FlowQix Books Privacy Policy
1. What this policy covers
This policy explains what information FlowQix Books collects, how it is used, who it is shared with, and the choices available to the people whose data it holds. FlowQix Books is a bookkeeping application. Today its only account holder is FlowQix itself; this policy is written so that it also holds when a client's accounts are connected.
2. Information collected
Account information. The email address used to sign in. Sign-in is by a one-time code sent to that address; no password is stored.
Financial account information, through Plaid. When a bank or card account is connected, FlowQix Books uses Plaid Inc. to retrieve, from the financial institution, the account name and type, the last four digits of the account number, balances, and transaction history (date, amount, merchant, and category). FlowQix Books does not receive or store online banking credentials. Those are entered directly with Plaid or the institution.
Financial information entered or uploaded. Statement exports (CSV), receipts, invoices, mileage entries, and the categories, notes, and tax treatments assigned to transactions.
Technical information. Server logs record the IP address, browser, and time of each request for security and troubleshooting. FlowQix Books uses no advertising trackers.
3. How the information is used
- To import, categorize, and reconcile transactions and to produce bookkeeping output: profit and loss, revenue reports, and tax schedules.
- To maintain the integrity of the books over time, including matching transactions across statements and feeds.
- To secure the application, investigate errors, and respond to support requests.
- To meet legal and tax record-keeping obligations.
Financial information is never sold, never used for advertising, never shared for marketing, and never used to train artificial-intelligence models.
4. Plaid
Account connections are made through Plaid Link. By connecting an account, the account holder grants FlowQix and Plaid the right to access and transmit information from the financial institution as described above and in the Plaid End User Privacy Policy, available at https://plaid.com/legal/#end-user-privacy-policy. Plaid may retain the connection to the institution until it is removed. Disconnecting an account in FlowQix Books removes the connection at Plaid.
5. Who the information is shared with
FlowQix does not share financial information with anyone except the service providers needed to run the application, each of which processes data only on FlowQix's instructions:
| Provider | Purpose |
|---|---|
| Plaid Inc. | Connection to financial institutions and retrieval of account and transaction data |
| Supabase Inc. | Database, authentication, and file storage, encrypted at rest |
| Vercel Inc. | Application hosting |
| Resend | Delivery of sign-in codes and notification emails |
| Intuit Inc. (QuickBooks Online) | Only when an account holder chooses to export to QuickBooks |
FlowQix may also disclose information when required by law, or to a professional adviser (such as an accountant) at the account holder's direction.
6. Security
All traffic is encrypted in transit with TLS. Stored data is encrypted at rest. The access tokens that permit retrieval from Plaid are additionally encrypted at the application layer with a key held outside the database. Administrative access to the systems that hold this data requires multi-factor authentication and is limited to FlowQix's principal. FlowQix maintains a written information security policy, incident response plan, and data retention policy, reviewed at least annually.
7. Retention and deletion
Bookkeeping records, including imported transactions, are retained for seven years to meet tax record-keeping requirements, unless the account holder asks for earlier deletion and no legal obligation prevents it. Plaid access tokens are deleted when an account is disconnected. Server logs are retained for no more than 90 days.
An account holder may ask FlowQix to delete their data at any time. Deletion is completed within 30 days of the request, and the connection at Plaid is removed as part of it.
8. Choices and rights
Account holders may at any time: disconnect a financial account; request a copy of the information held about them; ask for corrections; or ask for deletion. Requests go to the contact below and are answered within 30 days. FlowQix does not discriminate against anyone for exercising these rights.
FlowQix Books is not directed to anyone under 18 and does not knowingly collect information from minors.
9. Changes
Material changes to this policy are posted at the URL above with a new review date, and account holders are notified by email before the change takes effect.
10. Contact
FlowQix LLC
dev@flowqix.com