine learning technologies to provide features such as:

• AI-generated payment reminders
• Invoice analysis
• Collections recommendations
• Cash flow insights
• Communication drafting
• Smart categorisation and summaries
• Workflow automation

4.2 Data Shared with AI Providers

To provide AI-powered functionality, limited customer data may be processed by trusted third-party AI providers, including Anthropic Ireland, Limited.

This may include:

• Invoice text
• Payment statuses
• Email content
• Customer communication history
• Notes and metadata

We require AI providers to:

• Process data solely to provide Services to PayFlowAI
• Maintain confidentiality and security
• Not use customer data to train public AI models unless explicitly authorised
• Comply with applicable privacy and security standards, including the GDPR

Where possible, PayFlowAI implements zero-retention or limited-retention agreements with AI service providers. International transfers to AI providers outside the EEA are made subject to Standard Contractual Clauses (SCCs) adopted by the European Commission.

5. How We Use Your Information

We use personal information to:

• Provide and maintain the Services
• Authenticate users
• Process subscriptions and payments
• Generate AI-powered outputs
• Send invoices and payment reminders
• Improve and develop the Services
• Provide customer support
• Detect fraud and abuse
• Comply with legal obligations
• Personalise user experience
• Communicate updates and service notices
• Conduct analytics and research
• Send marketing communications where permitted

6. Legal Bases for Processing (GDPR)

We are established in Austria and subject to the GDPR. If you are located in the European Economic Area (EEA), United Kingdom, or similar jurisdictions, we process your personal data based on one or more of the following legal grounds:

Purpose

Legal Basis

Providing the Services, account management

Performance of a contract (Article 6(1)(b) GDPR)

Improving the Service, fraud prevention, security

Legitimate interests (Article 6(1)(f) GDPR)

Marketing communications (where applicable)

Consent (Article 6(1)(a) GDPR)

Tax, accounting, legal compliance

Legal obligation (Article 6(1)(c) GDPR)

You may withdraw consent at any time where consent is the legal basis for processing. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

7. Sharing of Information

We do not sell your personal information.

7.1 Service Providers

We share information with trusted service providers who process it on our behalf to provide the Services. These providers are contractually required to protect your data and are listed in Annex A to our Data Processing Addendum. Current providers include:

• Supabase, database hosting and storage
• Vercel, application hosting and infrastructure
• Resend, transactional and reminder email delivery
• Anthropic, AI language model features
• Stripe, subscription billing and payment processing
• Google Analytics, usage analytics and performance
• Google Tag Manager, tag/container management for analytics delivery

7.2 Website Analytics — Independent Controllers

We use Microsoft Clarity to understand how visitors interact with our website, including session recordings and heatmap analytics. Unlike our service providers listed above, Microsoft processes this data as an independent data controller, not as our processor — meaning Microsoft determines its own purposes for processing this data, which may include improving Microsoft's own products and services. Microsoft Clarity is only active on our website after you provide analytics consent through our cookie preferences.

For more information about how Microsoft collects and uses this data, please see the Microsoft Privacy Statement.

7.3 Business Transfers

If PayFlowAI FlexKapG undergoes a merger, acquisition, restructuring, financing, or sale of assets, information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

7.4 Legal and Compliance Requirements

We may disclose information where required to:

• Comply with applicable laws or regulations
• Respond to lawful requests from public authorities
• Enforce our agreements
• Protect the rights, property, or safety of PayFlowAI, our users, or others
• Prevent fraud or abuse

8. International Data Transfers

PayFlowAI FlexKapG is established in Austria (EEA). Some of our service providers are located outside the EEA.

Where required, we implement safeguards for international transfers, including:

• Standard Contractual Clauses (SCCs) adopted by the European Commission (e.g. for transfers to Supabase, Vercel, Resend in the United States)
• Adequacy decisions (e.g. for transfers to Stripe, Google, and Anthropic through their EEA entities), backed by Standard Contractual Clauses for any onward transfer outside the EEA
• Data Processing Agreements with all processors and sub-processors

You may request a copy of the relevant transfer safeguards by contacting privacy(at)payflowai.io.

9. Data Retention

We retain personal information only as long as necessary for the purposes for which it was collected, including:

• Providing Services to active customers
• Legal compliance (e.g. tax and accounting obligations under Austrian law, typically 7 years)
• Resolving disputes and enforcing agreements
• Security and fraud prevention
• Legitimate business purposes

Inactive accounts are reviewed periodically. Account data is deleted or anonymised within 90 days of account closure unless longer retention is required by law. You may request deletion at any time as set out in Section 12.

10. Data Security

We implement industry-standard technical and organisational security measures, as described in Annex B to our Data Processing Addendum, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Role-based access controls
• Multi-factor authentication for administrative access
• Infrastructure monitoring and audit logging
• Secure hosting environments with SOC 2 certified providers
• Periodic security testing

However, no system can guarantee absolute security. We encourage you to use strong passwords, enable multi-factor authentication, and secure your devices and email accounts.

11. Your Rights

Depending on your jurisdiction, you may have rights including:

• Access, obtain a copy of your personal data
• Rectification, correct inaccurate or incomplete information
• Erasure, request deletion of your personal data (“right to be forgotten”)
• Restriction, limit how we process your data
• Portability, receive your data in a structured, machine-readable format
• Objection, object to processing based on legitimate interests
• Withdrawal of consent, withdraw consent at any time where consent is the legal basis

To exercise your rights, contact: privacy(at)payflowai.io

We will respond to verified requests within 30 days. We may request verification of your identity before processing requests.

If you are not satisfied with our response, you have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde): www.dsb.gv.at.

12. Marketing Communications

You may opt out of marketing communications at any time by:

• Clicking unsubscribe links in emails
• Updating your account settings
• Contacting us at privacy(at)payflowai.io

You may still receive transactional or service-related communications even after opting out of marketing.

13. Third-Party Links and Services

Our Services may contain links to third-party websites or services. PayFlowAI is not responsible for the privacy practices or content of third-party services.

We encourage you to review the privacy policies of any third-party services you access through the Service.

14. Children’s Privacy

The Services are intended for business use and are not directed at individuals under the age of 18.

We do not knowingly collect personal information from children under 18. If we become aware that we have inadvertently collected such information, we will take prompt steps to delete it. Please contact privacy(at)payflowai.io if you believe we may have collected information from a child.

15. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including:

• Right to know, what personal information we collect, use, disclose, and sell
• Right to delete, request deletion of your personal information
• Right to correct, correct inaccurate personal information
• Right to opt out, opt out of the sale or sharing of personal information
• Right to non-discrimination, we will not discriminate against you for exercising your rights

PayFlowAI does not sell personal information.

California residents may exercise their rights by contacting: privacy(at)payflowai.io

We will respond to verified requests within 45 days, as required by California law.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements.

If material changes are made, we will notify you by:

• Email to the address associated with your account
• Notice within the Service
• Prominent notice on our website

The date of the most recent update is shown at the top of this Privacy Policy. Continued use of the Services after the effective date of changes constitutes acceptance of the revised Privacy Policy.

17. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us:

PayFlowAI FlexKapG Email: privacy(at)payflowai.io Website: https://www.payflowai.io/privacy

We aim to respond to all enquiries within 30 days.